RSDSageR

I finally found resolution to this issue! The problem was deeply rooted in the mandatory profile, because of how I created it (following closely Microsoft's knowledge base article on the subject How to customize the default local user profile when you prepare an image of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2) Turns out that article is incomplete. Here is what to do in a nutshell: 1. Log onto the machine you will be creating the mandatory profile from, using the account which will be specified in the sysprep command. 2. Configure Internet Explorer on the local account BEFORE running sysprep 3. Execute the sysprep command 4. Execute the step to export the default profile, specify "Everyone" in the permissions 5. Put that exported profile on the server, and create a user account that will use that profile 6. Log on using that account, continue to customize the profile, including running Internet Explorer 7. Change the profile from NTUSER.DAT to NTUSER.MAN As it was explained to me, there are customizations to the ntuser.dat hive that must be done at the "default profile" level, BEFORE actually configuring it for the "user profile", so like Xzibit says, "Yo dawg, I heard you like setting up IE, so we have to set up your IE before you set up IE" or something.... Anyways, I recreated my mandatory profile from scratch by doing this, and I am now able to log onto all https websites using mandatory user profiles, which were not working before. I hope this helps, and I hope Microsoft will update their instructions for creating mandatory user profiles. Good luck!

Is anyone familliar with how IE9 "virtualizes" sessions or pages (aka "sandbox" mode) Doing some more digging here and this seems to be popping up with file access issues within the "hugepath\temporaryinternetfiles\virtualized\c" area. Is it possible to turn this off and see if it is related to my problem?

Well, its comforting to know that you had the same issue as me and eventually fixed it, but today doesn't seem to be the day. Tomorrow: more coffee, and another attempt to fix it, thanks for the help though!

Do I need to do anything to the client machines to support this profile? (sysprep on clients) They are just standard off-the-disc installations (it's a small school) with SP1 and updates applied. I understand what you described above, which sounds like that I tried (from the Microsoft KB article) but I tried with your permission settings, and it still works the first time, then if I log off and reboot, then log back on, it fails every time after that.

Yes, I recreated late last week following closely all of the steps in this KB: How to customize the default local user profile when you prepare an image of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 And not doing many of our routine customizations, trying to keep it as simple as possible to isolate problems, but the problem is still occuring. Did things like resetting owner/security permissions as well, I even tried giving "Everyone" Full Control of the directory (temporarilly for testing)

Not intentionally setting any proxy settings, either manually in the profile, or via GPO. We have had very bad results anytime we give students roaming profiles instead of mandatory, too many people trying to configure things, easiest just to discard everything. We are using Lightspeed as our filter.

Hello, I am in IT support for a school district, and we are implementing Windows 7 at a new school, and have run into a problem accessing certain webpages. I will do my best to describe the situation and environment involved, so it may be a long post and plenty of irrelevant information, so bear with me, but here goes: The symptom we are seeing is that when students try to login to a secure website, the login fails and they only receive a "Internet Explorer Cannot Display the Webpage" page, with a "Diagnose connection problems" button. The easiest way to check if the pages will work is just visit gmail.com, though several sites can exhibit the problem. Other websites are accessible, I can go to Bing, and perform searches, everything works there, but most sites that require logins are failing to the "Page cannot be displayed". We do have a content filter, but I have verified that we are not blocking any ports or addresses related to this website at this level. Turning the content filter completely off during off hours we were still able to reproduce the problem. We are running Windows 7 Professional 32-bit Service Pack 1 on the client machines. They have all current recommended updates, including Internet Explorer 9. The domain controller is Windows Server 2008 R2 Enterprise, as well as the file server which stores profiles and documents. We have created a mandatory profile that is used for all student accounts, and I think this is where the problem exists. All students are members of a security group, which has full read and execute permissions to the student profile share as well as the mandatory profile folder itself. We have had some partial success with this problem by unlocking the mandatory profile by changing ntuser.man back to ntuser.dat, and logging in as a student account temporarilly made local admin on the machine, and then logging into the novanet website, which works in these conditions. Upon logoff after the profile has been synched back to its location on the file server, we change it back to ntuser.man. Then clearing all old profiles from the machine, and logging back in as a student using the mandatory profile, we can now log into novanet on some machines and not others, in other words it is not consistent enough to call fixed. Another problem is that even if this method worked 100%, we would have to unlock the profile to "customize" it for every site a student could conceivably log onto, which is not very practical. Since this appears to be a larger issue, solving it at its root would be the most helpful. Another thing we tried was to make an individual student a local administrator on a machine, and then log onto the machine using the mandatory profile, which still fails. We have tried compatibility mode, enabling SSL and TLS protocols in internet options, also to no avail, the only thing that seems to allow it to work consistently is to leave the profile non-mandatory, which we would like to avoid. What other options am I missing here, any suggestions at all? Thank you for taing the time to read this!