Search the Community

Since we migrated to our academy group's fancy new AD structure, last summer, ICT have reported that Internet Explorer is very slow starting up I finally got to go down and do some proper testing during half term this week and have come to the conclusion that it's an IE first run thing - basically, if a user has a profile in place on a given computer and has ran IE in the past then IE will start fine but if they haven't (and our group policy is set to get rid of profiles that have been inactive for 2 weeks) then IE can take up to about 2 mins to start up All the welcome screen and wizards are disabled but I guess IE must still be doing all of its setting up for a new user in the background I believe we were still using a mandatory profile for students, that had ran IE and gone thought the first-run process, right up until the change over last summer so that's why ICT weren't seeing IE starting up slowly before So... Does this sound right? Is a slow starting IE on first run just a fact of life if you don't run mandatory profiles and periodically delete unused ones or is there anything else we can do to speed up the 'first run' a bit, without having to go back to mandatory profiles? IIRC In earlier versions of IE there used to be a small pop-up displaying the stages of the first-run set-up process, is there some GP setting somewhere to bring that back if only to give users something to look at while they're waiting? Thanks

Hi guys, I'm trying to set up a mandatory profile for my Windows 10 1903 clients with no success. Currently I'm stuck because I can not load the profile, event viewer reports Error ID 1521. Description: Windows cannot locate the server copy of your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you log off. This error may be caused by network problems or insufficient security rights. For the C:\man.v6 folder the permission are : All application packages -> Full control Authenticated users -> Read & Execute Administrators -> Full Control SYSTEM -> Full control For the C:\man\ntuser.man the permission (given with regedit) are : All application packages -> Full control Unknown Account (S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681) -> Read Authenticated users -> Full control Administrators -> Full Control SYSTEM -> Full control I'm using the gpo: Computer configuration - Administrative templates - System - User Profiles and set the setting "Set roaming profile path for all users logging on to this computer" -> C:\man Has this ever happened to you? It's driving me crazy, any suggestion will be very aprecciated!

Hi, I have windows 7 setup to use mandatory profiles for students which run off a network share. It works OK but isn't as easy to manage as xp was e.g. I have installed Photoshop elements and premiere elements and want the acceptance agreement that shows each time a user uses it to go away. In xp I would set the load the program and setup the desktop as wanted then copy the profile to the share and make it mandatory. I can't do this in 7 because the copy button is now disabled. I tried making a profile using sysprep but ended up breaking a machine trying. I fixed a similar problem with office using a showoptin key. Does anyone know the regkey for pse and pre that stop the acceptance agreement? Or is there a better way to achieve what I'm after? Thanks

Hi all I have set up spark for the school it works great for the admin staff who use roaming profiles, but the teaching staff use mandatory profile. As spark wont load. has anyone fixed this issue? Thanks in advance

Hi, I am having a problem with a pair of our servers both are 2008 R2 SP1 , the are used by student to run programming software through the RDP system and RD Web, they are set to pick up mandatory profiles from another one of our DC servers. Which works they get the profile the issue is that they never update. E.G. I made a change to the profile to include links to a new program set so I changed and updated the location of the mandatory profile. If a new user logs on they get the full program set if a users who has been through the process before opens the program set they only see there existing options, they can load the software if you direct them through the drive to it so the issue seems to be caching of the mandatory profile. Now on a work station normally at this point I would go to the C:/ and clear out all the store users information. But as these are running on the server and this it now critical to the curriculum , I really don't want to do this. Without being sure that it will resolve the issue not make it worse. Any suggestion? Your help would be much appreciated.

Hi all just hoping for some help/advice again if possible. We have deployed UE-V correctly I hope.... but we're not sure how to get UE-V to save the outlook profile, I've enabled the gpo to capture settings for outlook 2016 but it doesn't seem to be doing it. Is there something that needs setting in the office gpo separately from the UE-V applications gpo ? We are running a hybrid network with mirrage & VDI both using a mandatory profile, any help would be appreciated. Cheers

Hi, For previous versions of Windows we've always used mandatory profiles - 1 per lab and set via GPO. We normally log on with a local admin account , run all of the software , configure any tweaks to settings (eg default save dir etc) then log off and with another account copy the profile to network , regedit and make it mandatory (as well as deleting local & locallow folders). With Windows 10 mandatory profiles seem to be causing problems with search & start button unless we leave appdata\local and locallow in the profile which makes them huge. Just wondering if anyone has any guidance on using GPO/GPP instead of mandatory profiles. If using GPP etc how do you know which files from the profile are actually needed and which would be recreated ? Any help or guidance would be much appreciated. Just trying to get my head around the GPO/GPP approach. Typical software includes Android Studio , Eclipse , Office , SPSS , Visual Studio etc Thanks in advance, tango

