Local admins and Mandatory Profiles

[Bobo]

(At first posted in networks folder then realized it is more of a windows problem)

 

Hello there, first post on the forum so I thought I'd say hello at least. Only just found out about this forum, was posting a little on icttechnician but that site seems to have sadly passed away. Was looking for a bit of advice on a few recent problems.

 

I mainly work in primary schools so sometimes I can be a little less strict than maybe I should as it is rare that kids try much. Out of "convenience" (mainly for myself) I have in the last year made mandatory profiles for everyone but also made everyone a local administrator, meaning a lot of the older software does not have a hissy fit. Problem is, some of my schools are more rough than others so the kids will push their luck a lot more. Certain IM's will be installed and be useable and the such with local administrator rights and I feel it is now time to lock down all of my schools.

 

Problem is, I have one mandatory profile for all the kids and it works fine when the users are local admins. As soon as I take the privelidges away the profile just isnt right. The desktop and start menu icons are not the locked down ones from AD. The profile isnt being picked up or implimented properly. It has to be something security related I'm sure? And I know there are people here who would know how to answer the question.

 

So what do I need to do to make mandatory profiles work without users' needing to be local admins?

 

On a seperate note, do you all create images for each new type of desktop or laptop. I have always used a combination of sysprep and windows repair to make one good image work on all the Pcs in my schools. Do you all make a new image or share them where possible. As the one I have not yet managed to make work or found an answer to sorting yet is the HP Nx6325, no matter what I do it will always either blue screen or die in some way shape or form, even if I remove all hardware, get into safe mode or any tricks that have always worked before. Anyone know any sneaky tricks, or do you all just recreate images?

 

Thanks for all your help anything would be hugely appreciated.

[NetworkGeezer]

Problem is, I have one mandatory profile for all the kids and it works fine when the users are local admins. As soon as I take the privelidges away the profile just isnt right. The desktop and start menu icons are not the locked down ones from AD. The profile isnt being picked up or implimented properly. It has to be something security related I'm sure? And I know there are people here who would know how to answer the question.

 

So what do I need to do to make mandatory profiles work without users' needing to be local admins?

.

 

It sounds like that the registry permissions on the NTUSER.MAN hive file weren't change to allow other users to use the profile. This is why it only works for local admin. Redo the profile but when you copy it make sure you change the permissions.

[dodgydave]

We use one image for single processor PCs and one for Dual processor PCs (different HAL). Its easy, you just collect together all the drivers that you need for the different machines in a folder on the Hard Drive and Download and run the Sysprep Driver Scanner from Vernalex.com (its free). Then you run Sysprep as normal. Once you have ghosted the machine you will be able to use the image on any of your machines.

[Bobo]

Thanks for the help. One good thing I like about forums like this is the friendliness.

 

I do not actually copy the profile into each of the users' directories so only have one profile for all the kids, or a group of kids pointing to the main man profile. Can I still change the permissions without profile recreation and how would I go about doing it? It seems this is something I have completely overlooked so have little knowledge on it so any help would be great.

[Bobo]

We use one image for single processor PCs and one for Dual processor PCs (different HAL). Its easy, you just collect together all the drivers that you need for the different machines in a folder on the Hard Drive and Download and run the Sysprep Driver Scanner from Vernalex.com (its free). Then you run Sysprep as normal. Once you have ghosted the machine you will be able to use the image on any of your machines.

 

I think that is the problem with the Nx6325. It is a 64 bit AMD as opposed to a 32 bit Intel, not different HALs in the windows sense but a different processor, so would that matter? The nx6325 has a lot of hardware with 3rd party drivers, it could always be any of that causing hte problem.

 

Is there any way around the differnet HAL problem though? Could you not make the computer a simple Pc before sysprep then clone, then repair it making it back to a better HAL then image again?

[dodgydave]

We only have a couple of 64 bit AMD machines on campus and have ended up just creating custom images for them to make our life easier. For everything else we just use the standard images.

[Bobo]

Ah yeah, that is the direction we have had to take at a few schools, just dont want to work those 64 AMDs, so am recreating them as we speak. Was just hoping and wishing someone would say "no, dont recreate the images, I have a foolproof solution" but no such luck.

 

Still though, anyone know how to change hive permissions on a profile after it has been created and used as a mandatory profile?

[Bobo]

Did some research and worked out the hive permission problem, thanks everyone. Still though, if anyone has any more light on AMD 64s with intel 32s I would be much appreciated knowing.

[NetworkGeezer]

I do not actually copy the profile into each of the users' directories so only have one profile for all the kids, or a group of kids pointing to the main man profile. Can I still change the permissions without profile recreation and how would I go about doing it? It seems this is something I have completely overlooked so have little knowledge on it so any help would be great.

