ramsay

Hi, Our staff mainly use laptops that they also take home. They have roaming profiles as they do use other computers sometimes. When connected to the network it's fine, but when offsite/not connected, the computer hangs for 1 minute exactly saying "waiting for user profile service" or similar before loading a cached profile. We would like to reduce this wait time to 10 seconds. I have played around with GPO settings such as "timeout" and "slow network connections" etc but anything I change does not seem to affect the 1 minute hang time. Any ideas? Thanks

It turns out that the computers had "\LOCAL" listed as a local administrator. That seemed to be giving everyone local admin rights! No idea how that got there or if it's a Windows default. I put a GP setting to remove this from the local administrator group and all looks OK now. Thanks

Thanks for the replies. I will investigate...

Hi, If a student runs an exe installation file it will say that it wants to make changes to the computer, they can select yes and it installs. This is very strange, as it does not ask for admin credentials and they are only a member of "domain users". Is that normal? Can we disable this access either before or after they click yes? I've played around with GP settings to deny elevation requests but they do not seem to do anything. Thanks

Just found today a few students who have the right printer listed (in Control Panel and Office) but in Adobe Reader there is another printer there (set as default)! It is likely that these students were in the room with this printer but even though Windows has removed it (after they logged on somewhere else) Adobe Reader still shows it. I don't think this is the original problem, as people had been printing from other applications. I'm sure it has got better but it's still happening (hopefully just Adobe Reader now!). I wonder where this setting would be stored. I looked in the AppData/Roaming/Adobe folder of their profile but cannot see anything obvious. I guess I need to find a way to exclude the file/folder where this setting is saved to avoid it happening. Fresh settings for Adobe Reader each time is fine. Any help appreciated. Thanks

OK thanks, I will set up our printers using that guide when I get a bit of time and see how that works for us.

> Could I just ask why you are giving users local admin access instead of just power users? I don't mind what they to do their laptops. If they mess the software up I just re-image it which takes 5 minutes of my time. > Have you tried assigning the GP to an OU containing users? Also I take it your FRDC is 2008 R2? It should be a computer configuration, as otherwise the user will be a local "Administrator" on any computer they use. > Computer settings do not apply on user login, they apply on startup so I would guess there is another setting in the policy or something. > Try disabling the user configuration settings on that group policy and see if it still does it. That's what I thought, can't imagine why it's causing an issue when they are logging in! It is definitely that setting rather than the GPO as the GPO is still active, I just removed the one specific setting.

> If you deploy printers per computer, then it's available to any user who logs on. > If you deploy printers per user, then you can control who has access to what a lot easier. In our environment "per computer" is what we want, and it appears to be working OK (just this strange phantom printing) > If you are using roaming profiles then yes the printers can follow the users. Yes, that's what we found so we now have logon/logoff scripts to delete all printers > I use GPPs to map printers and the first thing that runs is a deletion of all existing printers > before processing the rest. Works flawlessly every time. Not heard of GPP. Or is that just adding printers through GP? Thanks

Hi, New Windows 7 installation. We used GP[1] to add (AD group) members of "Staff" to the local "Administrator" group. This seemed to work OK (members of "Staff" had local admin rights) but about a month later people started to get stuck logging in at "applying local user and groups policy". I removed this setting in GP and the issue went. Some months later I put it back and the issue returned the next day. At least I'm happy to have narrowed it down! How do you give "local admin" access for staff members automatically? Or does the GP setting work for you? [1] we put the GPO in an OU containing computers. The setting is under "Computer config, Prefs, Control panel, Local users and groups". Thanks

Thanks for the info. As a quick attempt for a fix I set the "delete all network printers" command (reg delete "hkcu\printers\connections" /f) as a logon script (as well as the existing logoff script) just to make sure all printers were being deleted. I didn't know if that would interfere with the GP setting to add printers when they log on but it seems fine, and so far all is looking good!

Thanks for the advice. What commands do you run to add and remove printers in the script? How do you check what room they are in? By computer name? Thanks

When adding a printer using a GPO, the issue we have is the printer is added, but there is no port listed (so it doesn't work). In the GPO settings I have specified a port and path (both the same); \\server\printer. Adding the printer manually with these settings works. Any idea why the port isn't listed? The options are greyed out from the PC and no port is ticked. Thanks

I'm not using GP itself to add the printers, but the Print Management software which uses a GPO to push the settings somehow. I think I did originally try using GP but it wasn't working. I'll give it another go and let you know my findings. Thanks

Hi, We use Windows Server 2008's Print Management to deploy printers via GP (targets computers, not users). We then noticed that these printers were available as students moved around different computer rooms, so we used a log-off script to remove all printers. This has been working fine but somehow prints are going to the wrong printer sometimes. I assumed the printer wasn't being removed but we have caught a few students doing this (accidentally) before they logged off and they have the correct printer installed and it worked fine after that. So it seems the issue disappears by the time I turn up without anything actually changing. Printers use IPs reserved in DHCP so they cannot be using the same IP address. The issue has happened when printing from different software (MS Office, IE, Photoshop, Music Software). I've tried logging a student in and then not logging off and log on somewhere else but again the correct printer is listed and it works. Has anyone else had this issue? Is there another way to provide access to printers that I can try which may help the issue. I would have thought I was doing it the best way but then that doesn't remove the settings, only applies them! Many thanks

I found that although some computers are hanging at the user profile service, these actually go through eventually (can be 5 minutes or so). It is when "Applying Group Policy Local User and Group policy..." (think that's what it said, or similar) that it stays there forever. I looked at the "Local User and Group" settings in GP and found a setting that adds staff to the Local Admin group. I removed this and we have not had the issue since (3 days later). We were seeing this issue at least a few times a day before. Got to find another way to make staff a local admin automatically now. I guess we still have an issue loading people's profiles but at least it does go through eventually. Maybe their profiles are big and our network is slow! Especially the wireless.