Hi Edugeek's, We have a bunch of workstations currently running Windows XP Pro, with our server running Server 2008. The students and staff use mandatory profiles with "My Documents" redirected to their home drive with only a couple of users in school office using roaming profiles. We are looking to move to Windows 7 or maybe newer but will need to replace a chunk of the machines to run the newer OS so would like to stagger the update as the budget doesn't allow us to go out and replace the old machines. My question is, how do you deal with profiles with Windows XP and Windows 7 running along side each other? I understand that if you have roaming profiles enabled with XP, it will create a Windows 7 profiles using the appended V2 and there are no real problems. But can you have mandatory profiles running concurrently to cover both OS's? If not, any suggestions on a good course of action to take to help migrate?

Hi, We are currently in the process of moving from Novel to Active Directory, where we are now using mandatory user profiles for our students instead of local profiles. We've noticed that some of our software no longer functions as it did previously when running the software against an account with a mandatory user profile. The main two applications which we have had great difficulty with are Sage 50 Payroll V20-21 and Adobe Creative Cloud 2014. Both of these applications have limited functionality when ran against a user with a mandatory profile. For example, if we give an account named "StudentTest" a "local" profile, there is no functionality issues with software, but if we change the profile type for the account named "StudentTest" to a "mandatory" profile, the functionality issues with software return. The functionality issues in which we have experienced to date are as follows - Sage 50 Payroll V20-21 Software runs in "Restricted Mode" when ran against a user account with a "mandatory" user profile. Unable to activate the licence for this product when ran against a user account with a "mandatory" user profile. Software runs without any issues when ran against a user account with a "local" user profile. Software runs without any issues when ran under the context of another user with a "local" profile, when logged-in with a user with a "mandatory" user profile. [*]Adobe Creative Cloud 2014 Software crashes at launch with "Program has stopped working" error, when ran against a user with a "mandatory" user profile. Software runs without any issues when ran against a user account with a "local" user profile. Software runs without any issues when ran under the context of another user with a "local" profile, when logged-in with a user with a "mandatory" user profile. Does anybody here have any idea what could be going on here? The software list with functionality issues seems to be growing by the day. Personally, I've never experienced these issues before with mandatory user profiles and software functionality. Regards, Richard

Hello Everyone. A little cheeky, but by any chance does anyone have any info or advice on creating profiles for Windows 7? We currently have mandatory profiles (Admin Staff, Teaching Staff & Students), but of course we can’t use them with Windows 7. Is there anyway of converting them to V2 profiles so we can use them? I’m asking you as I’m sure that some of you will have already taken the leap to 7 from XP. Any help/advice would be greatly appreciated.

For years now I have used mandatory roaming profiles for 99.9% of my users. These have worked great as the staff and students are constantly moving machines. We use these in combination with folder redirection and we redirect all the possible folders to the users home share. This has worked great but now that more and more things require user customisations such as Windows Store Apps and cloud services like GoogleDrive (which doesn’t support even standard roaming profiles) I now need to develop this solution. I'm fine with giving users as much freedom as possible, the only reason I used mandatory profiles was to improve reliability. How on earth do you get a nice, reliable and low overhead profile system whilst still giving users the freedom to customise as they wish. I've used standard roaming profiles but they seem to slow down after a while and we've played with UEV but that doesn’t support everything. I'm not really asking for the answer but more asking what do you do? Thanks

This is a strange one for you guys! We have mandatory profiles for our pupils and have done for a long time without any problems. Recently I have been getting complaints about machines taking 10mins or so to log off. That has been since we returned from the holidays. Nothing has been changed as I was off for the 2 weeks. I have checked the usual places event logs on machine servers but there is nothing. I have checked permissions with no luck. I have UHPS installed but that makes no difference. Has anyone seen anything like this before? Rob

Is anyone successfully using Chrome ephemeral mode? Like the idea that our students are not leaving "tracks" on public computers (library kiosks) or friends computers BUT the constant dialogs with the "link data"/"New profile" buttons is causing no end of confusion. Not to mention if they press new profile, which would be the "safe" thing to tell them to do (so they don't go importing their parents profile into there school profile) - they get 2 chrome sessions 1 login as themselves and 1 not logged in to chrome. Has anyone found a way to keep things simple? What we really need is a way to say "this chrome profile cannot be merged/linked" with another profile, you need to login then change. (or log in and not allowed to change much because your apps are pre-installed, your bookmarks are not editable --> more the concept of a "mandatory profile" except in lives in the cloud and not the network server) Oh and by the way you can't leave your profile laying around on other computers... Our environment is Win7 domain with 2008R2 servers, Chrome and GAFE. Students have mandatory profiles - currently appdata NOT redirected. (most)Teachers have roaming profiles - appdata IS redirected. Any ideas or suggestions? Thanks!

