How can I edit our mandatory profile?

[reggiep]

Our mandatory profile was created ages ago and I can't remember how, as is always the case with me if I haven't done something in the last month I forget it.

 

I'd like to edit ours as all the users have to refresh internet explorer the first time they open it to get the home page and then they have to click a check box and I'm pretty sure a change to the profile couild fix this.

 

Please help this mans confused brain!

[mrbios]

open registry editor, click on HKEY_USERS, go to file > load hive, select the ntuser.man and name it anything.

 

You can edit all the registry stuff there, just remember to unload it to save the changes you make.

 

(i think that's what you're after anyway?)

[localzuk]

The way I do edits to mandatory profiles is to make a copy of it, change the ntuser.man to ntuser.dat, assign that copy to an account, edit what I want to and then do a 'copy to' in System Properties->Advanced->User Profiles, to create a clean version where I change the ntuser.dat back to ntuser.man.

[K.C.Leblanc]

open registry editor, click on HKEY_USERS, go to file > load hive, select the ntuser.man and name it anything.

 

You can edit all the registry stuff there, just remember to unload it to save the changes you make.

 

(i think that's what you're after anyway?)

 

I wouldn't do that with a live profile, make a copy edit the copy, test the copy then implement.

 

The other method for editing the profile is (and like the above make a copy and work on that);

 

Rename ntuser.man to ntuser.dat, if the profiles name ends .MAN remove this.

 

Assign the profile to an account with not GPOs applied, no mapped drive or printers.

 

Make sure that the above account has permissions to make changes to the profile (at both file and share level).

 

Log in using the account.

 

Make changes.

 

Double check that you haven't left behind anything you don't want in the profile.

 

Log out, making sure you give the system time to log out fully and save the profile.

 

Rename NTUSER.dat back to NTUSER.MAN. Replace .MAN to the end of the profile.

 

Test the profile.

 

Switch over to new profile (rename the old one, then rename the copy to the old profile's name).

[mrbios]

Should of mentioned in my post that i make a copy and edit that and not the live profile

[reggiep]

The way I do edits to mandatory profiles is to make a copy of it, change the ntuser.man to ntuser.dat, assign that copy to an account, edit what I want to and then do a 'copy to' in System Properties->Advanced->User Profiles, to create a clean version where I change the ntuser.dat back to ntuser.man.

 

This is ringing bells, I shall try this first!

 

thanks

[reggiep]

I must be doing something wrong in this very simple process!

Once I have finished and I copy the profile back on to the server and rename ntuser.dat to ntuser.man, allocate that profile to a user and they then log on they have problems!

No scripts are run or GPOs applied as far as I can tell.

Which bit did I do wrong?

 

Thanks

[localzuk]

I must be doing something wrong in this very simple process!

Once I have finished and I copy the profile back on to the server and rename ntuser.dat to ntuser.man, allocate that profile to a user and they then log on they have problems!

No scripts are run or GPOs applied as far as I can tell.

Which bit did I do wrong?

 

Thanks

 

How are you doing the copy back?

[reggiep]

After logging off as my profile user, I reboot, log in as domain admin, then do a 'copy to' in System Properties->Advanced->User Profiles across to a folder that also contains my other mandatory profiles folder. I then rename the ntuser.dat to ntuser.man?

[localzuk]

That should work fine. Have you got permissions all set correctly on the profile?

[reggiep]

I think so, I will have a look again.

[reggiep]

Yep, all permissions exactly the same.

 

Having just reread K.C.LeBlanc's post, I will have to check that my user doesn't have any gpos applied to it. I'm pretty sure my user does have them applied.

[Gibbo]

I'd like to edit ours as all the users have to refresh internet explorer the first time they open it to get the home page and then they have to click a check box and I'm pretty sure a change to the profile couild fix this.

 

Is this not a combination of turning off any "first use" settings in Group Policy and deleting any STUBPATH entries in the Registry? HLMK - SOFTWARE - MICROSOFT - ACTIVE SETUP

[reggiep]

I don't know! I'll take a look though.

[Gibbo]

Is it IE7 or IE8? We're on 8 here. ISTR someone having similar problems when IE7 came out, so we delayed the upgrade.

[reggiep]

Stuck on IE7 due to old software that won't run on 8!

