Jump to content

Students - Mandatory Profiles Vs "NETLOGON\Default User" method?

burgemaster

By burgemaster
in Windows Server 2000/2003

 Share

Recommended Posts

burgemaster

burgemaster

Posted
Posted (edited)

Hi all,

 

CURRENTLY:

In AD we have the "Profile Path" for all students empty. We have a modified copy of a "Default User" folder in NETLOGON.

 

When a student logs into a computer they havent logged into before they get a copy of this default user from the netlogon folder on the DCs..

 

This was setup from: How to Create a Base Profile for All Users

But it would seem that this method is possibly way outdated.

 

When a student logs in it doesnt take them too long, they see "setting up internet explorer branding" among other popups, etc etc..

 

If we moved to a mandatory profile method, would this vastly speed up all student logins?

 

Has anyone tried both of the above to compare??

Thanks in advance

Edited by burgemaster
stevenlong1985

stevenlong1985

Posted
Posted

mandatory profile is so much better than roaming profiles, you have more control, and kids cant change any settings. I've kept my Mandatory Profiles below 4mb, which is great for wireless log-on, as its much quicker.

With Roaming profiles they can get very big and corrupted

srochford

srochford

Posted
Posted

What @burgemaster is suggesting is not a roaming profile - the profile won't get copied back to the server when they log off because there's no profile path specified.

 

Given that, he would be better with a mandatory profile but it won't speed up the login process (you need to remove some of the active setup items if you want to get rid of things like IE setup)

 

The mandatory profile will stop profiles being left on machines as users log off (unless the machine crashes or is hard powered off)

burgemaster

burgemaster

Posted
  • Author
Posted (edited)

Ive setup a MAN profile for the test user. a little speed increase which is good.

 

Also Our MAN profile is only 1.7meg.. Could I ask, as its so small am i missing steps that I should have done previously before copying the profile?

I just ran Office and a few other applications.

 

As we have desktop and startmenu setup from the server, can i clear both of these in the profile folder?

 

Thanks in advance

Edited by burgemaster
burgemaster

burgemaster

Posted
  • Author
Posted
The mandatory profile will stop profiles being left on machines as users log off (unless the machine crashes or is hard powered off)

 

I still get a local copy of the profile on the machine mate.

srochford

srochford

Posted
Posted

You have to have the profile on the machine while the user's logged on. @Bio has pointed to a GPO setting (it's for Windows 2000 but I don't think it's changed since) that will delete these profiles when the user logs off.

 

UPHClean makes sure that profiles are closed cleanly at logoff (which is needed so that the group policy stuff can actually make them be deleted) but you can also use delprof (resource kit tool) as part of your machine startup script to clean up profiles which are left over following machine crashes etc.

sted

sted

Posted
Posted
How do you remove active setup items?

 

depending on the item in question run it when creating the profile or in the case of ie/media player gpo

  • Thanks 1
srochford

srochford

Posted
Posted

Active Setup is a system used by a number of installers which need "something" to happen when each user uses the package that has been installed by an admin.

 

If you look in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components you'll see a set of GUIDs which identify various packages. As a user logs on, Windows checks this list and compares it with HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components. If you look at the list under HKLM you'll see that there's a version value for each one. If the version value is different (or missing) under HKCU then Windows runs the stubpath program from the HKLM bit.

 

So, if you want to stop the active setup stuff running, one way is to try and capture what happens after a user logs on but sometimes this doesn't work (it writes stuff into HKCU which points to a user profile path that won't exist for other users or it writes the UNC of a home directory etc). The alternative is to either delete the Active Setup values from HKLM or just add the matching stuff to HKCU

  • Thanks 1
burgemaster

burgemaster

Posted
  • Author
Posted (edited)

This scripts gets rid of all the "Setting up personised settings for internet explorer", etc popups that appear top left when loggin in....

 

@echo off

setlocal EnableDelayedExpansion

set KEY="HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components"

set FND=find /i %KEY%

for /f "Tokens=*" %%a in ('reg query %KEY% /s^|%FND%') do (

set SP=N

for /f "tokens=*" %%b in ('reg query "%%a"^|find /i "STUBPATH"^|find "REG_"') do (

set SP=Y

)

if "!SP!" EQU "Y" reg delete "%%a" /V STUBPATH /F

)

endlocal

Edited by burgemaster
pete

pete

Posted
Posted

It's also worth running through what you're setting in group policy for the users.

 

Sitting down with a bare policy and a stopwatch and adding things one at a time, it's surprising how much time you can trim / add by setting or not setting various things.

 

You can do it with a populated policy too, but it's easier (and safer) to build from scratch in a test OU.

srochford

srochford

Posted
Posted

@burgemaster - I assume you're running that as part of machine startup (or your build process)? A normal user wouldn't be able to delete those values.

 

For most apps, that's not going to cause a problem but I know we deploy some apps (VMWare player comes to mind) where we've put in an active setup that we really do need to run for a user (it's trivial, doesn't display anything on screen and takes a fraction of a second but it was the easiest way to make sure the VM settings are configured properly for the user)

Gatt

Gatt

Posted
Posted

Woould any of this help me with my issue?

 

Since we came back in September I've been getting reports from Staff saying that all their settings have gone from their PC - Outlook settings/Sigs, Pinned taskbar/start menu items (we are using Windows 7)

When I check the Pcs i am seeing a lot of this:

 

username

username.DOMAIN

username.DOMAIN.000

username.DOMAIN.001

etc

etc

 

When I look in it there are random files that haven't been deleted - its not just limited to NTUSER.DAT

 

It's affecting the kids as well, but since they cannot customise their settings, is not a big deal other than loads of profile folders - I have added them all to the Domain Guests group which removes their profile at logoff, but this doesn't help for staff..

I have set a few staff up on Roaming profiles so that most of their settings are saved to the sever, but I would rather not be using them

 

Also not an option for staff is DELPROF.. not too sure about UPHClean - heard its in Beta for win7 and not sure if it deletes the profile

 

I have no idea why its started as there hasn't been any new software or any majopr policy changes made to the Domain.

burgemaster

burgemaster

Posted
  • Author
Posted
Woould any of this help me with my issue?

 

Since we came back in September I've been getting reports from Staff saying that all their settings have gone from their PC - Outlook settings/Sigs, Pinned taskbar/start menu items (we are using Windows 7)

When I check the Pcs i am seeing a lot of this:

 

username

username.DOMAIN

username.DOMAIN.000

username.DOMAIN.001

etc

etc

 

When I look in it there are random files that haven't been deleted - its not just limited to NTUSER.DAT

 

It's affecting the kids as well, but since they cannot customise their settings, is not a big deal other than loads of profile folders - I have added them all to the Domain Guests group which removes their profile at logoff, but this doesn't help for staff..

I have set a few staff up on Roaming profiles so that most of their settings are saved to the sever, but I would rather not be using them

 

Also not an option for staff is DELPROF.. not too sure about UPHClean - heard its in Beta for win7 and not sure if it deletes the profile

 

I have no idea why its started as there hasn't been any new software or any majopr policy changes made to the Domain.

 

We had that exact problem, what was happening was the profiles were attempting to be deleted (I think it was a GPO setting) and failing. When the user logged back in it failed to let them use the half deleted profile so created a new one. I will look back through my posts to see how we solved it!

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


×
×
  • Create New...