Does anyone keep their Mandatory Profiles in sysvol? Or tried and ended up regreting it? The reason I'm asking is I'm trying to eliminate single points of failure in our network, if the profile can be loaded from any domain controller this should make things more reliable.

We have used deepfreeze, steady state, and cleanslate in the past. deepfreeze is expensive, steady state doesn't work with 7, and cleanslate simply breaks on a lot of computers. I have been looking at a solution for our Lab Computers I was looking at steadierstate (Steadier State), but setup looked complicated, I have images built with pro, and it requires enterprise edition(which at least the version in my volume licensing doesnt have dvdmaker media player). I also looked at putting windows write filter for embedded windows in windows 7 pro (EWF on Windows 7 32-bit or 64-bit (Enhanced Write Filter)) but it is apparently buggy. I also looked at deploying windows thin pc for labs because it has the writefilter build in. but we found it lacked features we needed although you can install pretty much anything on it (like office) it had some .net issues. The latest thing I have been looking at is mandatory profiles. which are more meant to be hosted on a server pulled down. you are supposed to have all the microsofty goodness to use something like this (windows server/AD) and we run Samba, plus I just want each computer to function independently wihtout outside reliance. you can use these locally (Creating a Mandatory User Profile). This would sort of combine with microsoft's promise that now you don't need to run a admin user to use windows (we will see). Mandatory profiles use a base profile to set up users where all changes to the profile are reverted. which when combined with the fact that the user is a guest should make for a pretty secure machine that a non computer science major can't trash before another re-imaging cycle comes around. the problem with mandatory profiles is that the base profile must be copied with full permissions for Everyone which means that once the intended locked down user logsin they can happily go to the mandatory base profile and start deleting things and adding things that will screw up the whole sync association. what I have found out after two days of looking at permissions is that the files do not need write access to work as a base profile they just need read access it is only the registry entries inside the ntuser.dat (changed to ntuser.man with mandatory profiles) that need full everyone permissions. so that when the user logs in and windows propagates the ntuser.man from the mandatory profile base to the user profiles ntuser.man the user can then make changes to settings. What I also discovered is that if you set read only permissions on the ntuser.man then a guest user that is logged in cannot go and load the hive and make any changes. I have been developing a single click script that will implement after I have sysprepped my maching with copyprofile=true (so that i carries over a lot of the setting that are set up with administrator) after my image is deployed and sysprep and driverpacks finish my setup automatically logs me in as administrator once to finish any addional setup. this is when I would run the script which sets up the mandatory profile, renames ntuser.dat to ntuser.man. changes the permissions to be more secure (need elaboration), creates a guest user that is mapped to the mandatory profile. and sets up that user to autologin on the next reboot. here is the script so far. I hope to get some feed back and document this a little as I test it out myself. If anyone sees any glaring holes in my Idea let me know. the script is made with autoitv3 it needs to be compiled to run as an exe on a system that doesn't have autoit installed. my to do it to get it to a point where i might be able to distribute the compiled.exe any maybe add some user input to ask for user account name. the code executes one line at a time there is no logic. the first portion just automates a windows gui with keypresses. #include #include Run("rundll32.exe sysdm.cpl,EditUserProfiles") WinWaitActive("User Profiles") Send("{TAB}") Send("{ENTER}") WinWaitActive("Copy To") Send("C:\Users\mandatory.v2") Send("{TAB 2}") Send("{ENTER}") WinWaitActive("Select User or Group") Send("Everyone") Send("{ENTER}") WinWaitActive("Copy To") Send("{TAB}") Send("{ENTER}") WinWaitActive("User Profiles") Send("{TAB}") Send("{TAB}") Send("{ENTER}") FileMove("C:\Users\mandatory.v2\ntuser.dat", "C:\Users\mandatory.v2\ntuser.man") FileDelete ( "C:\Users\mandatory.v2\ntuser.dat" ) runwait( @COMspec & " /c icacls C:\Users\mandatory.v2 /remove everyone system administrators","",@SW_HIDE) runwait( @COMspec & " /c net user gclab /profilepath:C:\Users\mandatory /passwordchg:no /passwordreq:no /add","",@SW_HIDE) runwait( @COMspec & " /c net localgroup users gclab /delete","",@SW_HIDE) runwait( @COMspec & " /c net localgroup guests gclab /add","",@SW_HIDE) RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "DefaultUserName", "REG_SZ", "GClab") RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "DefaultPassword", "REG_SZ", "") RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "AutoAdminLogon", "REG_SZ", "1") exit getting the permissions right has been the hardest part. I tried to setup an indepedent directory that didn;t inherit permissions from users/ but that didn't work anyway I rolled it. There seem to be some inconsistencies with what i cacls does and what windows does with permission. or I am just missing something. for example these permissions work and are what is created by the first step c:\users\mandatory.v2 NT AUTHORITY\SYSTEM:(F) BUILTIN\Administrators:(F) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(OI)(CI)(IO)(F) c:\users\mandatory.v2\AppData NT AUTHORITY\SYSTEM:(I)(F) NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F) BUILTIN\Administrators:(I)(F) BUILTIN\AdministratorsA:(I)(OI)(CI)(IO)(F) but when trying to copy them with icacls this is the closest I could get which should work as it grants all the same permissions but it doesn't c:\users\mandatory.v2 Everyone:(RX) NT AUTHORITY\SYSTEM:(F) BUILTIN\Administrators:(F) Everyone:(OI)(CI)(IO)(RX) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(OI)(CI)(IO)(F) c:\users\mandatory.v2\AppData Everyone:(I)(OI)(CI)(RX) NT AUTHORITY\SYSTEM:(I)(F) NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F) BUILTIN\Administrators:(I)(F) BUILTIN\Administrators:(I)(OI)(CI)(IO)(F) this is after running icacls C:\Users\mandatory.v2 /inheritance:r icacls C:\Users\mandatory.v2 /remove everyone icacls C:\Users\mandatory.v2 /grant everyone:(RX) icacls C:\Users\mandatory.v2 /grant everyone:(OI)(CI)(IO)(RX) what i ended up doing was noticing the fact that the users directory has rx permissions just for the directory that don't propagate to the individual user profiles. so i just removed the permissions on the mandatory.v2 profile icacls C:\Users\mandatory.v2 /remove everyone system administrators /c /q and it works. this might not be the case for different setups i might have borked the permissions on users/ by playing so much with icacls.

