How To Configure Roaming Profiles and Folder Redirection

8/21/2015
HowtoconfigureRoamingProfilesandFolderRedirection
HowtoconfigureRoamingProfilesand
FolderRedirection
Postedby
on
AlanBurchill
18August2010,7:00pm
ReadMeFirst:IfyouareusingFolderRedirectionwithWindows7inyourorganisationthenIwould
definitelyrecommendthatyoucheckmyotherblogpostaboutaprettynastyFolderredirectionbug
andhowtofixitatDisappearingFolderRedirectionIssueswithWindows7
Update:IhavenewblogpostthatdescribesthenewPrimaryComputerfeatureinWindows8
forfolderredirectionatHowtoconfigureaPrimaryComputer(a.k.a.msDSPrimaryComputer
property)inWindows8IalsotalkaboutthisfeatureinaTechNetEdgevideoatEdgeShow55
RoamingProfilesandFolderredirectioniswhatallowsausertologonontoanycomputerinan
organisationsandhavealltheirpersonalfilesandsettingapplytothatcomputerasitwasthelast
timetheyusedacomputer.ThisisreallyaWin/WinforUsersandITProsasforauserthisisabig
timesaverastheynolongerneedtowastetimesettinguptheirdrives,printersandotherpersonal
settingswhentheyhavetouseanothercomputers.ITProsalsobenefitwhenthereisanun
expectedfailureorlossofacomputerthentheydonthavetogothroughwhatcouldbealengthily,
costlyandifnotimpossible,processofrecoveringtheusersdata.
NowtheoreticallyUserStateVirtualizationcanbetotallydonewithjustaRoamingProfile,however
thisquicklybecomesimpracticalasusersoftenstoreaLOTofdatawhichcanmakeusersprofile
impossiblylarge.TogetaroundthisMicrosoftusersfolderredirectiontoessentiallyredirectpartsofa
usersprofiletoafileshareonaserverwhereitiscentrallyaccesswhenevertheylogontoa
computer.
IncaseyoustillwonderingwhatUserStateVirtualizationisthencheckouttheoverviewvideofrom
Microsoftbelow:
data:text/htmlcharset=utf8,%3Cheader%20class%3D%22entryheader%22%20style%3D%22display%3A%20block%3B%20color%3A%20rgb(64%2C%206
1/32
8/21/2015
Reference:ManagingRoamingUserDataDeploymentGuide
FolderRedirectionprovidesawayforadministratorstodivideuserdatafromprofiledata.This
divisionofuserdatadecreasesuserlogontimes,andWindowsdownloadslessdata.
Windowsredirectsthelocalfoldertoacentrallocation,givingtheuserimmediateaccessto
theirdatawhentheysaveit,regardlessofthecomputertheyareusing.Thisimmediate
accessremovestheneedtoupdatetheuserprofile.
Byredirectingthesefolderstoaservertheyareonlyaccesswhenneededandthereforeverylarge
filesdonotslowdowntheprofileupdateprocess.Theobviousdisadvantageofdoingthisisthat
whenausercannotaccesstheredirectedfolders(e.g.disconnectedlaptopusers)theyloseaccess
tothesefiles.Howeverthisrestrictionisalsomitigatedbyensuringthattheuserhasacachedcopy
oftheseredirectedfolders.
BelowIamgoingtogothroughanumberoftipsandtrickstomakesureyougetthemostoutofa
UserStateVirtualizationsetupinyourenvironmentandtoensurethatyoudontfallintosome
configurationtraps.
BeforeyoubeginIwouldalsorecommendthatyoureadthefollowingarticlesfromMicrosoftabout
UserStateVirtualization.
ChoosinganAppropriateUserStateVirtualizationSolution
2/32
8/21/2015
UnderstandingUserStateVirtualizationImprovementsInWindows7
Note:IamgoingtomainlyfocusonWindowsVista/7setupshowevermostofthesetting/principalsI
domentionbelowwillstillapplytoWindowsXP.
Update:HereisareallygoodvideofromDarrenMarElia(FellowGroupPolicyMVP)fromTechEd
NorthAmerica2011.ThissessionisentitledOptimizingGroupPolicyinVirtualDesktop(VDI)
EnvironmentshowevermuchofitcoversUserStateVirtualization.
0:00
SettingupFolderRedirectionsusingGroupPolicy
BelowIwillshowyouhowtosetupfolderredirectionforyouusersprofiles.Itisveryimportantthat
yourealisetheimpactthatredirectionsomeofthesefoldercanhaveasifusershavemanyGBsof
