«

On Wed, 17 Dec 2003 13:24:29 +1300, "Matthew Strickland"
<> wrote:

>"Enkidu" <> wrote in message
>news:.. .
>
>> Presumably you are creating a profile, renaming it to .man and then
>> using GPOs to make sure that everyone is using that profile?
>
>Yes profile created, renamed to .man, but ive used the 'profile' path in the
>users account to set the profile. It seems to work (ie desktop appearance,
>application data stuff is working) Its on a share on the server
>\\server\profile
>
>> Is your GPO being applied?
>
>Other parts of the GPO are being applied (with the computer settings). Ill
>run gpresult and see in more detail whats going on. I suspect it *is* being
>applied but the mandatory profile is either happening after the GPO, or it
>somehow over-rides the GPO settings. Its some conflict between mandatory
>profile + folder redirection. "Exclude directorys in roaming profile didnt
>work." - I only have this problem as soon as I remove Domain Admin group
>from users.
>
>> >Also If I adjust the security so users cannot 'delete' the mandatory
>profile
>> >I assume this wont affect it?? (as in read only)
>> >
>> It shouldn't.
>
>I thought so
>
>Matt
>
I'd be interested in the answer! Got no clues, sorry.

Cheers,

Cliff
--

The complete lack of evidence is the surest sign
that the conspiracy is working.

Solved this one, it was because I was going back and adjusting the profile
with my own logon that has different permissions, and different GPO's
applied to it.

The profile should only be modified by the user or users that are using
it... (or rather, someone with similar permissions and GPO settings)

Glad I finally sorted it.

"Jax" <> wrote in message
news:3fdf5784$0$13346$...
> >>Ive setup a single mandatory profile and set some users to point to it.
> >>Seems to work. Ive also setup folder redirection (Desktop) for a group
of
> >>PC's (loopback processing enabled in an OU container of PC's) and thats
ok.
> >>
> >
> > I confused. If you are using folder redirection you must be using
> > GPOs, right.
> >
> >>But when I remove the users from the 'Domain Admins' group, there is no
> >>'re-direction'.
> >>
> >
> > But GPOs don't have anything to do with security groups.
> >
> >>Desktop comes up with I assume, 'default user' from the client machine.
> >>(Note: there is no desktop folder in the mandatory profile,
> >>I want to use folder redirection so it has been deleted)
> >>
> >
> > Presumably you are creating a profile, renaming it to .man and then
> > using GPOs to make sure that everyone is using that profile?
> >
> >
> >>I assume its something to do with restrictions on the local/client
machine?
> >>Its formatted in NTFS. As in it cant cache it locally (no rights) so it
> >>aborts and uses the client one?
> >
> >
> > Is your GPO being applied?
> >
> >
> >>(I quickly tried adding 'everyone' full rights to the 'documents and
> >>settings' folder on the client - then removing it from the subfolders
where
> >>its not needed) - still didnt work.
> >>
> >>2k server with 2k pro clients. I need maximum security (school
situation) so
> >>no admin rights local/server.
> >>
> >>Ideas?
> >>
> >>Also If I adjust the security so users cannot 'delete' the mandatory
profile
> >>I assume this wont affect it?? (as in read only)
>
> I just did a quick AD training here in London and the guy reckoned you
> are crazy to do anything with GPO's without using the "Group Policy
> Management Console"
>
> http://www.microsoft.com/windowsserv...c/default.mspx
> http://www.microsoft.com/windowsserv...mc/gpmcwp.mspx
>
> The tool is for 2k3 but the trick is, it can be run off a Win XP Pro
> workstation hooking into Win 2k Server. It can let you simulate certain
> scenarios, display effective permissions via HTML page etc etc
>
> HTH

Thanks for the report.

Cheers,

Cliff

On Tue, 23 Dec 2003 19:44:31 +1300, "M"
<> wrote:

>Solved this one, it was because I was going back and adjusting the profile
>with my own logon that has different permissions, and different GPO's
>applied to it.
>
>The profile should only be modified by the user or users that are using
>it... (or rather, someone with similar permissions and GPO settings)
>
>Glad I finally sorted it.
>
>"Jax" <> wrote in message
>news:3fdf5784$0$13346$...
>> >>Ive setup a single mandatory profile and set some users to point to it.
>> >>Seems to work. Ive also setup folder redirection (Desktop) for a group
>of
>> >>PC's (loopback processing enabled in an OU container of PC's) and thats
>ok.
>> >>
>> >
>> > I confused. If you are using folder redirection you must be using
>> > GPOs, right.
>> >
>> >>But when I remove the users from the 'Domain Admins' group, there is no
>> >>'re-direction'.
>> >>
>> >
>> > But GPOs don't have anything to do with security groups.
>> >
>> >>Desktop comes up with I assume, 'default user' from the client machine.
>> >>(Note: there is no desktop folder in the mandatory profile,
>> >>I want to use folder redirection so it has been deleted)
>> >>
>> >
>> > Presumably you are creating a profile, renaming it to .man and then
>> > using GPOs to make sure that everyone is using that profile?
>> >
>> >
>> >>I assume its something to do with restrictions on the local/client
>machine?
>> >>Its formatted in NTFS. As in it cant cache it locally (no rights) so it
>> >>aborts and uses the client one?
>> >
>> >
>> > Is your GPO being applied?
>> >
>> >
>> >>(I quickly tried adding 'everyone' full rights to the 'documents and
>> >>settings' folder on the client - then removing it from the subfolders
>where
>> >>its not needed) - still didnt work.
>> >>
>> >>2k server with 2k pro clients. I need maximum security (school
>situation) so
>> >>no admin rights local/server.
>> >>
>> >>Ideas?
>> >>
>> >>Also If I adjust the security so users cannot 'delete' the mandatory
>profile
>> >>I assume this wont affect it?? (as in read only)
>>
>> I just did a quick AD training here in London and the guy reckoned you
>> are crazy to do anything with GPO's without using the "Group Policy
>> Management Console"
>>
>> http://www.microsoft.com/windowsserv...c/default.mspx
>> http://www.microsoft.com/windowsserv...mc/gpmcwp.mspx
>>
>> The tool is for 2k3 but the trick is, it can be run off a Win XP Pro
>> workstation hooking into Win 2k Server. It can let you simulate certain
>> scenarios, display effective permissions via HTML page etc etc
>>
>> HTH
>

--

Christmas comes but once a year, thank the gods. I don't think
that I could cope with twice.