Exploring User Profiles

Windows XP loads users' profiles when they log on to the computer and unloads their profiles when they log off. A user profile contains a registry hive with per-user settings and folders, which contain documents and data files. The following section, "Profile Hives," describes the registry hive that the operating system loads. The section "Profile Folders" describes the folders in a user profile.

Before delving into the contents of user profiles, knowing their location on the file system is useful. The default location is different than it was in Microsoft Windows NT 4.0 or other operating systems of that era. Remember that Windows NT 4.0 stored user profiles in %SYSTEMROOT%\Profiles, but this location made it difficult to secure the operating system files while allowing access to users' data. Microsoft Windows 2000 and Windows XP store user profiles in a different location, which enables you to pull user data out from under an operating system folder: %SYSTEMDRIVE%\Documents and Settings, C:\Documents and Settings on most computers. This is the case only with a clean installation of Windows XP, however.

If you upgrade from a version of Windows earlier than Windows 2000, the profiles remain where they were in the previous operating system. For example, if you upgrade from Windows NT 4.0 to Windows XP, the profiles remain in %SYSTEMROOT%\Profiles. The location of user profiles after upgrading from Windows 2000 to Windows XP depends on whether you installed Windows 2000 cleanly or upgraded from an earlier version of Windows. In other words, the setup program never moves user profiles during an upgrade. Table 10-1 summarizes where you'll find profile folders, scenario by scenario.

Table 10-1: Location of User Profiles

Scenario	Location
Clean installation	%SYSTEMDRIVE%\Documents and Settings
Upgrade from Windows 2000	%SYSTEMDRIVE%\Documents and Settings
Upgrade from Windows NT 4.0	%SYSTEMROOT%\Profiles
Upgrade from Windows 98	%SYSTEMDRIVE%\Documents and Settings

Windows XP creates and stores a list of user profiles. Table 10-1 shows the locations of user profiles depending on the scenario. The key HKLM\SOFTWARE\Microsoft\Windows NT \CurrentVersion\ProfileList corresponds to the list you see in the User Profiles dialog box. To open the User Profiles dialog box, click Start, Control Panel, Performance And Maintenance, and System. In the System Properties dialog box, on the Advanced tab, click Settings in the User Profiles area. Each subkey is a user profile, and the subkey's name is the SID of the account that owns the profile. Each profile in ProfileList contains the REG_SZ value ProfileImagePath that points to a user profile folder in %SYSTEMROOT% \Documents and Settings. Figure 10-1 illustrates the relationship between the ProfileList key and the user profile folders. This relationship is the reason you shouldn't just remove a user profile from the file system. Instead, use the User Profiles dialog box to remove user profiles, which cleans the user profile out of the ProfileList key as well as off the file system.

Figure 10-1: The subkeys of ProfileList contain a wealth of information about the user profiles that Windows XP has created, including their paths on the file system.

Note 

In enterprises that use Windows NT 4.0, IT professionals sometimes move profiles to %SYSTEMROOT%\Profiles when deploying Windows XP because managing the profiles is often easier if they are in the same location regardless of the platform. Windows XP answer files offer a setting that enables you to do that. The setting is ProfilesDir, and it's in the [GuiUnattended] section. Set ProfilesDir to the path of the folder in which you want to store profiles. You should begin the path with either %SYSTEMROOT% or %SYSTEMDRIVE%; otherwise, the setup program ignores it.

Advantages of User Profiles

The primary goal of user profiles is to keep each user's settings and data distinct from that of other users as well as from the computer's settings. This has several advantages for enterprise environments and makes Windows XP more convenient to use at home, too. User profiles enable statelesscomputing. A company can configure Windows XP to store key user settings and data separately from the computer. This makes backing up and replacing computers much easier because users' data is tucked safely away on the network and maintained separately from the computer's configuration. The first time users log on to a replacement computer, the operating system copies their settings from the network. They get back to work more quickly.

User profiles also allow users' settings to follow them from computer to computer. They don't have to reconfigure settings at each computer. When they log on to a network that supports roaming user profiles, the operating system downloads their settings from the network. When they log off of the computer, the operating system copies users' settings back to the network. Roaming user profiles makes sharing computers more feasible because each user has his or her personalized configuration. Roaming user profiles are a must-have in environments such as call centers, where users aren't guaranteed to sit down at the same computer twice. You learn about roaming user profiles in the section "Using Roaming User Profiles," later in this chapter.

Profile Hives

The first half of a user profile is the profile hive: Ntuser.dat. You learn about the second half in "Profile Folders." This file is in the root of users' profile folders. Chapter 1, "Learning the Basics," and Chapter 2, "Using the Registry Editor," describe hive files and how to work with them. Users' operating system and application settings are stored in profile hives. For example, you find all the per-user settings for Windows Explorer and persistent network connections in profile hives. Profile hives also contain per-user taskbar, printer, and Control Panel settings. Accessories that come with Windows XP store per-user settings in the profile hive.

