How to Assign a Mandatory User Profile in Windows 2000

To assign a mandatory user profile in Windows 2000, follow the steps that are described in this section.

Step 1: Create a Profile

1. On a domain controller, create a template user account that has the same permissions as the user or the group for which you want to create the mandatory profile.
2. Use the template user account to log on to a workstation computer.
   A user profile is automatically created on the local computer in the Drive:\Documents and Settings\User_name folder.
3. Configure the desktop settings that you want to use in the profile, including shortcuts, appearance, and Start menu options.
4. Log off the computer.

Step 2: Copy the Profile to a Shared Folder

Copy the user profile that you created in the Step 1: Create a Profile section of this article to a shared network folder. To do so:

1. Create a shared folder on the network in which you want to store the mandatory profile, for example, C:\Profiles\Mandatory, and then share this folder. For example, create the following share:

\\Server_name\mandatory

2. Assign at least Read & Execute permissions for the users or groups to whom you want to assign the profile.
3. Log on to the domain as an administrator from the workstation computer.
4. Click Start, point to Settings, and then click Control Panel.
5. Double-click System, and then click the User Profiles tab.
6. Under Profiles stored on this computer, click the profile that you created in the Step 1: Create a Profile section of this article, and then click Copy To.
7. In the Copy profile to box, type the Universal Naming Convention (UNC) path to the share that you created in step 1 (for example, type \\server_name\mandatory), and then click OK.
8. Under Permitted to use, click Change, click Mandatory profile user, and then click OK.
9. On the Windows 2000 Server-based computer, start Windows Explorer, and then locate the shared folder that contains the profile that you copied.
   This folder contains a file named Ntuser.dat.
10. Rename Ntuser.dat to Ntuser.man.

Step 3: Assign the Mandatory User Profile

1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2. Locate the container that contains the user account whose settings you want to modify.
3. In the right pane, right-click the user account that you want to configure, and then click Properties.
4. Click the Profile tab.
5. In the Profile path box, type the location of the profile that you want to assign.
   When you type the location, use the following UNC format, where Server_name is the name of the computer where the profiles are stored and Share_name is the shared folder that contains the mandatory profile:

\\Server_name\Share_name

6. Click OK.
7. On the workstation computer, log on to the domain by using the account to which you have assigned the mandatory profile, and then test to make sure that the profile settings have been successfully applied.

Creating a roaming user profile

Creating a roaming user profile is a two-step process: creating a test user profile and then copying the test user profile to a network server.

Creating a test user profile

In this procedure, you create a test profile for the roaming user:

1. Create a user account to act as a test user account. For example, create an account named Sales Profile.
2. Log on as the test user account. A user profile is automatically created on the local computer in the c:\Winnt\Documents and Settings\username folder.
3. Configure the desktop environment, including appearance, shortcuts, and Start menu options.
4. Log off, and then log on as Administrator.

Copying the test user profile

In this procedure, you copy the test profile to a network server:

1. Create a folder on a network drive in which you can store network profiles. For example:

\\server_name\Profiles\user_name

2. In Control Panel, double-click System, and then click the User Profiles tab. Under Profiles Stored On This Computer, click the profile that you want to copy, and then click Copy To.
3. In the Copy Profile To dialog box, type the network path to the folder. Under Permitted to Use, click Change.
4. Add the appropriate user, and then click OK.
5. In the folder that you created on the network, rename the file Ntuser.dat to Ntuser.man if this is a mandatory user profile.
6. In User Manager for Domains, double-click the user account, and then in the User Properties dialog box, click Profile.
7. In the User Profile Path box, type the UNC path to the network profile folder. For example:

\\server_name\Profiles\user_name

This step-by-step article describes how to restore a user profile as well as the following user profile items:

• Documents
• Desktop settings
• Favorites
• Cookies

By default, when you first log on to a Windows 2000-based computer, Windows creates a user profile folder in the %SystemDrive%\Documents and Settings folder, and you are given Full Control permission. If you lose the Full Control permission for this folder, Windows creates a new user profile folder the next time that you log on and you can no longer access the original user profile folder unless you have local administrative authority on the computer.
If you lose access to your profile folder, Windows creates a new profile folder for you, and places it in the Documents and Settings folder by default. Windows attempts to use your user name as the name of the new profile folder. However, if the old profile folder still exists, Windows modifies the name of the new folder to avoid duplicating the name of the original profile folder. In this scenario, you may see multiple profile folders for your user profile. The following information describes the default naming scheme that Windows 2000 uses for user profiles:

• If the username folder does not already exist, the new profile folder is named:

username

• If the username folder already exists, the new profile folder is named:

username.computername

• If the username.computername folder already exists, the new profile folder is named:

username.computername.000

• If the username.computername.000 folder already exists, Windows uses the next available increment of the username.computername.000 naming scheme.
  For example:

username.computername.001

Another way to keep track of these duplicate profile folders is by the creation date or time, as long as you have not modified the creation date or time.

Back to the top

Requirements

To restore a user profile, the Documents and Settings\username profile folder must still exist, and you must have the Full Control permission for this folder. If you do not have the correct permission for your user profile folder, you (or someone else) must log on to the computer as an administrator and restore the required level of permission to your user profile.

Back to the top

Copy Documents from the Current Profile Folder to the Appropriate User Profile Folder

If you have logged on to Windows since you lost access permission to your original profile folder, there are at least two user profile folders that have your user name. To make these files accessible from the user profile that you are restoring:

1. Log on to the computer as an administrator.
2. Copy all of the documents from your current My Documents folder to the My Documents folder of the profile that you are restoring.
   NOTE: Step 2 is not required if you have moved your My Documents folder to a location outside the Documents and Settings folder; however, after you restore your user profile, you may need to re-specify the target folder location of the My Documents folder.
3. To retain the Internet favorites links, copy all of the Internet shortcut files from from your current Favorites folder to the Favorites folder of the user profile that you are restoring.
   NOTE: Do not copy Desktop.ini file.

Back to the top

Grant Full Control Permission for the User Profile Folder

1. Right-click your old user profile folder, and then click Properties. By default, this folder is %SystemDrive%\Documents and Settings\username.
2. On the Security tab, click your user profile in the Name list, and then click to select Allow for the Full Control permission.
   NOTE: If your user profile is not displayed in the Name list, add your profile: Click Add, click your user name in the list, and then click OK.
3. Click OK to close the dialog box.

Back to the top

Edit the User Profile Registry Key

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 (http://support.microsoft.com/kb/322756/ ) How to back up and restore the registry in Windows

Edit the registry so that the profile image path points to the user profile folder that you worked with in the "Grant Full Control Permission for the User Profile Folder" section in this article:

1. Log on to the computer with the user profile that you want to restore.
2. Click Start, and then click Run.
3. Type regedit, and then click OK.
4. In Registry Editor, navigate to the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList

5. Locate your user profile folder.
   NOTE: When you open the ProfileList folder, you see several folders, each of which belongs to a different user. These folders are named according to the user security IDs (SIDs) and not according to the user names.
   To locate your user profile folder, use one of the following options:
   • For each folder, click the folder, and then look for the ProfileImagePath value that contains the path to your user profile (such as %SystemDrive%\Documents and Settings\username).
     -or-
   • In Registry Editor, press CTRL+F to start the Find tool. Type your user name in the Find what box, click to select the Data check box under Look at, and then click Find.
6. After you locate the subkey folder for your user profile, double-click the ProfileImagePath value.
7. In the Value data box, change the path so that it points to the profile folder that you are restoring, and then and click OK.
8. Quit Registry Editor.

The next time that you log on to the computer, Windows will use your restored user profile.