GPO Folder Redirection W/ Roaming Profile Issue

awizarddidit · 11-06-2009, 09:58 AM

Hey guys & gals,

In our company we are trying to setup a default user profile for new employees (as we are migrating this enterprise to a domain from a workgroup). We have created the exact 'new' profile and copied it to the NETLOGON folder of the primary DNS/DC in our domain.

We have also created an OU, with the new user in it, that has a GPO applied to it that cause folder redirection for Application Data, Desktop, My Docs & Startmenu to the location \\server\share\%username%\

The issue we are having is... Unless I specify in the user's account profile tab a profile path for the user, when the user first logs on it does not look to the NETLOGON for the Default User template, instead it uses the local Default User Template on the machine...how do i specify in a GP that all profiles, in the OU the GP is applied to, are roaming profiles without having to right click each user in ADUC & click properties -> profile tab & input the profile path manually. Is that not what the GP folder redirection is for?

Systems are Server 2003 R2 (fully updated) Domain controller (AD) & machines are XP SP3 fully updated, no Terminal Services of any kind in use on this network.

Any thoughts?

**2xgrump** · 11-06-2009, 12:10 PM

Hi, pls. verify your roaming profile configuration here.

http://technet.microsoft.com/en-us/l...96(WS.10).aspx

Here's a helpful link as well: http://www.windowsnetworking.com/art...rver-2003.html

awizarddidit · 11-06-2009, 01:15 PM

Thanks 2xgrump. I did check this actually prior to posting. The solution is in two parts.

1. The one way to setup multiple user's with uniquie profile paths without completing it manually is to used microsofts ADSI tool. There are multiple templates available from microsoft depending on what parts of the profile you want customized when you generate all of them. One of the options is setting a profile path.

2. For the folder redirection, to ensure the GPO does not allow the alteration of the desktop icons or start menu icons (pin'd programs only on start menu the rest are controlled through other GPO's) create sub folders in your folder redirection path for both start menu and desktop.(IE \\server\share\startmenu & \\server\share\desktop) Set the NTFS permissions to read only for the folders start menu and desktop and do not inherit from the share that startmenu & desktop are nested in(as the above folder should have full control to everyone) Then when creating the redirection policy for desktop and start menu choose 'basic' and 'redirect to following location' and set the UNC to \\server\share\start menu & \\server\share\desktop respectively.

The LAST step that I missed was that, even though you have set up read permissions only on the desktop folder's NTFS permissions, in the folder redirection properties page there is a second tab called 'settings'....you have to uncheck 'grant exclusive rights to desktop' as well as uncheck 'move contents of desktop to new location' to stop users from making changes to desktop that will stick.

The above will allow you to have a my documents user can save files to but no changes will be saved for the desktop or the start menu 'pin'd icons. To change the right side of your start menu or set a background on your desktop see the individual GPO settings.

11-06-2009, 09:58 AM	#1 (permalink)
awizarddidit Registered User Join Date: Sep 2008 Posts: 2 OS: xp	GPO Folder Redirection W/ Roaming Profile Issue Hey guys & gals, In our company we are trying to setup a default user profile for new employees (as we are migrating this enterprise to a domain from a workgroup). We have created the exact 'new' profile and copied it to the NETLOGON folder of the primary DNS/DC in our domain. We have also created an OU, with the new user in it, that has a GPO applied to it that cause folder redirection for Application Data, Desktop, My Docs & Startmenu to the location \\server\share\%username%\ The issue we are having is... Unless I specify in the user's account profile tab a profile path for the user, when the user first logs on it does not look to the NETLOGON for the Default User template, instead it uses the local Default User Template on the machine...how do i specify in a GP that all profiles, in the OU the GP is applied to, are roaming profiles without having to right click each user in ADUC & click properties -> profile tab & input the profile path manually. Is that not what the GP folder redirection is for? Systems are Server 2003 R2 (fully updated) Domain controller (AD) & machines are XP SP3 fully updated, no Terminal Services of any kind in use on this network. Any thoughts?

11-06-2009, 12:10 PM	#2 (permalink)
2xgrump Mentor Networking Forums Join Date: Aug 2009 Posts: 1,007 OS: Vista-sp2/Win2003Server-R2/SBS2003/XP-sp3	Re: GPO Folder Redirection W/ Roaming Profile Issue Hi, pls. verify your roaming profile configuration here. http://technet.microsoft.com/en-us/l...96(WS.10).aspx Here's a helpful link as well: http://www.windowsnetworking.com/art...rver-2003.html __________________ Networking Forums "Peace" RD

11-06-2009, 01:15 PM	#3 (permalink)
awizarddidit Registered User Join Date: Sep 2008 Posts: 2 OS: xp	Re: GPO Folder Redirection W/ Roaming Profile Issue Thanks 2xgrump. I did check this actually prior to posting. The solution is in two parts. 1. The one way to setup multiple user's with uniquie profile paths without completing it manually is to used microsofts ADSI tool. There are multiple templates available from microsoft depending on what parts of the profile you want customized when you generate all of them. One of the options is setting a profile path. 2. For the folder redirection, to ensure the GPO does not allow the alteration of the desktop icons or start menu icons (pin'd programs only on start menu the rest are controlled through other GPO's) create sub folders in your folder redirection path for both start menu and desktop.(IE \\server\share\startmenu & \\server\share\desktop) Set the NTFS permissions to read only for the folders start menu and desktop and do not inherit from the share that startmenu & desktop are nested in(as the above folder should have full control to everyone) Then when creating the redirection policy for desktop and start menu choose 'basic' and 'redirect to following location' and set the UNC to \\server\share\start menu & \\server\share\desktop respectively. The LAST step that I missed was that, even though you have set up read permissions only on the desktop folder's NTFS permissions, in the folder redirection properties page there is a second tab called 'settings'....you have to uncheck 'grant exclusive rights to desktop' as well as uncheck 'move contents of desktop to new location' to stop users from making changes to desktop that will stick. The above will allow you to have a my documents user can save files to but no changes will be saved for the desktop or the start menu 'pin'd icons. To change the right side of your start menu or set a background on your desktop see the individual GPO settings.