[KK20]

Try computer -> admin -> windows components -> I.E. -> Prevent performance of first run (go to home page).

 

Also IE8 is a real sod inregards to proxy settings and local CUSTOM settings. Local CUSTOM settings are applied "on launch" therefore overriding your GPOS. GRRR!

 

Also if someone has a local cached profile that was wasnt mandatory (.dat) then the following could happen: they login, the .MAN is copied but the previous .DAT takes priority, hence the .MAN is never used. Worst still, the .DAT is migrated back when they log off. GRR!

[BJG]

Our mandatory profile was created ages ago and I can't remember how [to edit it], as is always the case with me if I haven't done something in the last month I forget it.

 

Likewise.

 

The way I do edits to mandatory profiles is to make a copy of it, change the ntuser.man to ntuser.dat, assign that copy to an account, edit what I want to and then do a 'copy to' in System Properties->Advanced->User Profiles, to create a clean version where I change the ntuser.dat back to ntuser.man.

 

OK, I'm trying that, but getting confused. Is this still the relevant approach for Server 2008 R2 / Windows 7...? I copy the profile to a new .v2 folder, but when I try to log back in as the relevant user I get: "The Group Policy Client service failed the logon. Access is denied."

[localzuk]

Likewise.

 

 

 

OK, I'm trying that, but getting confused. Is this still the relevant approach for Server 2008 R2 / Windows 7...? I copy the profile to a new .v2 folder, but when I try to log back in as the relevant user I get: "The Group Policy Client service failed the logon. Access is denied."

 

No. You have to craft your profile during initial setup of a machine, before sysprepping it - then once the machine has booted, you can copy the default profile off and rename that how you wish.

 

This is the Microsoft article about it - Customize the default local user profile when preparing an image of Windows

[BJG]

Thanks for the reply, but I'm not sure what you mean...we have a working mandatory profile with Windows 7 clients, but I need to make a change to it.

[localzuk]

Thanks for the reply, but I'm not sure what you mean...we have a working mandatory profile with Windows 7 clients, but I need to make a change to it.

 

What sort of change? It depends what changes you need to make.

[BJG]

I'm actually trying to cure a strange glitch when the students run Excel, whereby they frequently receive a "Could not open file" error when trying to open documents until they run IE and close it. (Strange but true).

[localzuk]

You should be able to open the ntuser.man file using regedit if you need to edit the registry. Editing other things will mean you have to go back to the original creation stage but I'm not sure. Not sure about the app data part though!

[stylemessiah]

As far as my own mandatory profile, albeit on a standalone PC, if i want to edit anything, i just rename the ntuser.man to ntuser.dat, log in as the user that the logon is assigned to, edit away. once done i just logout and rename the ntuser.dat to ntuser.man again.

 

If however youre trying to edit things that may be disallowed via GPO and arent editable when logged in as that user (though you can temporarily disable GPO's), and it is a simple change/edit that can be made via regedit, i would try the aforementioned load the ntuser.man hive, assign it to a temporary key (i always use 11111111) in regedit and edit the necessary registry entries, then unload the hive and test.

Edited May 13, 2013 by stylemessiah

[stylemessiah]

No. You have to craft your profile during initial setup of a machine, before sysprepping it - then once the machine has booted, you can copy the default profile off and rename that how you wish.

 

This is the Microsoft article about it - Customize the default local user profile when preparing an image of Windows

 

Sorry to go OT, but...

Thats actually not the only way to do it. Thats what Microsoft SAY is th eonly way to do it properly....

 

See my posts

here: http://www.edugeek.net/forums/windows/81112-mandatory-profile-group-policy-preferences-2.html#post938300

and here: http://www.edugeek.net/forums/windows-7/109909-prevention-file-creation-etc.html#post941148

 

Between those two are the methods and tools i used to set up my mandatory profile - kiosk/guest user standalone PC

 

Its targeted at a non domain PC with roaming profile, my needs were quite specific, but its good info to have in case you go down this path someday

 

I use DefProf from ForensiT Free Downloads to copy over the customised profile to default, this tool does it properly, unlike every other way suggested, and it avoids having to do the sysprep garbage

 

I really need to combine those posts into one, if only for my own records ....

Edited May 13, 2013 by stylemessiah