How to create mandatory profiles in Windows 1. Creators Update 1. HTGI wrote a comprehensive post a few years ago God, its been that long on how to create mandatory profiles. When Windows 1. 0 came along, mandatory profiles had been completely and utterly forgotten about, and simply didnt work. After a while, they got around to fixing this, and I ended up recording a rather long video about how to create them. Unfortunately this had some issues around UWP apps, in that they seemed not to work very well when using a mandatory profile. Windows_Update_Settings_Disabled.png' alt='Windows Update Managed By System Administrator Regedit' title='Windows Update Managed By System Administrator Regedit' />And then, just as I was getting around to having a look at the WP issue, Microsoft released the Creators Update 1. This, although it ostensibly brought back the capability to use the Copy Profile command to create a mandatory profile, also had the annoying effect of now breaking the Start Menu when you used a mandatory profile thanks to Pim for the heads up on this issue. So, yesterday I set about cracking the issues that we had, so we needed to create a mandatory profile and test a Whether the Start Menu functionsb Whether the UWP apps functionc If both of the above still work OK when the user logs in to a second machine. Now, the only officially supported way to create a mandatory profile is by using Audit Mode to create a custom default user profile, and then using the Copy Profile command to move the customized default user profile to a network share. Windows Update Managed By System Administrator Regedit' title='Windows Update Managed By System Administrator Regedit' />This is the way Ive attacked it in the new video Ive recorded. This article is intended to supplement that and if you choose to do it the old fashioned way, by copying an existing profile directly into a network share, youre going to get problems. I downloaded and updated my Windows 7 pro to Windows 10 today. I had two user accounts in Windows 7 before update Administrator and Ritesh. I never used Ritesh. Fix System Restore Point Creation Configuration Disabled by Group Policy or System Administrator in Windows Sometimes when you try to create a System Restore. Do you need new ScanSnap Windows 10 drivers How does the Fujitsu ScanSnap work on Windows 10 Heres what you need to know. As an system administrator, I know how difficult it can be to solve Windows Update errors. This is particularly the case with Windows Update, because Windows Update. Computer Configuration Policies Administrative templates Windows Components Remotes Desktop Services Remote desktop Session Host Security Always prompt for password. Windows has some great features, but like any operating system, it brings its share of issues with every new version. Windows upgrades are tricky business. Its. Ron Says March 4th, 2013 at 1113 pm. I was able to use Mikes regedit method, but how can I adjust or stop my system from going to sleep after 30 seconds. Believe me, Ive tried Pre requisites. We need a a network share to hold our user profileb a Windows 1. Active Directory environmentd Ensure this Registry value is set on your devices HKLMSoftwareMicrosoftWindowsCurrent. VersionExplorerSpecial. Roaming. Override. Allowed REGDWORD value 1. Hopefully you should have all that checked The hard work creating the mandatory profile. Build a Windows 1. Audit Mode. You trigger Audit Mode when it reaches the screen that asks you which regional layout you want, and do it by pressing Ctrl Shift F3. The machine will then log you in and put up a sysprep prompt click Cancel on this. Once logged on, customize the environment how you want your mandatory profile to look. How much or how little you do probably really depends on what you are using the mandatory profile for. If you are using it as a base for a UEM product, then you probably dont want much customization. If youre using it for a kiosk or similar device, you may want a lot. Some of the things I find it handy to set are browser home pages, browser search provider, show file extensions in Explorer, change the default view in This PC away from Quick Access its entirely up to you how much or how little you customize. Heres how much I did complete with odd icon placement so I can tell if it has worked Next, create an XML file with the following text lt Microsoft Windows Shell Setup processor. Architectureamd. Key. Token3. 1bf. Scopenon. Sx. S xmlns wcmhttp schemas. WMIConfig2. 00. 2State xmlns xsihttp www. XMLSchema instance lt Copy. Profile truelt Copy. Profile lt component lt settings lt cpi offline. Image cpi sourcewim D sourcesinstall. Windows 1. 0 Enterprise xmlns cpiurn schemas microsoft com cpi lt unattend Changing the settings in bold to those as required in your environment the path to the install files, and the Windows 1. EditionMake a note of the XML file name and path I normally copy it to C unattend. Next, open an administrative command prompt and run the following commandwindirsystem. Sysprep is a System Preparation Tool designed for Windows deployment, and this tool is commonly used to prepare your operating system for disk cloning or restoration. Greetings Leo, Thank you for sending feedback. We understand that you continue to have problems with Windows Update. Our team is working on a more. Resolves issues in which you cannot open Help files. Windows Help format in Windows 7 or Windows Vista. XML file you created. Now, this will restart the system and complete the installation, copying your user profile into the default user profile area. After this, I normally apply all patches and join the domain. Once this is done, log on with a domain account that has access to your network share where you intend to store the profile, and open up the Advanced System Properties dialog. Click on the Advanced tab and then Settings. Highlight the Default Profile, and click Copy To. Enter the path that you wish to copy to, change Permitted to use to say Authenticated Users, and check the box for Mandatory profile not that it appears to do anything, but hey, check it anywaysThis copies the Default Profile across to our file share but its not done properly, sadly. Firstly, we need to set the permissions correctly. The filesystem needs to have the permissions set as below ALL APPLICATION PACKAGES Full Control this is mega important without this set the Start Menu will failAuthenticated Users Read and Execute. SYSTEM Full Control. Administrators Full Control. Once you have set these permissions on the parent folder ENSURE that you cascade them all the way down the filesystem, and also MAKE SURE that Administrators is the owner of all the files and folders as well. Next we need to set the Registry permissions as well. Open up regedit. exe, select the HKEYUSERS hive, and choose the Load Hive option from the File menu. Windows Xp Pro Sp2 Inc No Activation. Browse to the network share where you copied the files to, and open up the ntuser. Give it a name, and you will see the named hive loaded under HKEYUSERS. Right click on the root of the hive you have loaded and select Permissions. The permissions in here will be wrong. Change them to match those set below exactly. You must ensure that the RESTRICTED group is removed, otherwise you will be unable to log on and will get an Access Denied error. When you apply these permissions, you will get an error saying unable to set security in some keys just ignore this. Now, search the Registry hive for any instances of the username and delete them. If you want to be really thorough, search for the SID of the user too and remove any references to that. After this I normally delete any Registry keys which I think are unnecessary. Policies keys can definitely go, I also tend to remove APPDATALOW from Software and the huge amount of Google references you will find within the Registry. Its up to you how much you do here certainly there are lots of redundant objects related to gaming, XBox and Sky. Drive that could easily be taken out. Once youve done this, highlight the root of the loaded hive again and choose File Unload Hive from the menu in regedit. VERY IMPORTANT After this, you can highlight the Registry transaction logs in the root of your file share and delete them theyre not needed. Next you can strim down the filesystem. Because the Copy Profile command ignores the App. DataLocal and App. DataLocal. Low folders, you shouldnt have too much to do here. I normally just get rid of App. DataRoamingAdobe. This usually takes the size of the mandatory profile down to just over 1. MB, which is about right. For the penultimate steps, rename the ntuser. Mandatory check box not do this bit, and then set a test user to use the mandatory profile in AD or GPO. But there is one final step we need to take to ensure that UWP apps work in our mandatory profile. You need to set a GPO that allows roaming profiles because mandatory profiles are simply read only roaming profiles to deploy UWP apps.