| Login

Search this Blog


Links I like to keep around


Here are the most recent postings to this blog. Use the archive calendar or search to find other entries.
Oct13

Written by:R Teachout
10/13/2009 12:21 PM 

A bunch of notes I found online about terminal services roaming profiles

(targeted at a 2008 TS, at least that is what the article is referencing)

A bunch of notes I found online about terminal services roaming profiles

(targeted at a 2008 TS, at least that is what the article is referencing)

I would apply this via a GPO instead of in the Terminal Services profile option in ADUC so you don't need to remember to do that. Link  the policy at the OU where your TS box lives and apply loopback processing so all users get the same settings. Also see KB 278295 for some good TS lockdown suggestions. Also see MVP Patrick Rouse's articles at http://www.msterminalservices.org/articles/Locking-Down-Windows-Terminal-Services.html

You don't need the .v2 stuff - a) this is TS and b) this ain't Vista.

Roaming profiles in general have not changed much over the years. Here's my boilerplate - a lot of it will apply to TS as well...especially the folder redirection stuff. TS profiles, roaming profiles - you need to keep them TINY.

********************
General tips:

1. Set up a share on the server. For example - d:\profiles, shared as profiles$ to make it hidden from browsing. Make sure this share is *not* set to allow offline files/caching! (that's on by default - disable it)

2. Make sure the share permissions on profiles$ indicate everyone=full control. Set the NTFS security to administrators, system, and users=full control.

3. In the users' ADUC properties, specify \\server\profiles$\%username% in the profiles field

4. Have each user log into the domain once - if this is an existing user with a profile you wish to keep, have them log in at their usual workstationand log out. The profile is now roaming.

5. If you want the administrators group to automatically have permissions to the profiles folders, you'll need to make the appropriate change in group policy. Look in computer configuration/administrative templates/system/user profiles - there's an option to add administrators group to the roaming profiles permissions. Do this *before* the users' roaming profile folders are created - it isn't retroactive.

********************
Notes:

Make sure users understand that they should not log into multiple computers at the same time when they have roaming profiles (unless you make the profiles mandatory by renaming ntuser.dat to ntuser.man so they can't change them, which has major disadvantages),. Explain that the 'last one out wins' when it comes to uploading the final, changed copy of the profile. If you want to restrict multiple simultaneous network logins, look at LimitLogon (too much overhead for me), or this: http://www.jsifaq.com/SF/Tips/Tip.aspx?id=8768

********************
Keep your profiles TINY. Via group policy, you should be redirecting My Documents (at the very least) - to a subfolder of the user's home directory or user folder. Also consider redirecting Desktop & Application Data similarly..... so the user will end up with:

\\server\users\%username%\My Documents, 
\\server\users\%username%\Desktop,     
\\server\users\%username%\Application Data.

[Alternatively, just manually re-target My Documents to \\server\users\%username% (this is not optimal, however!)]

You should use folder redirection even without roaming profiles, but it's especially critical if you *are* using them.

If you aren't going to also redirect the desktop using policies, tell users that they are not to store any files on the desktop or you will beat them with a
stick. Big profile=slow login/logout, and possible profile corruption.

********************
Note that user profiles are not compatible between different OS versions, even between W2k/XP. Keep all your computers. Keep your workstations as
identical as possible - meaning, OS version is the same, SP level is the same, app load is (as much as possible) the same.

*********************
If you also have Terminal Services users, make sure you set up a

n entirely *separate*  TS profile path for them in their ADUC properties - e.g., \\server\tsprofiles$\%username%

********************
 Do not let people store any data locally - all data belongs on the server.

********************
 The User Profile Hive Cleanup Utility should be running on all your computers.  You can download it here:  http://www.microsoft.com/downloads/details.aspx?familyid=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en 
(I disagree with this, as I've had problems with it, at least on dedicated terminal services, to each their own)

********************
Roaming profile & folder redirection article -
http://www.windowsnetworking.com/articles_tutorials/Profile-Folder-Redirection-Windows-Server-2003.html
Lanwench [MVP - Exchange] ** Do not fold, spindle or mutilate. Fill in the box completely and erase any stray marks. Use only a #2 pencil.

 

Source: http://social.technet.microsoft.com/forums/en-US/winservergen/thread/2e3d27cf-38ec-433d-8bee-2a69a73871a5/ 

Archived here so I don't lose 'em, they are good notes


Tags:

Your name:
Your email:
(Optional) Email used only to show Gravatar.
Your website:
Title:
Comment:
Add Comment  Cancel 

The first rule of any technology used in a business is that automation applied to an efficient operation will magnify the efficiency. The second is that automation applied to an inefficient operation will magnify the inefficiency.
-Bill Gates

Inspired by Nina