Chris Sanders

User profile management can be a complete nightmare for a network administrator. There are literally dozens of ways to manage profiles based on the needs of your particular organization or department. One of the most complicated scenarios to properly administer is a typical lab environment in which you do not want user profiles to be modified at all. Through the use of mandatory profiles this type of profile administration becomes much easier.
For this example we will examine a typical University Campus. This small campus has one hundred computers spread across various labs. These are all Windows XP machines connected to a Windows 2003 domain. These computers are used by students to do research, type papers, and perform various other coursework. Along with these computers there are a total of 2000 students who each have their own unique user account. Our goal is to present each and every student user with the same profile settings, and disregard all profile changes when a user logs out so that they are presented with the same profile as everyone else when they log back in.

Step 1: Setting up the Base Profile
The first thing you will want to do is setup a model profile on a workstation (preferably an identical one to the workstations in the lab) that will serve as the profile that everyone sees when they log into a computer. Here you will want to make sure you have configured all desktop settings, shortcut icons, and installed printers correctly as to how they will appear on all other workstations.

Step 2: Copying the Profile to a Server
Once you have your profile setup how you want it, the next step is to copy the profile to a server. It is important that you set the permissions on the folder holding the profile so that all users accessing it will have complete read and write access to it. Once setup the workstations will pull each user profile from this location. In order to properly copy this profile to a server you will complete the following steps:

1. Login as a user other than the one you used to make your model profile
2. Right click “My Computer” and click “Properties”
3. Click the “Advanced” tab
4. Click “Profiles”
5. Select your model profile and click the “Copy to” button
6. Browse to the location you want to store the profile at
7. Click “Change” under “Permitted to Use” near the bottom of the window and add the “Authenticated Users” group
8. Click “OK”
9. Exit out of any dialog boxes that may remain open.

Step 3: Making the Profile Mandatory
The next step in creating your profile is the actual process of making it mandatory and therefore unchangeable.

1. Browse to the location of your saved profile on the server and locate the NTUSER.dat file (make sure hidden files are set to be visible)
2. Rename this file to NTUSER.man

Step 4: Configuring the User Accounts

1. Open Active Directory Users and Computers and browse to the location of the user or group of users you wish to assign a mandatory profile to
2. Right click the user or group of users and click “Properties”
3. Click on the “Profile” tab
4. In the “Profile Path” box type the UNC path to the folder where the mandatory profile is located
5. Click “OK”Exit Active Directory Users and Computers

With those steps completed you have successfully setup mandatory profiles for your student population. You may now reap the benefits of having a central location to store all of your user profiles so that they can be modified with ease. This also provides a great layer of additional security for your network. Mandatory profiles can also be extended upon greatly with the use of Group Policy, which is something that I would highly recommend looking into.

Be Sociable, Share!

•