When Windows XP loads a user profile, the operating system loads the hive file Ntuser.dat into the subkey HKU\SID, where SID is the user's SID. (See Chapter 1, "Learning the Basics," for more information about SIDs.) Then Windows XP links the root key HKCU to HKU\SID. Figure 10-2 shows this relationship. Windows XP and most applications reference users' settings through HKCU, not HKU\SID, because HKCU resolves which subkey of HKU contains the console user's settings. HKU contains a second hive file, HKU\SID_Classes, which contains per-user file associations and class registrations. You learn about this in Appendix A, "File Associations."

Figure 10-2: Windows XP loads Ntuser.dat into HKU\ SID and then links HKCU to it.

The list of profile hives is in the key ProfileList, which you learned about in the previous section. It contains one subkey for each user profile. The subkey's name is the name of the hive in HKU or the account's SID. The REG_SZ value ProfileImagePath is the path of the profile hive file Ntuser.dat for that user profile. ProfileList does not contain a value for the SID_Classes hives, however. HKLM\SYSTEM\CurrentControlSet\Control\hivelist contains one REG_SZ value for each hive in HKLM and HKU that the operating system is currently using. The difference between the values ProfileList and hivelist is that ProfileList contains a list of all user profiles that Windows XP knows about, loaded or not, and hivelist contains a list of all currently loaded hive files.

Tip 

You can load and edit profile hives in Registry Editor (Regedit) without logging on to the computer using the account that owns that user profile. This is one of the techniques you use later in this chapter to build default user profiles.

Profile Folders

The folders in a user profile contain per-user application files. For example, Office XP installs templates and custom dictionaries in the user profile. Internet Explorer stores its cookies and shortcuts in the user profile. The most interesting folder in a user profile is the Application Data folder. Figure 10-3 shows a user profile in Windows Explorer. Some of the folders are hidden; show the hidden files in Windows Explorer if you want to see all the following folders for yourself:

• Application Data. This folder contains application files, such as mail files, shortcuts, templates, and so on. Each application's vendor chooses what files to store here. You can redirect this folder to a network location using Group Policy.

• Cookies. This folder contains Internet Explorer cookies.

• Desktop. This folder contains files, folders, and shortcuts on the desktop. Users see the contents of this folder on the Windows XP desktop. You can redirect this folder to a network location using Group Policy.

• Favorites. This folder contains Internet Explorer favorite shortcuts. Users see the contents of this folder on Internet Explorer's Favorites menu. Group Policy doesn't support redirecting this folder, but you can redirect it manually as shown in Chapter 15, "Working Around IT Problems."

• Local Settings. This folder contains application files that do not roam with the profile. The files you find in this folder are either per-computer or too large to copy to the network. This folder contains four interesting subfolders:

  • Application Data. This subfolder contains computer-specific application data.

  • History. This subfolder contains Internet Explorer history.

  • Temp. This subfolder contains per-user temporary files.

  • Temporary Internet Files. This subfolder contains Internet Explorer offline files.

• My Documents. This folder contains the default location for users' documents. Applications should save users' documents to this folder by default, and this is the location to which the common dialog boxes open by default. This folder also contains the My Pictures folder, which is the default location for users' pictures, and optionally the My Music folder, which is the default location for users' music files. You can redirect this folder to a network location using Group Policy.

• NetHood. This folder contains shortcuts to objects on the network. Users can browse the folders to which these shortcuts are linked in the My Network Places folder.

• PrintHood. This folder contains shortcuts to printer objects. Users see the contents of this folder in the Printers folder.

• Recent. This folder contains shortcuts to the most recently used documents. Users see these shortcuts on the My Recent Documents menu, which is on the Start menu.

• SendTo. This folder contains shortcuts to drives, folders, and applications that are copy targets. Users see the contents of this folder when they right-click an object and then click Send To.

• Start Menu. This folder contains shortcuts to program items. Users see the contents of this folder on the Start menu and on the Start menu's All Programs menu. IT professionals can redirect this folder to a network location using Group Policy.

• Templates. This folder contains template files. Users see the contents of this folder when they right-click in a folder and then click New.

Figure 10-3: The user profile folders you see in this figure are the default folders in a clean installation of Windows XP.

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders is the key where Windows XP stores the location of each folder that's part of a user profile. Each value in this key represents a folder as shown in Table 10-2. These are REG_EXPAND_SZ values, so you can use environment variables in them. Use %USERPROFILE% to direct the folder somewhere inside users' profile folders and %USERNAME% to include users' names, particularly when you want to redirect a profile folder to a network location. Redirect users' Favorites folders to the network by setting Favorites to \\ Server \ Share \%USERNAME% \Favorites, where \\Server \Share is the server and share containing the folders, for example. Windows XP does not use the similar key Shell Folder.

