wehr

Hi, if your main goal is to reduce logon time you could also use a shared mandatory dummy user for all users: Using ZCM Bundles to speed the login for students at shared computers | Novell User Communities The logon time is about 5 seconds - 10 seconds to ready opended internet explorer. I use this for some stand-up computers since 1 year now. At first sight it seems wierd to share a dummy user amongst all users. But we have shared computers anyway. In one year there has been no issue with this solution. However its fundamental to configure the machine correctly since we cannot rely on the SID as security boundary. Logon with a Windows Dummy User could also be achieved with pgina (pGina) best regards Markus

lacking permissions on the keys will prevent GPOs from being applied for users. The GP Client will modify permissions on these keys when loading the profile. That means if you load the profile to make updates to the mandatory profile you must adjust the permissions every time.

Farhad, Microsoft employees created the tool you are looking for. Google: apply_lgpo_delta.exe The big advantage with this tool: it does what the name implies: applies deltas. So you can easily deploy new Policies without changing existing LGPOs on the Computers. Also works with custom adm files. Disadvantage: no Group Policy Preferences. you could use custom adm files and scripts/tools as a replacement. e.g the builtin powercfg.exe regards Markus

in your super-mandatory profile (ntuser.man) what are permissions on HKEY_USERS\manprofile\Software\Policies HKEY_USERS\manprofile\Software\Microsoft\Windows\CurrentVersion\Group Policy HKEY_USERS\manprofile\Software\Microsoft\Windows\CurrentVersion\Policies ? If its not 'full' for authenticated users or everyone GPOs cannot be applied. Besides that... with Windows 7 using standard user accounts i cannot see any security problem when machine specific restrictions are in place. (e.g. remove NTFS create rights for standard users) Since years i follow the strategy to use as few restrictions as possible - GPOs only where necessary. without a problem (ok its a university not a kindergarten). Restrictions via GPOs in many cases do not provide additional security but to help users not to mess up their own desktop. In my opinion when its perceived as 'i got admin rights' if restrictions fail its more a psycological problem.

set permissions in ntuser.man on this 3 keys \software\microsoft\windows\currentversion\group policy \software\microsoft\windows\currentversion\policies \software\policies to full for authenticated user. there are more threads on the topic in the forum

I found the solution here at edugeek: the ntuser.man got wrong permissions because i loaded it one time as writeable profile. under hkcu software\policies software\microsoft\windows\currentversion\group policy software\microsoft\windows\currentversion\policies Add authenticated users with full access. The group policy client seems to set permissons at this keys. for a logged mandatory user you will find read access again. the SID with read access in the ntuser.man is the user we used to customize the profile - so we need to put authenticated users back in. Now this one of the reasons why Microsoft only supports the sysprep/copyprofile Method for creation of Mandatory Profiles. best regards Markus

i experience the same but the other way around and with local GPO: when the Profile is _new_ the LGPO will be applied. For subsequent logins with existing profile c:\users\testuser the LGPO will not apply. The only workaround i can see so far: prepare the ntuser.man with the GPO Settings already in Place.. not very flexible. reagrds MArkus

i also started with a tool (shlib.exe from grimadmin) i put this in the users logon script. now i just edit the xml library files and add the Network Drive u: - in our case.

Hi Stefano, i am also planning to use local mandatory Profiles. The Goal is to assign a mandatory Profile to a shared account as described here: technet.microsoft.com/en-us/library/gg241178(v=ws.10) I found that under some circumstances the history for IE9 would not revert back to the Mandory Profile after logon/logoff. Instead before typed URLs for the same User do reappear. This typed URLs remain sticky even after i manually delete the cached Profile(!) did you come across a problem like this? many thanks Markus