Zenden

just a little more info regarding the profile and making it 'generic'. Hopefully this clarifys it a little. If you host a mandatory profile on your server eg \\server\profiles\profile1 then when someone logs in the PC copies \\server\profiles\profile1 to c:\users\username\ and then that folder is theirs to use but when they logoff changes aren't saved. The process is no different in this case, it is just copied from c:\profiles (or wherever you are putting it) to C:\Users\username . Once it is copied, only then does the user interact with the profile and only on their specific copy. So their shouldn't need any extra work to keep it generic other than standard mandatory profile setup. Does that make sense?

I think I will need more info eean. I am following a standard method for creating a mandatory profile that you would follow if you held the profile anywhere else, the only difference is that it is on the C Drive rather than on the network. Sounds to me like the profile was corrupt somehow. Have you tried manually copying the profile onto a pc as a test rather than doing it through gpo script? It also shouldn't matter where you specify the profile path, I just wanted it to apply to all users who use the machine as I am applying this setup only to PCs which are treated like hotdesks with people swapping and changing (eg IT Suites, Teacher PCs in classrooms). I didn't want it to always apply to certain users as they are given more freedom to customise their configurations on their own PCs in their offices or on their own laptops. Definitely sounds to me like the issue is with the profile itself rather than anything specific about this setup.

are you not preserving permissions Chris? I had assumed this would be needed for the profile to work?

Fantastic, thanks again Chris. I will give your robocopy script a go. I assume the switches included in that copy the files with the same permissions aswell?

Thank for the info Chris, Can you clarify your use of robocopy as I dont have much experience with it. If you make a change to the central profile does it copy out only those individual changes and otherwise copy nothing? if so, that is very useful! Also, do you find the slight issue where sometimes the desktop loads before the wallpapaer? if not can you clarify how you are setting the wallpaper? and finally one more question, can i add your setup to my original post so this becomes a central place for the info?

oops didn't answer a coupleo f your questions with my first reply. We redirect docs/downloads/music/videos/pictures and we use mandatory profiles (user.man)

Glad it was useful for you. The GPO is a computer based GPO and is found at Computer Configuration\Policies\Administrative Tempaltes\System\User Profiles\Set roaming profile path for all users logging onto this computer To clarify about the library file issue: Windows 7 libraries are controlled/setup by library-ms files hidden in the appdata portion of the userprofile. They are automatically created for a user when their profile is first created. I have found that by setting things up as I have done (removing the active setup for bits and bobs) that if a user logs in who does NOT have a roaming or mandatory profile and also does NOT already have a local profile on the computer and therefore a new one is created when they login that the library-ms files do not get created and the libraries appear completely blank. I am guessing this problem is caused by the removal of the activesetup for windows desktop update but I have not got to the bottom of it. It doesn't particularly matter since all users who login to the pc are using the mandatory profile anyway but I thought it was worth noting.

fair enough, we ll to my knowledge i dont think it can be done this way since computer policies are applied earlier. I can only think to move your policies to user based rather than computer based.

yes this is true, perhaps you would be best trying to apply as much of your policies at user level rather than computer.

out of curiosity, why would you want to set it up this way? i find seperate OUs a hell of a lot easier to manage then trying to setup a complicated permissions based structure in group policy.

my apologies, i think i misunderstood your question. You want your staff and student computers in the same ou but to filter which policy is applied to the computer based on which user logs in? this wont be possible as computer policy processing is applied before any user can login. I would put two sub-OUs inside your computers ou, one for staff and one for students.

(going off memory here). I think you need to change permissions on the gpo to apply group policy to the group "domain computers" and then add the user group you want too (eg staff). Make sure "authenticated Users" is not set to haev the policy applied as this includes all domain computers and all domain users. This way the computer portion of the policy is applied to all computers in the ou but the user portion of the policy is only applied to the correct user group.

Fantastic, i think i will be getting one of these then. Cheers.

How long have you had this Chris? Just read the reviews and one of them pretty much says that it died really quickly when being used for a student ICT Suite!

My School will be advertising for an ICT Apprentice within the next month or so through InTraining and their apprenticeship scheme.

That's fantastic, thanks very much.

Boot To desktop, More control over the start screen and the start button back are the three things I have been saying were needed before I considered win8 at our school. This makes me very happy. Do you know if we will be able to force the start screen to open to the "all apps" page straight away instead of the pinned items?

is it always the same laptops or the same model laptops? do different model laptops work ok?

just a thought here - you have it set to "wait for the network" but it is possibly timing out before applying any GPOs. Have these devices ever applied the GPOs (via a cable maybe?). If this issue has always been happening then it has never actually applied the wait for the network setting or the policy processing time. bit of a chicken or egg situation possibly.

I second michaels point about forcing aes, not just for this reason but I have found multiple encryption types actually reduced performance with our wifi.

is the wireless being managed by windows or a third party program? if it is windows, is the service set to startup automatic?

Minor Bug found with this setup - The DesktopSwitchTimeout setting causes the PC to load the desktop before loading a wallpaper (if you set wallpaper by group policy) sometimes. This issue is intermittent and actually resolved itself because the wallpaper loads afterwards.

Glad to see it helped you out. Regarding the mandatory profile, I just hunted through the folders looking for large sizes so that was quite easy. Regarding the tweaks, it was mostly through research and trial and error, I did a lot of timing of the login process with verbose logging on so I could see which bits were taking the most time. I also checked the group policy event logging to see the exact times which policies were taking to rule those out. By the end I knew that "please wait for the user profile service" and "preparing your desktop" were the biggest culprits and found through research that the first one was copying the profile across the network and the second one was related to the active setup stub paths and the desktopswitchtimeout. I am still hunting and trying to improve on it and was hoping that this thread would lead to others sharing new tricks Let me know anything more you find.

This issue did return intermittently but has lessened a fair bit (now once every week if that). I have enabled the setting as linked Richard to 90 seconds and will review it over the next half term, hopefully this will be the end of it. Thanks very much.

Hi Richard, My apologies for the delay in getting back to you, i did not notice your response! Did you have the event logs listed on that microsoft KB when you had the problem? My event logs were only showing event 1006 (which is LDAP bind failed)