ramsay

Hi, Our staff mainly use laptops that they also take home. They have roaming profiles as they do use other computers sometimes. When connected to the network it's fine, but when offsite/not connected, the computer hangs for 1 minute exactly saying "waiting for user profile service" or similar before loading a cached profile. We would like to reduce this wait time to 10 seconds. I have played around with GPO settings such as "timeout" and "slow network connections" etc but anything I change does not seem to affect the 1 minute hang time. Any ideas? Thanks

It turns out that the computers had "\LOCAL" listed as a local administrator. That seemed to be giving everyone local admin rights! No idea how that got there or if it's a Windows default. I put a GP setting to remove this from the local administrator group and all looks OK now. Thanks

Thanks for the replies. I will investigate...

Hi, If a student runs an exe installation file it will say that it wants to make changes to the computer, they can select yes and it installs. This is very strange, as it does not ask for admin credentials and they are only a member of "domain users". Is that normal? Can we disable this access either before or after they click yes? I've played around with GP settings to deny elevation requests but they do not seem to do anything. Thanks

Just found today a few students who have the right printer listed (in Control Panel and Office) but in Adobe Reader there is another printer there (set as default)! It is likely that these students were in the room with this printer but even though Windows has removed it (after they logged on somewhere else) Adobe Reader still shows it. I don't think this is the original problem, as people had been printing from other applications. I'm sure it has got better but it's still happening (hopefully just Adobe Reader now!). I wonder where this setting would be stored. I looked in the AppData/Roaming/Adobe folder of their profile but cannot see anything obvious. I guess I need to find a way to exclude the file/folder where this setting is saved to avoid it happening. Fresh settings for Adobe Reader each time is fine. Any help appreciated. Thanks

OK thanks, I will set up our printers using that guide when I get a bit of time and see how that works for us.

> Could I just ask why you are giving users local admin access instead of just power users? I don't mind what they to do their laptops. If they mess the software up I just re-image it which takes 5 minutes of my time. > Have you tried assigning the GP to an OU containing users? Also I take it your FRDC is 2008 R2? It should be a computer configuration, as otherwise the user will be a local "Administrator" on any computer they use. > Computer settings do not apply on user login, they apply on startup so I would guess there is another setting in the policy or something. > Try disabling the user configuration settings on that group policy and see if it still does it. That's what I thought, can't imagine why it's causing an issue when they are logging in! It is definitely that setting rather than the GPO as the GPO is still active, I just removed the one specific setting.

> If you deploy printers per computer, then it's available to any user who logs on. > If you deploy printers per user, then you can control who has access to what a lot easier. In our environment "per computer" is what we want, and it appears to be working OK (just this strange phantom printing) > If you are using roaming profiles then yes the printers can follow the users. Yes, that's what we found so we now have logon/logoff scripts to delete all printers > I use GPPs to map printers and the first thing that runs is a deletion of all existing printers > before processing the rest. Works flawlessly every time. Not heard of GPP. Or is that just adding printers through GP? Thanks

Hi, New Windows 7 installation. We used GP[1] to add (AD group) members of "Staff" to the local "Administrator" group. This seemed to work OK (members of "Staff" had local admin rights) but about a month later people started to get stuck logging in at "applying local user and groups policy". I removed this setting in GP and the issue went. Some months later I put it back and the issue returned the next day. At least I'm happy to have narrowed it down! How do you give "local admin" access for staff members automatically? Or does the GP setting work for you? [1] we put the GPO in an OU containing computers. The setting is under "Computer config, Prefs, Control panel, Local users and groups". Thanks

Thanks for the info. As a quick attempt for a fix I set the "delete all network printers" command (reg delete "hkcu\printers\connections" /f) as a logon script (as well as the existing logoff script) just to make sure all printers were being deleted. I didn't know if that would interfere with the GP setting to add printers when they log on but it seems fine, and so far all is looking good!

Thanks for the advice. What commands do you run to add and remove printers in the script? How do you check what room they are in? By computer name? Thanks

When adding a printer using a GPO, the issue we have is the printer is added, but there is no port listed (so it doesn't work). In the GPO settings I have specified a port and path (both the same); \\server\printer. Adding the printer manually with these settings works. Any idea why the port isn't listed? The options are greyed out from the PC and no port is ticked. Thanks

I'm not using GP itself to add the printers, but the Print Management software which uses a GPO to push the settings somehow. I think I did originally try using GP but it wasn't working. I'll give it another go and let you know my findings. Thanks