Hello I want to lockdown Windows client for school or library standalone PC no Domain. From Windows XP to Windows 8.1 mandatory profile are perfect for my request. Every reboot the profile is new. From windows 10 this is not possible. If you setup a mandatory profile, they will broke immediately for windows update (features update) or for modern app and cortana. I've seen 3rd party software but the will doesn't support the windows update. If the update start after reboot they re deploy original image. Do you have a suggestion to make kiosk or lockdown computer with windows 10? My best regards PAolo

Hi everyone, I'am currently setting up our shiny new windows 7 domain we are almost there but I have hit a bump in the road. Please help I went to create a mandatory profile for our students and copy it to a share like i have always done in windows XP and found the button grayed out. After talking to Google I have found Microsoft have disabled this button. I have also found loads of old men moaning about it. every one was so busy slating Microsoft i cant find any guides on how i should go about making a mandatory profile. Please help! Thanks,

I am looking to see what people have found best for the unique school environment where you have hundreds of users logging on/off at the same time several times a day and specifically at profiles. Testing last year found that on a 7 PC the initial logon from password to ready-to-go varied between 40-50 seconds for roaming/mandatory/local all with folder redirection and subsequent logons around the 11-15 second mark if the profile existed under Users. The folder redirection only does Documents. Interestingly taking folder redirection to the maximum options available (2008 domain) the initial logon time came down to the 11-15 second mark. However hundreds of users all hitting the same server for everything did not appeal. So we used a 4MB mandatory profile (not super at this stage) on a teamed NIC server dedicated to storing Documents for folder redirection and the profile. Our 7 boxes are frozen with Deep Freeze which means users must do the initial logon each time (and the extra 30 second delay). The server does not come close to being stressed on either the CPU/Memory/Disk or Network. Some users log on within the 50 seconds to 1 minute, but a few always seem to hit the 1-5 minute logons. What are other people doing for student computers in regards to profile selection and setup and what times are you getting from the password being entered up to ready-to-go? Is there a way to beat that initial logon delay?

Hi folks, I've seen various posts about the size of mandatory profiles and can't understand how they can be so small. Most of my profiles (1 per lab) are at least 100Mb and thats after removing appdata\low & appdata\locallow. We do have quite a bit of software installed on the image (SPSS , Office , Audacity etc etc) What we do is image the machine , log in as a newly created local admin user , run all software & configure it , log in as admin & copy the profile to the fileserver. I then delete low & locallow , mount the ntuser.dat & remove perms for the account used to create profile & give full control to everyone , unmount & change to ntuser.man Is there anything else I should be doing ? Any advice on how to reduce the size of the profile would be much appreciated too. Thanks in advance tango