Dealing with Profiles and Policies In Vista and Server 2008
Thursday, 26 June 2008 by Michel Roth
We all know that there have been quite a few changes in the way Windows Vista and Windows Server 2008 deal with Profiles and Policies. In my quest to find out more I came across the blog of the Microsoft Directory Services team which provides some very valuable insights.

Insight number one was without a doubt a renewed introduction to a must-read white paper (if you are dealing with user profiles in Vista or Server 2008) called the "Managing Roaming User Data Deployment Guide". Insight number two was the explanation the Microsoft Directory Services team gave of the four new policy settings that Vista / Server 2008 introduce pertaining to user profiles:

Delete user profiles older that a specified number of days on system restart. This policy setting accepts a numeric value, represented in number of days. Windows uses this value to determine the how long it retains dormant user profiles. When you enable this policy, Windows deletes all user profiles older than the value provided. This policy setting measures one day as 24 hours since the last time Windows loaded the profile.

NOTE: Microsoft released a hotfix to correct problems specific to this policy setting. You can view more about the issue and related fix from Microsoft Knowledgebase article 945122 (http://support.microsoft.com/?kbid=945122).

Sometimes, in earlier versions of Windows, the registry portion of the user profile fails to unload. Many times this failure prevents the user from subsequent logons to the same computer. Windows Server 2008 and Windows Vista always unload the registry portion of the user profile, even if it must forcefully do so.

Do not forcefully unload the user registry at user logoff
This counters the default behavior of Windows Vista. When enabled, Windows Vista does not forcefully unload the registry and waits until no other processes are using the user registry before it unloads it.

Set roaming user profile path for all users logging onto this computer
This setting provides you a way to create a shared user profile path for a specific computer. When you enable this policy, all users use the profile path specific in the policy when logging onto a computer receiving the policy. There is a small catch-there is an order of precedence. Windows reads profile configurations in the following order and uses the first configured setting.

  1. Terminal Services roaming profile path specified in the Terminal Services policy setting.
  2. Terminal Services roaming profile path specific in the user object.
  3. Per-computer roaming profile path specified in the above described policy setting.
  4. Per-user roaming profile path specified in the user object.

For example, if you configure the Terminal Services roaming profile path using the Terminal Services policy settings and, you also configure the per-computer roaming user profile policy setting, then Windows uses the roaming profile path from the Terminal Services policy. This result is due to the order in which Windows reads the roaming user profile path.

Set maximum wait time for the network if a user has a roaming user profile or remote home folder
At logon, Windows Vista typically waits 30 seconds for an active network connection, when you configure the user with a roaming user profile or remote home directory. In cases such as wireless, VPN, or NAP-protected networks, it may take more time before the network connection becomes active. When enabled, Windows waits up to the number of seconds specified in the policy setting for an active network connection. Windows immediately proceeds with logging on the user as soon as the network connection is active or the wait time exceeds the value specified in the policy setting. Windows does not synchronize roaming user profile or use the remote home folder if the logon occurred before the network connection became active.

One policy setting for user profile exists under the User Configuration category. Actually, it is more of an Offline Files/ Folder Redirection policy setting. Windows Vista automatically marks all redirected folders as available offline. Windows Vista keeps track of all folders marked offline and synchronizes the contents of these folders between the local computer and the network location where you store the files. This synchronization process occurs at logon, periodically throughout the user session, and at logoff. You configure the policy setting by entering network paths that you only want synchronized during logon and logoff. Windows then places these specified network paths offline during the user session.

Windows Server 2008 and Windows Vista Service Pack 1 provide several new Group Policy settings that affect User Profiles. Many of these new policies settings help overcome profile limitations with earlier versions of the operating system. Be sure to evaluate these settings to see how can help with your environment.

Read more at the Directory Services team blog. 

 

 


Related Items:

Changes in the Windows Vista and Longhorn Profiles (2 December 2006)
Microsoft User Profile Hive Cleanup Service 1.5e (25 October 2005)
triCerat Profile Analysis Tool (PAT) (3 July 2006)
Free Profile Management Tool - BOMBProf (20 October 2006)
RTO Software Launches Virtual Profiles (16 January 2008)
A First look at RTO Virtual Profiles (9 April 2008)
triCerat Launches Simplify Profiles 4.5 (16 February 2007)
Flex Profile Kit 4.0.1 Reviewed (1 April 2005)
AppSense Releases Environment Manager 7.0 (30 January 2007)
triCerat Releases Simplify Suite v4.5.09 (15 August 2007)
Comments (0)