Re: Mandatory Profile and GPO

Hello,
What I can think off is that you got some registry settings in the mandatory profiles that overwrites the settings applied earlier by the group policy engine. Since they apply in the follow order: Policy Settings -> Profile Settings.

What happens if you run the follow command logged in as "est2": gpupdate.
Will the restrictions to the shutdown command take place then?

If so have the profile as mandatory again with that settings applied.

--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services
----------------------------------------------------------------
http://www.chrisse.se - Active Directory Resources

"Ken Lizotte" <KenLizotte@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:3233EF98-8FA1-4FEB-9AB9-F3BC41B8A8DC@xxxxxxxxxxxxxxxx
I hope this is appropriate for this group.

I have a type of employee that I would like to give mandatory desktop and
security settings. I have Server 2003 on 1 DC (DC1) and several XP Pro
Workstations.

I created an OU called 'Estimators' and created a GPO called 'Estimator
Group Policy' for this OU. For testing, the only setting I Enabled was
'Remove and Prevent Access to the Shutdown Command'. I then created a shared
folder called 'Profiles' on DC1.

I created a user called est1 in 'Estimators' OU. I logged on a workstation
with user 'est1' and, for testing, added a desktop shortcut to calc.exe. I
restarted the workstation and logged in as administrator. From
system/Advanced/User Profiles settings, I copied est1 profile to
\\dc1\profiles\ManProfile and added est1 in 'permitted to use'.

On DC1, I went to \profiles\ManProfile and changed ntuser.dat to ntuser.man.
In Domain Users and Computers, I opened est1 and entered
'\\Dc1\Profiles\ManProfile' under user profile/profile path.

Mandatory profile is working. Now my objective is to add new users in the
'Estimators' OU and assign them the mandatory profile. I add user 'est2' in
the 'Estimators' OU, and enter '\\Dc1\Profiles\ManProfile' under user
profile/profile path. I give est2 full control to the ManProfile folder (same
as est1).

Here is problem: When I log in as est2, I get the shortcut to clac.exe, but
I also get the shutdown function. If I remove the profile path from 'est2',
then a log in creates a local profile and shutdown is not available. It
seems that any new user in the 'Estimators' OU that is directed to the
mandatory profile, loses the GPO for the OU.

I hope I was not too detailed, but wanted to portay an accurate step-by-step.

Any ideas?
Thanks,
Ken

.

Relevant Pages

  • RE: Private settings on my laptop
    ... am still getting the same "can not migrate profile because user settings are ... NOTHING is marked private. ... I understand that you cannot copy profile to domain ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Re: "Classic logon" screen in XP does not remeber the user name
    ... If you used the File and Settings ... that you can access them fine in the profile you want to use them in. ... and log onto a workstation, that workstation immediately goes to a ... you can work from the server and ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Internet Explorercache (further info)
    ... Just for future reference for you...Zone Alarm and Mailwasher are not ... > It is looking more like I will need to delete the profile and then rebuild ... > this saves user settings in IE, OE, My Documents, Mailwasher etc, so in ... > the restore facility in Eazy Backup, it should also put my desktop ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: User-Specific Settings
    ... 'remember each folder's view settings' is checked. ... Outlook and all of our applications run on our server and are accessed thru ... >> Profile tab for all of our users. ... >>> log on to another workstation. ...
    (microsoft.public.win2000.termserv.apps)
  • Re: DNS not working. Help!
    ... > install SBS ... > then migrate the data and as much settings as possible, ... > profile folder ... > When copying the User folders, I made each user the owner of their ...
    (microsoft.public.backoffice.smallbiz2000)