musicofvideosontheirlocalcomputersyoucouldquicklyfindyourselfrunningoutofdiskspaceon
theserver.
ForanothergoodoverviewofRedirectedFoldertakealookatthevideobelow:
3/32
8/21/2015
SettingupfileservershareforUserStateVirtualization
Whensettingupthefileserveryouneedtobesurethatthepermissiononthefolderaresetupsothat
ausercancreateanewfolderhoweveryoualsoneedtoensurethattheycanonlyseetheirownfiles
iftheystarttosnoopabout.
BelowIwillgothoughthesetupofafoldertobeusedforfolderredirectionandtheroamingprofiles.
Combiningausersredirectedfoldersandroamingprofilepathtotheonespotonthenetworkisfar
easiertomanageasitconsolidatesalltheusersinformationinonelocations.
Note:ThisconsolidatedstorageofusersinformationcanonlyappliestoWindowsVista/7systems.
Otherwiseyouwillneedtocreateaseparateshareforroamingprofileswithofflinecachingdisabled
forWindowsXPsystems.
Step1.Createafoldertobeusedasarootfolderforalltheusersinformation(e.g.Users)
Step2.OpenthepropertiesofthefolderandthengototheSecuritytabandthenclickonthe
Advancedbutton.
4/32
8/21/2015
Step3.NowclickontheChangePermissionsbutton
5/32
8/21/2015
Step4.UntickIncludeinheritablepermissionformthisobjectsparent.
6/32
8/21/2015
Step5.ClicktheAddbutton
Explanation:Wehavenowsetupafolderwithnoinheritablefilepermissionsfromtheparent.Wedo
thissowecanremovetheReadpermissionfromUsersforallsubfoldersandfilesinalaterstep.
Youshouldnowseesomethinglikethisbelow.
7/32
8/21/2015
Step6.SelecttheUsersSpecialACLandthenclicktheEditButton.
8/32
8/21/2015
Step7.ChangetheApplyto:permissiontoThisfolderonlyandpressOK
9/32
8/21/2015
Step8.SelecttheUsersRead&executeACLandthenclicktheEditbutton.
10/32
8/21/2015
Step9.AgainselecttheThisfolderonlyoptionfromtheApplyto:sectionandthenpressOK
11/32
8/21/2015
NoticehowthetwoThisfolderonlypermissionsforUsershavenowcombinedintooneACL.
Step10.ThenpressOKandOKtogetyoubacktotheUsersPropertiesscreen.
12/32
8/21/2015
Nowweneedtosharethefolder
Step11.ClickontheSharingTabontheUsersPropertiesscreenandthenclickontheAdvanced
Sharingbutton.
13/32
8/21/2015
Step12.TickSharethisfolderandgivethetypeinasharenameendingwitha$(e.g.Users$)then
clickonthePermissionsButton.
Note:The$symbolattheendofthesharenamemakesithiddentoauserssotheycannotbrowser
tothefolder.Thisisnotnecessarybutitisgoodpracticetohelpstopnoseyusers.
Reference:http://blogs.technet.com/b/askds/archive/2008/06/30/automaticcreationofuserfolders
forhomeroamingprofileandredirectedfolders.aspx
youshouldalwayshidetheprofileshareusingadollarsign($).
14/32
8/21/2015
Step13.TickAllowfortheFullControlpermissions(changeshouldthengetautomaticallyticked)
andthenpressOKthenOKthenClose.
(Optional)SettingupRoamingProfileFolder
15/32
8/21/2015
IfyouarestillusingWindowsXPthenIwouldrecommendconfiguringtheroamingprofilefolderisthe
sameastheUsersfolderfortheredirectedfoldersexceptthatyouneedtodisablefilecaching.
SimplerepeatthestepsaboveforSettingupfileservershareforUserStateVirtualizationinstead
usethefoldernamecalledProfilesandasharenamecalledProfiles$.
Afteryouconfigurethesharepermissions(seestep13above)alsoclickontheCachingbuttonand
selecttheNoFilesorprogramsfromthesharefolderareavailableofflineoptionsthenpressOK
thenOKthenClose.
YoushoulddisableOfflineFiles
EnablingAccessBasedEnumeration
NowwearegoingtoenableAccessBasedEnumerationfortheUsers$sharesothatanyusersthat
manuallygoesto\\server04.contoso.local\users$willonlyseetheirownfolder.Thisisoptional
howeverasitsimplestopsyoursnoopingusersfromseeingwhoelseisintheorganisation.
16/32
8/21/2015
ThislastpartisfortheformerNovellAdminsoutthere.Yes,youcoulduseAccessBased
