Super Duper fast mandatory profiles

[Rozzer]

How do you people do it? I have setup mandatory profile by doing the following.

 

1) Setup a local user account with admin rights. Make any changes if necessary

2) Log off and copy user accounts profile from users folder and store in profile share

3) Set permissions to authenticated user on folder in share.

4) Load registry hive and give authenticated users full control.

5) Set AD path and wait for what should be a fast login. (Sticks with preparing desktop 30 seconds) Total login 40 - 50 seconds.

 

What am I doing wrong? The machines are generally quick intel core 2 duo with 2gb ram runs fine when in use.

 

I have looked online and read a lot of other threads and I am pretty sure I did what is stated above.

 

Thanks as always

 

Ross

[elsiegee40]

Take a look at the size of the mandatory profile. They can be enormous. Doing simple things like deleting cookies before conversion to .man can drastically reduce the size

[3s-gtech]

Rather than creating the profile from a local user, I set a network user within the Users group in AD, therefore they have high level permissions already. Then I do as above. The profile is around 2MB. Edited March 12, 2012 by 3s-gtech

[Rozzer]

The size is of the profile is 2MB. So I am doing it the right way?

[3s-gtech]

If they can log on with it, the method is fine. I've just purged mine a bit and got them to 1.2MB, smaller the better really - have a look at this too Some Mandatory Profile Best Practices *** Updated April 16th 2010. « AppSense

[DavidYoung]

I've just purged mine a bit and got them to 1.2MB

 

Ours is 700kb, do I win?

 

Admittedly, ours isn't a mandatory profile, but a network default profile, but the principle is the same.

 

EDIT: Thanks for that link by the way, looks like good info, might have another poke around our profile and check some of what they suggested.

Edited March 12, 2012 by DavidYoung

[FN-GM]

I store ours on the local C drive instead of a share

 

What does it get stuck on when loggin on?

[3s-gtech]

Ours is 700kb, do I win?

 

Yes

[Rozzer]

I store ours on the local C drive instead of a share

 

What does it get stuck on when loggin on?

 

At the moment mainly folder redirection and preparing your desktop. I have considered storing it on the local drive.

 

I removed all the content out of shell folders in the mandatory profile, which should of speeded up folder redirections

[FN-GM]

At the moment mainly folder redirection and preparing your desktop. I have considered storing it on the local drive.

 

I removed all the content out of shell folders in the mandatory profile, which should of speeded up folder redirections

 

Do you block desktop.ini files?

[Rozzer]

Not that I am aware off. I have noticed that if I re-login again after an initial login it takes 8 seconds to login.

[Rozzer]

Just noticed the error logs.

 

 

Windows cannot log you on because your profile cannot be loaded. Check that you are connected to the network, and that your network is functioning correctly.

 

DETAIL - Unspecified error

 

Helpful error lol

[3s-gtech]

That's a classic permissions error, either on the profile folder or the ntuser.man. Double check that you've set the permissions recursively on the hive (this does not happen by default!)

[Rozzer]

That's a classic permissions error, either on the profile folder or the ntuser.man. Double check that you've set the permissions recursively on the hive (this does not happen by default!)

 

The hive has authenticated users read and write access and so does the profile folder. Should they both be read only?

 

Ross

[3s-gtech]

The hive should have Auth Users or Everyone full access, they need to be able to read and write it. The profile folder should be in a share (if it's a network one) with Auth Users or Everyone full control on the share, and NTFS permissions set as Read/Execute. Again, both the registry hive and the profile need to have these set recursively - I had the exact same issue and it was due to not having propogated the permissions down far enough on the hive.

[gshaw]

How comes no-one seems to be doing it via the MS-supported sysprep method?

 

When we do ours I'm going to use a VM, snapshot before running the sysprep command then once I've got what I need revert the snapshot back to re-use next time round... will post results when we do it

Edited March 13, 2012 by gshaw

[3s-gtech]

I don't do it that way because it seemed to be massively more hassle as well as time to create. Been a while since I looked though.

[gshaw]

I guess question is whether the time spent troubleshooting issues that might arise as a result of doing it an unsupported way is worth what you save initially...

[3s-gtech]

Good point, it does work fine with a bit of testing though. Edited March 13, 2012 by 3s-gtech

[mrkn9]

Yes. Please how did You Do it?

[detjo]

I don't have .man profiles.

I create profile as a local admin account then copy it to Default User in Netlogon