Can you use a local path for mandatory profiles?
i had the same problem. I have to set up a P.C. classroom for students with mandatory profiles without the use of an active directory domain server. I needed to setup and customize a LOCAL mandatory profile on a sample machine for replication. I wrote some notes to describe the working solution, in italian, below an attempt to translate it (i apologize for my poor english)
- login as a user in the
Administrators
group - From "User Management" create user
student
with passwordstudent
and set:
-Password never expires
-User can not change password - Start Menu > Change User > log in as user
student
- Log Off
- Create a new folder in C:\Users\ and give it a name like
defstudprofile.v2
. Login as Administrator and copy the profile "DEFAULT" (the default system profile) to the newly created folder using the System Settings menu > Advanced > User Profiles Settings > BUTTON "Copy to ...".
IMPORTANT! Before you copy use the "Change" to allow the group "
Authenticated Users
" use of the new profile.This operation overwrites the entire contents of the folder 'defstudprofile.v2' with the contents of the default profile, but allows 'Authenticated Users' to use it.
- Menu "Edit Local Users and Groups" > user "student" > "Profile" - enter in the "Profile Path" box the path of the folder
defstudprofile.v2
... remembering that the folder must be specified without the .v2 extension. so the path becomes C:\Users\defstudprofile - Log Off
- login again as user
student
- Customize the desktop settings, the home page of the browsers, the proxy, and anything else you need blocked or changed
- Log Off
- Log back in as user
student
and verify that the settings are all stored. - Before you continue you should Log off and back several times, opening several applications to make sure they are all properly configured.
- Log in as an administrator. Go to the the
C:\Users\defstudprofile.v2
profile folder and rename thentuser.dat
file tontuser.man
- Log Off
- DONE! login as
student
and try to change some settings - disconnect and go back. The profilestudent
is locked!
Further customizations of the mandatory profile can be done by renaming ntuser.man back to ntuser.dat to unlock the profile, and setting the file back to ntuser.man again to re-lock it.
You can use any path that is reachable from the system when logging on. In case of a roaming profile, the user needs change permissions on the profile directory. In case of a mandatory profile read permissions are sufficient.
Advice: The creation of a new user profile involves a lot of disk activity. It might be faster if the profile template (in your case the mandatory profile stored locally) is read from the network since that reduces the IOPS the local disk has to deal with.
More information from my blog:
Articles about mandatory profiles
User Profile Design: A Primer