Server 2k3 locked Roaming Profiles.

[Recursion]

Hey,

I need to set up some roaming profiles so that a user can log on, do whatever to their desktop and it won't save it when they log out. This means that everytime the user logs on the desktop is set back to normal with the program links in the start menus etc etc.

Anyone know how I would do this on a Win 2k3 domain network?

Thanks

[Tomm]

Setup a logoff script to delete everything in their start menu/desktop and then replace it with the stuff you want there.

If you don't want them to alter the start menu or desktop at all just redirect all users desktops and start menus to the same location and deny all users write permissions.

You can do all this stuff with group policies, if you want it to apply to a certain user group then just create a new GPO and use security group filtering to limit it to those in that group.

[Recursion]

Ah, I didn't think just denying write access would work, thanks! I'm just gunna create a profile, they can do whatever and then when they log off at the end none of it is saved.

Thanks.

[Tomm]

Make sure to tell it not to copy the files currently in the users desktop/menu else it will fail to redirect since it can't write to it.

[Recursion]

What I was going to do was to create a local user account on a computer on the domain, set it all up the way I want it to be then copy the profile folders over to the server's profile shares, rename the profile folder to the respective account names and then login as the domain user to test it, so it shouldn't need to write to it, correcto?

[Tomm]

I don't see how that would prevent the user from changing the desktop/start menu though?

[Recursion]

Well, when I copied the profiles over i'd set the permissions to disallow write access to anyone but Administrators.

[mat64]

Sounds like you are referring to mandatory profiles

A mandatory user profile is a preconfigured user profile. The user can still modify the desktop, but the changes are not saved when the user logs off. The next time the user logs on, the mandatory user profile is downloaded again. User profiles become mandatory when you rename the NTuser.dat file on the server to NTuser.man. This extension makes the user profile read-only.

[Recursion]

Aha! That must be it! Thank you

Btw, +REP to both of you if I can.

[Tomm]

This will disalow the users doing alot more than just changing the desktop/start menu though.