Enumeration(ABE)onthesenewshareshoweverifthereisgoingtoalotofuserfolderson
anyoneofthesesharesyoucouldexperiencedegradationofperformance.EnablingABEon
asharedoescomeatapriceofperformance.
Step1.OpenServerManagerandexpandRoles>FileServices>ShareandStorageManagement
andthenhighlighttheUsers$share
Step2.FromthemenuclickonActionandthenPropertiesandthenclicktheAdvancedbutton
17/32
8/21/2015
Step3:TickEnableaccessbasedenumerationandthenclickOK
18/32
8/21/2015
Step4.ClickOK
19/32
8/21/2015
Thefolderonyourserverisnowreadyforyourusersroamingprofiles(WindowsVista/7)andfolder
redirections.
Tip:YoucanalsoalsoenableaFileScreenusingtheFileServerResourceManagertopreventyour
usersfromsavingfilestypeofacertainextension(e.g.MP3,AVIorMP4)totheirredirectedfolders.
AnotheroptionthisgivesyouistheabilitytoapplyanAutoApplyQuotatotheusersfoldersandhave
thengetwarningemailmessageswhenevertheyconsumeralotofdiskspace.
HowtoconfiguredRoamingProfilesforauserusingGroup
Policy
Beforewebegin,takethetimetowatchpart2videothatshowsanexampleofhowRoamingProfiles
canbeusedtogiveyourusersabetterexperience.Thisvideoalsodemonstratessomeofthepitfalls
withjustimplementingaroamingprofileforauserwithoutFolderRedirectionenabled.
20/32
8/21/2015
PERUSERROAMINGPROFILE
YouhavealwaysbeenabletoconfiguredausersroamingprofilepatchbyconfiguringtheProfile
Pathontheusersaccount(seeimagebelow).Thismethodallowsyoutogranularlyconfigureausers
roamingprofilepathlocationhoweveritisalotmorelaboriousprocesstoensurethattheyare
consistentwiththefolderredirectionpolicythatisalsoappliedtotheusers.
WINDOWS8.1V3ROAMINGPROFILES
Windows8and8.1nowhasanotherversionofroamingprofileswhichareincompatiblewiththe
WindowsVista/7versions(http://support.microsoft.com/kb/2887239).AsoftheNovember2013
Windows8.1updatethereisnowaregistrykeyyoucansettospawna.v3profiletoavoidconflicts
witholderversionsoftheprofile.ThisregistrykeyisaDWORDValuecalled
UseProfilePathExtensionVersionwithavalueof1andneedstobecreated
underHKEY_LOCAL_MACHINE\System\CurrentControlset\Services\ProfSvc\Parameterskey.This
canbethenbedeployedusingtheGroupPolicyPreferencesRegistryExtensionthatistargetedto
theWindows8.1Computers.
ROAMINGPROFILEEXAMPLES
Belowistheviewofausersroamingprofileconfigured
to\\server04.contoso.local\users$\%username%\profile.IfyouareaWindowsXPuserthiswill
translateto\\server04.contoso.local\users$\sam\profileandifyouareaWindowsVista/7usersthis
21/32
8/21/2015
willtranslateto\\server04.contoso.local\users$\sam\profile.v2andifyouareaWindows8.1withthe
UseProfilePathExtensionVersionregistreykeyenableditwill
be\\server04.contoso.local\users$\sam\profile.v3
Explanation:Ihaveadded\profileontotheendofwhatwouldnormallybetheprofilepathsothat
whentheprofileiscreateditisplacedatthesamelevelasalltheotherredirectedfolders.Youwill
seehowthisworkslateroninthispost.
YouconfiguretheprofilelocationontheProfileorTerminalServicesProfiletabwithin
ActiveDirectoryUsersandComputers.
22/32
8/21/2015
IfyousetuptheoptionalProfiles$shareforWindowsXPthenyouwillneedtomakesuretheshare
youuseisprofiles$(notusers$)andthereisnoneedfortheadditional\Profilesfoldertobespecified.
OncefeaturethatwasintroducedinnewversionofActiveDirectoryUsersandComputerinWindows
Server2003wastheabilitytoupdateuserattributeswithmultipleusersinoneaction(seeimage
below).Thismadethewholeprocessofconfiguringtheusersprofilepatchmucheasierespecially
whendealingwithmanyusersaccounts.
23/32
8/21/2015
PERCOMPUTERROAMINGPROFILE
BeforeWindowsVistatheonlywayyoucouldconfiguretheroamingprofilespathforauserswasby
configuringitontheusersaccountviaActiveDirectoryUsersandComputers.Whileconfiguringthe
