[itdiscuss] TS GPOs

[Tim Larson]

There are several strategies to dealing with profiles on Terminal servers.

1. Mandatory Profiles - When a user logs in, they get a generic profile (that the admin can create and customize).  When they log off, any user based customization is deleted.  Login Scripts can help to set up per-user type settings.  This scenario forces the administrator to control every little detail.  We don't have that much time on our hands.

2. Roaming Profiles - when a user logs off, their profile is copied to a network share and deleted from the terminal server.  When the user logs on, their profile is copied from the network share back to the terminal server.  Great idea, but these profiles seem to like getting corrupted.  And if the user has lots of stuff in the registry or filesystem, the copy can take a bit of time.

3. Standard Profiles (is there a real name for this?) - Users have a separate profile on each terminal server.  They have to set up their outlook settings and such every time they hit a new server.  Users don't like this much at all.

4. Hybrid Approach.  This is what we use.  We actually use Provision Networks to handle some of this, which I've replaced in this explanation with FlexProfiles (free).

- Set up Mandatory Profiles so that after logoff the profiles are deleted.  Create an appropriate Generic user profile (C:\Documents and Settings\Default User) if you want some stuff to come in as default.
- Set up Drive mappings and printer mappings with a login script
- Redirect My Documents and Desktop to somewhere on the network (so that these folders don't have to be copied back and forth over the network at every logon/logoff).  This can be done with Group Policies or logon scripts.  Other folders can be redirected if desired.
- Use FlexProfiles to preserve registry settings.  You tell it what registry keys are important, and it will save them to a network share when the user logs off and restore them when the user logs on.  Figuring out what registry keys to preserve can be tricky.  For example, we preserve HKCU\Software\TNTWare, which contains the settings for a program we use called TNTMPD.

Flexprofiles can be found at http://www.loginconsultants.com under Downloads - Tools.

There is information and documentation included in the FlexProfiles download, and there is a forum at http://portal.loginconsultants.nl/forum/index.php?board=16

     Tim Larson
     Mission to the World