Windows 10: Mandatory Roaming profile users stuck at logoff after kb4522355 - any fix?

After installing the above update or any cumulative after that one, my mandatory profile users get stuck logging of. It sits ans spins and says "Please wait for user profile service". It will sit there for hours. Other user types are not affected.


I do note in the notes that update contains some sort of security change to mandatory profile log offs.


Anyone else experience this and maybe know what I need to do? I have 1200 enterprise computers and can't just not upgrade anymore.

:)

 

What is mandatory profile

Hi Oliver,

Thank you for writing to Microsoft Community Forums.

The option, Mandatory profile has been there in older versions of Windows as well. It is a roaming profile pre-configured by an administrator to specify settings for users. Mandatory profile is very much similar to roaming profile.
In a domain, wherever you go, you have access to your files and folders, but not your profile settings. Please refer to the link given below.

Creating mandatory user profiles (Windows 10) | Microsoft Docs

NTuser.dat is a portion of the user profile where the registry settings are saved for that user.

When it is named .dat, any changes made by the user to desktop environment will be saved to user profile when the user logs out.

NTuser.man is same as NTuser.dat, but renamed manually to .man which makes it a mandatory profile. Any changes made to the mandatory profile won’t be saved when user logs out.

Roaming profiles are protected from permanent change by renaming NTuser.dat to NTuser.man. Renaming the file to .dat makes the profile read-only, which means that Windows does not save any changes made to the profile when the user logs off.

Mandatory accounts are used in domain systems rather than the computers which are in workgroup. So, for further information and help with your query, please post your question on Microsoft
TechNet Forums.

Hope the information above is helpful.

Peer Samie

Microsoft Community-Moderator

 

Mandatory Profile (.v5)


Hi
Has anyone successfully got mandatory profiles working with Windows 10 (currently running Win10 Enterprise 1511).

Essentially, I have it 99% of the way there, but whilst the start bar is clickable (which it previously wasn't), it now shows a blank start menu - ignoring either the Mandatory Profile Start Menu, or the XML Start Menu imported via Group Policy.

My steps are based on having a dedicated "mandatory" local account to do all user customisations before copying it up to the netlogon share rather than using the default profile - which works fine but has none of our app customizations built in - unless I start look at importing reg keys etc;

So here are my steps;

Login to the gold image machine as .\mandatory
1. Open Regedit
2. Right Click on HKCU and give the following full permissions – logging in as a domain admin first
a. Everyone
b. All Application Pools
c. Authenticated Users
4. Close Regedit
This is essentially instead of doing it via loading the hive - which seems to really help the start menu (I think)

5. Reboot the machine
6. Login as domain administrator – run Windows Enabler
7. Copy the profile to \\%domaincontroller%\netlogon\profiles\.v5 with everyone as permissions
8. Change a user to use that as their profile
9. Reboot the computer (giving AD enough time to replicate)
10. Login as that user
11. Start Menu is clickable and edge works on the task bar

However!.

It does not pull in the start menu xml that we have configured, nor the start menu contained within the mandatory profile, but the start menu is fully clickable!

I think other ways I have read on mandatory profiles about loading the hive from another machine didn't work because the DeviceAccess registry key seems to be permanantley locked even if I give everyone full permission - if I do it locally and then export the full mandatory profile it works.

In anticipation

John Paul

 

Local Mandatory Profile doesn't work after joining a domain

You likely need to setup the mandatory profile to be on a server share in the domain as that's the way that functionality works with Windows in domain environments so it's likely the way you have it configured that needs to change but I've done this successfully many times in the past.

Further Resources

• Creating a mandatory profile on Windows 10 1803
  
  
• Roaming user profiles of earlier versions of Windows are incompatible with Windows 10 and Windows Server 2016