roamingprofilepathontheusersaccountisnowfareasierwiththemultipleuserattributeupdate
featurethisstillleftthesettingconfiguredforeachindividualusersandunlessyoudoanauditofall
theuseraccountitispossiblethatsomepathscouldbesetupincorrectly.
HoweverineversinceWindowsVistathereisnowagrouppolicysettingyoucanapplytocomputers
thatconfiguredtheroamingprofilepathforanyonewhologsontothatcomputercalledSetroaming
profilepathforallusersloggingontothiscomputer.
Warning:ThebiggestproblemwiththePerComputerroamingprofileconfigurationisthatthereisno
waytoexcludeyouadministratoraccountsfromalsogettingthispolicyasitisapercomputerpolicy.
Thismeansifanyadministratorlogsontoaworkstationwiththispolicyappliedtheywillbe
24/32
8/21/2015
configuredtousearoamingprofile.
Step1.EditaGroupPolicyobjectthatistargetedtoyourworkstations
Step2.NavigatetoComputerConfiguration>Policies>AdministrativeTemplates>System>User
ProfilesandenabletheSetroamingprofilepathforallusersloggingontothiscomputerand
configurethepathto\\PROFILESERVERNAME\Users$\%username%\profile.
Explanation:Ihaveadded\profileontotheendofwhatwouldnormallybetheprofilepathsothat
whentheprofileiscreateditisplacedatthesamelevelasalltheotherredirectedfolders.Youwill
seehowthisworkslateroninthispost.
25/32
8/21/2015
IfyouarestillrunningWindowsXPthispolicyworksverywellifyouhaveusedageographicalOU
structure(seeBestPractice:ActiveDirectoryStructureGuidelinesPart1)foryourworkstationsas
youwillbeabletosendtheusersroamingprofilepathforeachusertoalocalfileserver.Thiswould
allowyoutopointusersinthelocalsitetotheclosest/quickestroamingprofileservertoreducethe
timeittakestologonandlogoff.HoweverasWindowsVistaandWindows7nowuploadstheprofile
asynchronouslyloadingtheprofileviaahigherlatencylowerbandwidthlinkisnotsonoticeable
unlesstheusershasneverloggedontothatcomputerbefore.
WHICHDOIRECOMMEND?
AmazinglyIamnotgoingtorecommendthepercomputerGroupPolicymethodasthereisnoway
youcangetaroundnothavingaroamingprofileifyoulogonasanadministrator.Thisisarealshow
stopperasIthinkitisreallybadforadministratoraccountsshouldnotbeencumberedwithcrudin
theirprofilewhenloggingontoacomputer.
ThereforeIrecommendtheperuserroamingprofileconfigurationmethod,whichismademuch
easiertodowiththemultipleuserattributeupdateoptionyougetwiththenewerversionofActive
DirectoryUsersandComputers.
OtherRoamingProfileGroupPolicysettings
InthissectionIwillgothrough(innoparticularorder)theGroupPolicysettingsIrecommendyou
configureforsettinguproamingprofiles.
ComputerConfiguration>Policies>AdministrativeTemplates>System
Verbosevsnormalstatusmessages
WindowsVistaprovideslittleinformationaboutthestatusofloadingorunloadingroaming
profilesduringuserlogonandlogoff.Thislackofinformationismisleadingandmaygivea
usertheimpressionWindowsVistaisunresponsive.
ComputerConfiguration>Policies>AdministrativeTemplates>Systems>UserProfiles
AddtheAdministratorsecuritygrouptoroamingusersprofiles(HIGHLYRECOMMEND)
Backgrounduploadofaroaminguserprofilesregistryfilewhileuserisloggedon
26/32
8/21/2015
Deleteuseprofilesolderthanaspecifiednumberofdaysonsystemrestart
UsersConfiguration>Policies>AdministrativeTemplates>Systems>UserProfiles
DonotcheckforusersownershipofRoamingProfileFolders
Usefullyifyouaredoingacrossdomain/forestmigrationofuseraccounts.Alsoreduceslogonissues
causedbyincorrectlysetpermissionsonthefolders.
Limitprofilesize(NOTRECOMMENDED)
Vistastillrespectsthispolicysettinghowever,nolongerpreventstheuserfromloggingoff
thecomputer.Windowsdoesnotsynchronizetheusersprofiletotheprofileserverwhenit
exceedsthepolicyenabledlimit.
Excludedirectoriesinroamingprofile