Table 10-2: User Profile Folders

Name	Default path
AppData	%USERPROFILE%\Application Data
Cache	%USERPROFILE%\Local Settings\Temporary Internet Files
Cookies	%USERPROFILE%\Cookies
Desktop	%USERPROFILE%\Desktop
Favorites	%USERPROFILE%\Favorites
History	%USERPROFILE%\Local Settings\History
Local AppData	%USERPROFILE%\Local Settings\Application Data
Local Settings	%USERPROFILE%\Local Settings
My Pictures	%USERPROFILE%\My Documents\My Pictures
NetHood	%USERPROFILE%\NetHood
Personal	%USERPROFILE%\My Documents
PrintHood	%USERPROFILE%\PrintHood
Programs	%USERPROFILE%\Start Menu\Programs
Recent	%USERPROFILE%\Recent
SendTo	%USERPROFILE%\SendTo
Start Menu	%USERPROFILE%\Start Menu
Startup	%USERPROFILE%\Start Menu\Programs\Startup
Templates	%USERPROFILE%\Templates

Special Profiles

The profile folders you saw in Figure 10-1 contain more than the standard user profiles that Windows XP creates when users log on to the operating system. The figure shows four special user profiles about which any IT professional should learn:

• All Users. This profile folder contains settings that apply to all users who log on to the computer. This profile folder contains a profile hive, Ntuser.dat, which the operating system doesn't load. Also, this profile folder contains the shared documents and music folders; shared Start menu shortcuts, and so on. The key User Shell Folders in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer contains the linkages to the subfolders in the All Users profile folder.

• Default User. This profile folder contains the default user profile that Windows XP copies when it creates new user profiles. It contains most of the files and folders that you learned about in the previous section. Customizing this folder is a good way to start each user who logs on to the computer with the same settings. Windows XP first checks for a Default User folder on the NETLOGON share of the server and uses the local Default User folder only if the network copy isn't available. Customizing this folder is a good way to deploy settings that you don't want to manage. You learn how to customize it in the section "Deploying Default User Profiles," later in this chapter.

• LocalService. This profile folder is for the built-in LocalService account, which Service Control Manager uses to host services that don't need to run in the LocalSystem account. This is a normal user profile with limited data. You don't see it in the User Profiles dialog box, and the LocalService folder is super-hidden.

• NetworkService. This profile folder is for the built-in NetworkService account, which the Service Control Manager uses to host network services that don't need to run in the LocalSystem account. This is a normal user profile. You don't see it in the User Profiles dialog box, and the NetworkService folder is super-hidden.

In the previous list, the first two profile folders are far more interesting than the last two. IT professionals often customize the All Users profile folder on disk images. The customization, such as a shortcut on the Start menu, affects all users who log on to the computer. IT professionals more frequently customize the \Default User folder, though. Doing so is a great way to create custom settings that you don't want to manage. In other words, it's one method for deploying common user preferences while still allowing users to change those preferences if necessary. As you'll learn throughout this chapter, customizing the Default User folder on a disk image isn't necessarily the most efficient means to deploy default user settings. Instead, create a customized Default User folder on the server's NETLOGON share. See the section "Deploying Default User Profiles," later in this chapter.

Tip 

Many programs install themselves for use by a single user when you really want all users who share the computer to use them. You can tell when a program is installed per-user because its shortcut is in the profile folder belonging to the account you used to install it. If the program re-creates missing settings as it starts, you can change the program from per-user to per-computer by simply moving its shortcut from the user profile folder in which it installed the shortcut to the All Users profile folder. This works the other way, too. You can move a shortcut from the All Users profile folder to a specific user's profile folder so that only a single user sees the shortcut.

Improvements to User Profiles

In Windows 2000, poorly written applications and services that keep registry keys open during logoff prevent Windows 2000 from unloading the user's registry hive. When this occurs, changes that a user made to his or her profile are not saved to the server. This has three symptoms:

• The user experience is affected because changes are not saved when users log on to another computer.

• Because locked profiles never get unloaded, they end up using a lot of memory on a terminal server that has many users logging on to it.

• If a profile is marked for deletion at logoff (to clean up the machine or for temporary profiles), profiles do not get deleted. The three symptoms are solved as follows:

• In Windows XP, when a user logs off and the profile is locked, the operating system polls the profile for 60 seconds before giving up. Windows XP then saves the user's profile hive and roams the profile correctly.

• When the application or service closes the registry key and unlocks the profile, Windows XP unloads the users profile hive, freeing memory used by the profile.

• If a profile is marked for deletion, when the reference count drops to zero, Windows XP unloads and deletes it. In the event that the application never releases the registry key, Windows XP deletes all profiles marked for deletion at the next machine boot.