Hi, We use Windows Server 2008's Print Management to deploy printers via GP (targets computers, not users). We then noticed that these printers were available as students moved around different computer rooms, so we used a log-off script to remove all printers. This has been working fine but somehow prints are going to the wrong printer sometimes. I assumed the printer wasn't being removed but we have caught a few students doing this (accidentally) before they logged off and they have the correct printer installed and it worked fine after that. So it seems the issue disappears by the time I turn up without anything actually changing. Printers use IPs reserved in DHCP so they cannot be using the same IP address. The issue has happened when printing from different software (MS Office, IE, Photoshop, Music Software). I've tried logging a student in and then not logging off and log on somewhere else but again the correct printer is listed and it works. Has anyone else had this issue? Is there another way to provide access to printers that I can try which may help the issue. I would have thought I was doing it the best way but then that doesn't remove the settings, only applies them! Many thanks

I found that although some computers are hanging at the user profile service, these actually go through eventually (can be 5 minutes or so). It is when "Applying Group Policy Local User and Group policy..." (think that's what it said, or similar) that it stays there forever. I looked at the "Local User and Group" settings in GP and found a setting that adds staff to the Local Admin group. I removed this and we have not had the issue since (3 days later). We were seeing this issue at least a few times a day before. Got to find another way to make staff a local admin automatically now. I guess we still have an issue loading people's profiles but at least it does go through eventually. Maybe their profiles are big and our network is slow! Especially the wireless.

Hi, We are having the same issue reported here, but we disabled suspend/hibernate months ago before we had this issue on our desktops and we have the issue there as well as laptops. To confirm the issue: - Completely random; staff (local profile) and students (roaming profile) affected on desktops and laptops. Sometimes a reboot helps, sometimes entering and exiting safe mode helps, sometimes a gpupdate helps - Event viewer shows starting some services are timing out - No errors in DHCP/DNS - Happens where no printer settings are deployed (other topics have said it might be related to deployed printers) We are running Windows 7 Enterprise 32 bit. I wonder if Windows 7 Professional would be a fix? Will try a few! Any other suggestions appreciated; already tried everything mentioned here and no luck. Many thanks [EDIT] Actually realised people are having this issue on Pro too so doubt that will help. Also forgot to mention it hangs on "Waiting for user profile service"

Hi, We wish to change a few things on the Windows login screen. Not sure if this is possible... When a computer joins the domain the user image is removed (which is fine) but it leaves the border/frame which looks stupid. Is there any way to remove this or put our schools logo there? It says "How do I log on to another domain?" that you can click to find the computer name and other info; can this be replaced with text: "Computer: computer-name"? Thanks

We use a number of different types of software, and I have not found a way to set a global default save location.

Hi, After disabling Libraries in Windows 7 our users are presented with a message each time they save/open something: Restrictions This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator. OK I assume it is trying to take them to the Library which does not exist (or they don't have access). They click OK and are put in "Computer" which is fine, and they can select their network drive and save, but this message is really annoying! I wonder if we can stop this popping up (disable the exe that's loaded) or at least change the message to something that sounds a little more useful like "Make sure you save your work in your N:\ drive" and get rid of the big red cross that's shown. Thanks for any help.

Quota is fine, and a new profile fixes it. Just looked through the Wiki and tried a few tweaks but still no further with mandatory profiles. I think I had a topic about mandatory profile issues (if not I will create one shortly) so will not talk about that further here; just wondering what could cause a profile to get messed up so easily.

No errors on the server. Wonder if the AP cannot handle them all at once, but surely that should just slow things down; not screw things up! I'll have a look at that wiki and see if it helps get mandatory profiles running. Thanks

Student profiles keep getting messed up on laptops. A class of 20 or so will log in and 5 will have issues. Giving them a new profile fixes the issue... until another day. When the issue occurs it takes them a good few minutes to log in (instead of the usual 20 seconds ish) then they get an error saying they cannot see the desktop location (a network share). The big issue is then MS Office will not save! It throws up an error when they try and save about not being able to access the file menu. Basically the profile is screwed. Looked at mandatory profiles but seems like a big issue with Windows 7, and we are indeed running into problems with them, so for now it's roaming profiles. Any idea what's going on? Many thanks

What do they need extra permissions on in the registry? I assume the best way is to apply the registry changes is via GP? Many thanks

We are trying to set up mandatory profiles after so many issues with corrupt profiles on laptops. I logged in as a test student. Logged out. Changed to ntuser.man. Shared it out as man$. Gave everyone full control on the share permission and even tried full control on file permission. Hooked up another student to it and it fails to load the profile. Any ideas? We've got it set so that a user cannot log on without a successful profile load. Thanks

That looks more complicated than the con2prt script; not too fussed if the spooler stops if a reboot will fix it. Do I need to download and install con2prt? Just done a quick search and cannot find a working download location if someone can link me? Thanks