 

A copy of the mandatory profile is cached/copied to the PC student is on when they log in. That's how how changes are obliterated from session to session.

 

You could use either the programs regedit or SubInAcl.exe or SetACL to change registry permissions. SubInAcl is a Microsoft download and I think SetACL is opensource availible at soureforge.net

 

It will probably be a bit fiddly to retrorespectively change user hive registry permissions. You have load NTUSER.MAN into HKUSERS then make the required changes and (never forget to) unload it again.

 

It is much easier to create a test account on clean machine, configure the profile to how it would appear to the users. After this is done just copy the profile to a central location using the profiles screen from the Advanced tab of the system properties dialog (control panel or press Win+Pause). Make sure the Permitted to Use field is set to Authenticated Users.

[Bobo]

After some research I loaded the ntuser.man into hkusers in the registry. I then right clicked the whole profile while loaded and allowed "everyone" to be read only. I then unloaded the hive again. It wasn't that fiddly as I was only changing one user profile.

 

But still when I log in everything isnt right still.

[NetworkGeezer]

After some research I loaded the ntuser.man into hkusers in the registry. I then right clicked the whole profile while loaded and allowed "everyone" to be read only. I then unloaded the hive again. It wasn't that fiddly as I was only changing one user profile.

 

But still when I log in everything isnt right still.

 

You should give Everyone full permission. If only give students readonly access to the mand hive then then GPOs can't be applied because the student can't make changes to their downloaded copy of the NTUSER.MAN.

 

Mandotory profiles ignore user made changes because unlike a roaming profile those changes aren't copied back to the server.

 

You did also rember to unload the hive. Regedit doesn't do this automatically. If a hive is still loaded then it is effectively locked and can't be used a user. That's nice little gotcha courtsey of our friends in Redmond, WA.

[maniac]

Make sure the directory or share you're actually hosting the mandatory profile in has the correct read permissions as well, and also the actual user.man file. Silly point, which I expect you've relised already, but thought I'd suggest it all the same.

 

Mike.

 

edit: thinking about this, you'd get a glaring big error if this was wrong, so ignore the above.

[Bobo]

I gave them full control but still the profile isnt the same... very odd. Doesnt seem to be working

[maniac]

Have you made sure you've removed all traces of old profiles from the machine you're testing it on to make sure it can't be using an old copy of the profile that might be remaining on the workstation. There's a little utility call DELPROF in the windows resource kit (I think) that removes all profiles from a workstation.#

 

Mike.

[Bobo]

Right, I thought, scrap it and start from the start:

 

So I created a new account lets call X. Gave it admin rights to start with and created the profile and changed all the settings. Then logged out and gave X normal rights, logged in and it was super duper working with all the normal shortcuts as the account should be.

 

Made X profile sharable to Y account. Went into the registry and changed the hive privelidges to everyone with full control. Logged in with Y and the desktop and start menu has twice the shortcuts it should.

 

Any ideas? FYI I use ranger as a lockdown with GPOs.

[Bobo]

Have you made sure you've removed all traces of old profiles from the machine you're testing it on to make sure it can't be using an old copy of the profile that might be remaining on the workstation. There's a little utility call DELPROF in the windows resource kit (I think) that removes all profiles from a workstation.#

 

Mike.

 

Just tried it with a brand new account and still the same problem

[maniac]

Do you use ranger for your start menus and desktops as well?? If so, Edit the mandatory profile and make sure there are no entries for startmenu and desktop location within the mandatory profile. (I also run a mandatory profile with ranger, and had a few issues of a simelar nature when I was getting it working.)

 

Mike.

[Bobo]

Any idea where these settings are in the man profile? Dont wanna delete something I need

[maniac]

The settings are located at;

 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

 

Obviously replace HKEY_CURRENT_USER with your mandatory profile name.

 

There's also various other settings there which you might want to remove or change according to your network, but the two main ones are Desktop and Startmenu.

 

Mike

[Bobo]

Oh, you got me all excited there. Gave it a go, didnt make any difference, the actual path in the profile was fine in the first place. It feels it's just not loading the profile at all and just getting the default profile.

 

But it's nice to know how to manually edit a profile for the future.

[ajbritton]

How to set up Mandatory Profiles is here

[maniac]

If you're using ranger for your desktops and startmenus I would remove these values to be on the safeside. Ranger should step in at logon and replace them with whatever is programmed into ranger.

 

Insted of setting up an admin user and creating the profile using an admin user try seting up a normal user with a roaming profile (as oppose to using the mandatory one) log this user on and off, and use this as the template for your mandatory profile. The fact it's created by a normal user and not an admin user might make a difference.

 

Also what share are you hosting your profile in?? Whatever share it is must be accessible to the system, not just the user (I think) I host my mandatory profile in \\school\SYSVOL\school.local\scripts\Students Policy where it works fine.

 

Mike.