HandytoexcludeapplicationsthatincorrectlywriteverylargecachesfromtheusersApplicationData
folderifyoudonothavefolderredirectionenabled.
TrustedSites
AsyouareredirectingtheDesktopandStartMenutoanetworklocationyouwillneedto
addthefileserverintothetrustedsiteslistotherwiseWindowswillwarnyouaretryingtorun
aprogramformanuntrustedlocation(seebelow).
Tip:Toavoidhavingtoenterinthenameofeveryfileserverinyourorganisationsimpleaddedthe
DomainnameportionoftheservernamesothatallserverswillbeIntranetZone
(e.g.file://*.contoso.local).SeemyotherblogpostHowtouseGroupPolicytoconfigureInternet
Explorersecurityzonesitesonhowtodothis
ErrorMessageyouwillgetifyoudonotaddyoufileserversintotheIntranetZone.
27/32
8/21/2015
Updates:RoamingProfileImprovementinWindows7
BACKGROUNDSYNCHRONISATION
ThemostsignificantimprovementtoRoamingProfileswithWindows7istheintroductionofanew
featurecalledBackgrounduploadofaroaminguserprofilesregistryfilewhileuserisloggedonthis
enablestheITadministratortoscheduleabackgrounduploadoftheusersNTUSER.datfileifthey
dontlogofftheircomputer.Evenifyourusersareinthehabitofloggingoffattheendofthedaythis
isasettingyoushouldconsiderturningontoensurethattheuserssettingsarealwaysbeingbacked
upasfailurescanhappenatanytime.
HowtoconfigureFolderRedirectionviaGroupPolicy
Nowletstakealookathowtosetupfolderredirectionforausersothatthefilesstoredintheir
personalfolders(e.g.Documents,Music&Videos)arestoredonthefileserverandnotonthelocal
computer.Bydefaultallfoldersthatareredirectedareautomaticallymadeavailableofflinewhichis
donesothatuserscanstillaccesstheirpersonalfilesiftheyaredisconnectedfromthefileserver.On
aWindowsXPsystemthiscanaddsubstantialtimetothelogon/logoffprocessastheuserhasto
waitforthefilestobesyncedhoweverinWindowsVista/7thisisdoneinthebackgroundthereforeit
isamuchmoreseamlessprocess.
Step1.EditaGroupPolicyObjectthatistargetedtoyourusersandnavigatetoUserConfiguration>
Policies>WindowsSettings>FolderRedirection>Documents
28/32
8/21/2015
NowwearegoingtosetupfolderredirectionsfortheDocuments(a.k.a.MyDocuments)folderas
thisisthemostcommonlyredirectedfolderhoweveryouwillneedtorepeatthesameinstructionsfor
eachoftheotherfolders(ifrequired).
Step2.FromthemenuclickonActionandthenProperties
Step3.SelecttheBasicRedirecteveryonesfoldertothesamelocationoption
29/32
8/21/2015
ForthepurposeofthisdemoIamonlygoingtoshowyouhowtosetupaBasicredirection.
Howeverifyouwanttospreadouttheusersamongstmultiplelocationsyoucanusetheadvanced
optionsandapplyadifferentfolderredirectionbasedontheuserssecuritygroupmembership(see
imagebelow).Thisoptionisusefulifyouwanttodistributetheloadacrossmultipleserverbutitcan
starttogetcomplicatedastheusersroamingprofilemaythenbestoredinadifferentlocationsto
theirredirectedfolders.Alsobecarefulwiththeorderyouapplytheseadvancedsettingsasifthe
usersisamemberofmultiplegroupsitwillpickupthetopentryinthelistandthereisnowayto
reorderthelistaftertheentriesarecreated.ForthesereasonsunlessyouREALLYwanttoyou
shouldtrytoavoidusingtheAdvancedoption.
Advancedredirection(justforyourFYI)
30/32
8/21/2015
Step4.SelecttheCreateafolderforeachuserundertherootpathoptionundertheTargetfolder
locationandthentypethefullUNCpathintherootpaththatwecreatedbefore(e.g.
\\server04.contoso.local\users$)thenclickontheSettingsTab.
31/32
8/21/2015
Step5.
32/32

How To Configure Roaming Profiles and Folder Redirection

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

How To Configure Roaming Profiles and Folder Redirection

Transféré par

Droits d'auteur :

Formats disponibles

8/21/2015

Vous aimerez peut-être aussi