Windows 10: How to create Mandatory User Profiles in Windows 10

Many a time system admins need to create a pre-configured user account which works with fixed settings. These profiles are called mandatory user profiles (one of many Unique profiles) in Windows 10. In this guide, we will share how you [...]

This post How to create Mandatory User Profiles in Windows 10 is from TheWindowsClub.com.

read more...

 

Mandatory Profile (.v5)


Hi
Has anyone successfully got mandatory profiles working with Windows 10 (currently running Win10 Enterprise 1511).

Essentially, I have it 99% of the way there, but whilst the start bar is clickable (which it previously wasn't), it now shows a blank start menu - ignoring either the Mandatory Profile Start Menu, or the XML Start Menu imported via Group Policy.

My steps are based on having a dedicated "mandatory" local account to do all user customisations before copying it up to the netlogon share rather than using the default profile - which works fine but has none of our app customizations built in - unless I start look at importing reg keys etc;

So here are my steps;

Login to the gold image machine as .\mandatory
1. Open Regedit
2. Right Click on HKCU and give the following full permissions – logging in as a domain admin first
a. Everyone
b. All Application Pools
c. Authenticated Users
4. Close Regedit
This is essentially instead of doing it via loading the hive - which seems to really help the start menu (I think)

5. Reboot the machine
6. Login as domain administrator – run Windows Enabler
7. Copy the profile to \\%domaincontroller%\netlogon\profiles\.v5 with everyone as permissions
8. Change a user to use that as their profile
9. Reboot the computer (giving AD enough time to replicate)
10. Login as that user
11. Start Menu is clickable and edge works on the task bar

However!.

It does not pull in the start menu xml that we have configured, nor the start menu contained within the mandatory profile, but the start menu is fully clickable!

I think other ways I have read on mandatory profiles about loading the hive from another machine didn't work because the DeviceAccess registry key seems to be permanantley locked even if I give everyone full permission - if I do it locally and then export the full mandatory profile it works.

In anticipation

John Paul

 

What is mandatory profile

Hi Oliver,

Thank you for writing to Microsoft Community Forums.

The option, Mandatory profile has been there in older versions of Windows as well. It is a roaming profile pre-configured by an administrator to specify settings for users. Mandatory profile is very much similar to roaming profile.
In a domain, wherever you go, you have access to your files and folders, but not your profile settings. Please refer to the link given below.

Creating mandatory user profiles (Windows 10) | Microsoft Docs

NTuser.dat is a portion of the user profile where the registry settings are saved for that user.

When it is named .dat, any changes made by the user to desktop environment will be saved to user profile when the user logs out.

NTuser.man is same as NTuser.dat, but renamed manually to .man which makes it a mandatory profile. Any changes made to the mandatory profile won’t be saved when user logs out.

Roaming profiles are protected from permanent change by renaming NTuser.dat to NTuser.man. Renaming the file to .dat makes the profile read-only, which means that Windows does not save any changes made to the profile when the user logs off.

Mandatory accounts are used in domain systems rather than the computers which are in workgroup. So, for further information and help with your query, please post your question on Microsoft
TechNet Forums.

Hope the information above is helpful.

Peer Samie

Microsoft Community-Moderator

 

Windows 10 Mandatory Profile Configuration

Hello,

I'm trying to configure Mandatory Profiles in a Windows 10 Environment.

I'm following this article:

Create mandatory user profiles (Windows 10)

Everything works correctly if I specify the mandatory path in the properties of the user account in Active Directory Users and Computers.

I have the share

\\server\share\manny.v6

and the profile specified in the user properties as

\\server\share\manny

If I try to configure this in Group Policy it does not work. I tried under Computer Config | System | User Profiles.

Can you still configure the Mandatory Profile path through Group Policy?