Give Your Users Nice Profiles | Windows Server 2003 for Dummies

A user profile is the collection of desktop, environment, network, and other settings that define and control the look, feel, and operation of the workstation or member server. Windows Server 2003 records profile information automatically for each user. However, unless you make them roaming profiles (which you find out about later in this chapter), these profiles are accessible only locally.

A user profile records lots of information about the user's environment and activities, including the following:

Start menu configuration
Screensaver and wallpaper settings
List of recently accessed documents
Favorites list form Internet Explorer
Network mapped drives
Installed network printers
Desktop layout

TECNICAL STUFF

In addition, a profile includes a compressed copy of the HKEY_CURRENT_USER Registry key in a file named NTUSER.DAT. To find definitions for all the various Registry keys, you can use the Registry Tools utility in the Windows Server 2003 Resource Kit and access REGENTRY.HLP.

You can turn profiles into roaming profiles. (Note that a nonroaming profile is called a local profile .) A roaming profile is a profile stored on a network-accessible drive; therefore, no matter which workstation is used to gain access, the user's profile is available. As a result, the user's working environment follows him or her from one computer to the next . (You can also set the profile so that the user can't customize his or her roaming profile, which is called a Mandatory User Profile. See the last paragraph of this section for details.)

To create and enable a roaming profile for a specific user, follow these steps:

On the domain controller, create and share a directory named Users (or whatever name you like best).
On the workstation where the existing local profile resides, choose System from the Control Panel.
Click the User Profiles tab.
Select the profile that you want to make into a roaming profile.
Click the Copy To button.
Define a network accessible path for the new storage location for the profile.

For example, \\domain controller\users\<username>, where domain controller is the name of the domain controller, users is the share name, and username is the name of the user account that is tied to the profile.
On the domain controller (or any domain member that has the ADMINPAK.MSI tools properly installed), launch the Active Directory Users and Computers (choose Start Programs Administrative Directory Users and Computers).
right-click the user object you just copied to the domain controller and then choose Properties.
Click the Profile tab.
In the Profile Path box in the User Profile section, type the same path from Step 6.
Click OK.

The profile for the selected user is now a roaming profile. After a user has a roaming profile, the local profile is no longer used. It remains on the system, but the user account is now associated with the roaming profile.

By default, each time a user logs out, all changes made to his or her profile during that logon session (no matter which workstation he or she uses) are saved to the profile on the domain controller unless you specifically made this a mandatory profile. The next time the user logs on, the work environment is exactly the same as when he or she logged off. Local and roaming profiles should be used only by a single user. If multiple users need to use a single profile, you should employ a mandatory profile.

A mandatory profile doesn't save customized or personal changes to the profile when a user logs out. Instead, the profile retains the same configuration at all times. This type of profile is used mainly when system or network administrators want to control or limit the end users' ability to modify their profiles beyond a standard one that may be employed throughout the enterprise.

You create a mandatory profile by simply renaming the NTUSER.DAT file to NTUSER.MAN in either a local or roaming profile. After this change is made, the profile remains consistent no matter who uses it. You can always reverse this process by renaming the NTUSER.MAN file back to NTUSER.DAT.