Windows profiles include the user registry and the file system under c:\users\%username%. Windows profiles are where application vendors store setting information particular to a user. What is stored here can be anything the vendors need to store for their applications to work. Many application run specific setup code the first time an application is launched by a new user on a desktop. Windows supports a process called ActiveSetup that allows vendors to hook code into the user logon for this setup purpose. The first time a user logs in to any desktop the settings in Windows Active Setup are run.

This process can take a very long time to complete. The actions performed by the application can include many things including:

• Create Shortcuts
• Create Folders
• Define Application Settings
• Obtain input from users and store it somewhere
• Etc.

The time it takes to create the user profile, then configure the applications defined in ActiveSetup can be very long, sometime over 5 minutes. For customers using non-persistent desktops this can be very problematic as users will run this process every logon. One advantage of using a pre-defined or mandatory profile is that these processes have already been run so that the logon becomes much faster.

Another benefit of a predefined profile is that standard settings can be configured for each user logging in to a desktop. These settings can often be configured by script or GPO but desktop admins sometimes prefer a direct modification of the windows default profile.

In Windows XP and earlier these modifications were often performed on any profile then copied over the default profile or copied to create a mandatory profile.

When Windows 7 was released Microsoft determined this process was too dangerous and now they only support modifying the default profile or creating a mandatory profile using the “copyprofile” command as part of the sysprep process as outlined in this KB article.

http://support.microsoft.com/kb/973289

In this recipe we will discuss two methods for creating a mandatory profile that can be used to both speed up user logons and configure user settings. One is the Microsoft method using copyprofile. The other uses a free utility from ForensiT (http://www.forensit.com/ ), called defprof, that provides a mechanism to copy a local user profile over a computers default profile. Be aware this second method is not supported by Microsoft but seems to work in our testing on Windows 7 and Windows 8. Defprof has not yet been updated for Windows 10. So for Windows 10 you must use the copyprofile method.

Using either of these methods will require some trial and error as well as in depth understanding of what settings applications store in the profile. Many applications are not compatible with utilizing a mandatory profile because the information they store in the profile is specific to a single user. For example an application can store a user name or even an encryption key, hashed to the username of the user creating the profile. If these were deployed to a desktop with a different user logging on, the application would at best have the wrong user defined and at worst not be able to unencrypt the application information stored with the key.

Often these types of limitation are found only after testing the application when using a mandatory profile.

The advantage of the defprof method is that we can keep a profile template desktop in our environment and use it to test and modify the default template we use as the basis of our mandatory profile. When using the copyprofile method we must create a new profile from scratch every time a change is desired. This can be quite tedious.

---

Instructions

Windows 8 and 10

In Windows 8 Microsoft introduced” Metro-Style” or “Modern” Apps. These apps are not installed for all users on the system but instead for particular users with their files often stored in the Windows profile in AppData\Local. These apps cannot be included in a Mandatory profile and for this whole process to be successful they must be removed from the desktop during build. The Unidesk Optimizer has settings to remove these apps as the desktop is being built. You can set these settings in the OS layer or in the Man Profile Layer depending on if you want to remove the apps for all desktops or just non-persistent desktops.



Another Critical performance related tweak required to get good logon performance for Windows 8 and 10 is also supported by the optimizing. You must use the optimizers autologon feature so that a network user will be logged on to the desktop during build. This process copies a set of system files from the SO layer to the desktops UEP during build. If the files are not copied before the desktop is converted from persistent to non-persistent then they will have to be copied every logon adding approximately 80-90 seconds to the logon process. See the “Increase NP Desktop Performance Recipe” for more details.

The section in the optimizer used for this is shown below.



Lastly you cannot include setting up start menu Tiles in your mandatory profile because these are not stored under AppData\Roaming they are stored in AppData\Local which is not included in the Man profile.



This means that after logging in the start menu will look like this.

  


CopyProfile Method

If using this approach a layer is created using all of the desired applications as prerequisite layers when creating the layer. The administrator’s account settings are then modified as desired and the layer is finalized. Then this layer is used to create a desktop using the copyprofile=true flag in the unattend.xml file. This will create a default profile with all the settings included in the administrator profile on the layer. Then this profile is copied to a server share so that it can be copied down into a new layer that will be used to apply the mandatory profile to desktops.

The high level process is as follows: