At this point, you may have noticed that we didn’t give our users very many permissions on the Users folder. First and foremost, we made sure that one user can’t see inside of another user’s folder. It’s also pretty obvious that we don’t want to give users the ability to do things like take ownership, delete files/folders, or change permissions, but a few of the other missing permissions take a little more explanation.

First off, you don’t want users to have Create files/write data permissions or they can save files into the root of the shared folder. Since we’re redirecting folders, we only want the users to be able to create folders in the root Users folder, but not individual files. Once the user creates a folder named %username%, the CREATOR OWNER permission will take over (since it is a sub-folder of Users) and will give the account full control over the %username% folder and everything inside of it.

Second, List folder/read data is also missing because we don’t want users to be able to enumerate folders in the share. Here’s what it will look like to the end user if they try to go to \\fileserver\Users:

User can’t enumerate folders

However, if the user tries to go to \\fileserver\Users\%username%, he can see all of his folders:

User CAN see inside username folder

To the Administrator, you’ll still be able to see everything on the server:

Redirected folders on server

Why would you want to do it this way? The biggest reason is that we’re giving the user the ability to create folders in the Users share. That means that there is nothing to stop a user from creating a few hundred folders and then saving files into those folders inside of Users. By removing the ability to enumerate folders in the Users share, you eliminate the ability of the user to see what is in the folder. It doesn’t stop the user from being able to create other folders or copy data into them, but it makes is much more difficult to use should they decide to try.

The other big benefit you get is that users can’t see the other user account folders that are stored in the Users share. Can’t I do that with Access Based Enumeration? Yes… Access Based Enumeration will essentially hide any files/folders to a user that he/she doesn’t have permissions to see; but, it doesn’t solve the problem of the user being able to create new folders in your Users share. If you enable Access Based Enumeration and allow users to enumerate the contents of the share, they’ll just see their %username% folder and all of the other folders they’ve created there.

In the next post I will show you how to configure folder redirection in Group Policy.

• Folder Redirection – Part 5: Best practices (1)
• Folder Redirection – Part 4: Group Policy configuration (0)
• Folder Redirection – Part 2: Setting up your file server (0)
• Folder Redirection – Part 1: Introduction (0)
• Microsoft Desktop Optimization Pack (MDOP): Advanced Group Policy Management (AGPM) (0)

If you’re like me, you’ve probably gotten a frantic call from a customer because they have a computer that won’t boot and they have irreplaceable files on their local hard drive. Try adding clicking or grinding sounds coming from that computer along with no recent backup to the mixture. Sound familiar? That combination can add up to a very upset customer and possibly a very expensive bill if you have to get data restored from that failed hard drive.

The good news is that there is something you can start doing today to start combatting that problem: Folder Redirection in Group Policy. To get started with Folder Redirection, you’ll need to be running Active Directory (any functional level), have an available file server, and a management station running the Group Policy Management Console. As with most Group Policy, the latest version of the GPMC is preferred, but most of these settings are available in older versions.

So what exactly does Folder Redirection do? Folder Redirection takes common user profile folders from C:\Users (or C:\Documents and Settings\ in Windows XP) like the Desktop or Documents and puts them on a UNC path instead of the local hard drive of the computer. I

In addition to the immediate benefit of having that data on a file server that is much easier to keep backed up, the user also gets the benefit of being able to go to multiple computers in your organization and still have access to their data. Using the default Windows settings and the default share settings on your file server, these redirections will be even made available offline automatically for your users. (Don’t worry, this can be controlled separately in Group Policy, which we’ll cover in a later article.)

Documents Redirected in Windows 7

In the GPMC, the Folder Redirection settings can be found in User Configuration > Policies > Windows Settings > Folder Redirection. If you’re using the GPMC in Windows XP, you can redirect Application Data, Desktop, My Documents, and the Start Menu. In addition, folders in Windows XP that are inside the My Documents folder like My Music and My Pictures will follow My Documents when it is redirected.

GPMC in Windows XP Showing Folder Redirection

If you’re using the GPMC in either Windows 7 or Windows Server 2008 R2, you’ll see that the list of folders that can be redirected is much longer. AppData (Roaming), Desktop, Start Menu, Documents, Pictures, Music, Videos, Favorites, Contacts, Downloads, Links, Searches, and Saved Games can all be redirected in Vista, 7, Server 2008, and Server 2008 R2.

GPMC in Windows 7 Showing Folder Redirection

In the next post of this series I will explain how to set up Folder Redirection.

• Folder Redirection – Part 5: Best practices (1)
• Folder Redirection – Part 4: Group Policy configuration (0)
• Folder Redirection – Part 3: Explanation of folder permissions (4)
• Folder Redirection – Part 2: Setting up your file server (0)
• Microsoft Desktop Optimization Pack (MDOP): Advanced Group Policy Management (AGPM) (0)

I recently spent some time troubleshooting slow logons. I had several complaints and had also personally witnessed some very slow logons. After some investigation, I found that nearly all of the user’s had either a very large profile or had directories with extremely high file count. Rather than just delete and hope the problem didn’t happen again, I decided to seek out a solution that would prevent this from happening in the future.

As you may know, just before discovering a solution, there’s usually a key discovery that lowers your blood pressure and allows your confidence level to return to normal. For me, that moment was discovering the power of using the Exclude directories in roaming profile and Limit Profile size Group Policy settings together.

Exclude directories in roaming profile and limit profile size

The Group Policy Object (GPO) setting Exclude directories in roaming profile is one of those settings that is unusually self explanatory. It allows you to create a list of directories, from the root of the user roaming profile location, that should be excluded from roaming profile synchronization.

How do I configure it?

This group policy setting is located in the User Configuration/Policies/Administrative Templates/System/User Profiles section of a GPO. To add multiple folders, separate them in the list using a semi-colon. For example, to exclude the Cookies directory and the Mozilla directory use this for your value:

AppData\Roaming\Microsoft\Windows\Cookies;AppData\Roaming\Mozilla

Exclude directories in roaming profile

What to exclude

Sometimes profiles grow large and you may not be sure which directories are the cause. This is where the Limit Profile size setting comes in very handy. Enabling the setting allows you to specify what the Max profile size should be as well as the message to use to notify the end user. This could be a double-edged sword. It can prompt your user to contact you when their profile is large but should be used with caution depending upon your user group. In my experience, I found this was a great way to target those experiencing slow logons due to profile size.

For the admin, the real power in this setting is the Profile Storage Space dialog box that is enabled in the system tray of the user’s desktop. It allows you to quickly view a list of the files in the profile sorted by size. I found this to be invaluable. That is because the cause of each user’s large profile can be unique.

Profile Storage Space dialog box enabled with Limit profile size

In your environment, I would recommend enabling this setting with a large Maximum profile size of somewhere around 300MB for those user’s that you know are having problems with slow logon. This will allow you to begin to assess the cause of the large profiles. As you add directories to the Exclude directories in roaming profile setting, you will see directories disappear from the Profile Storage Space view.

• Modify Exclude directories in roaming profile GPO setting that applies to the user
• Synchronize domain controllers
• Refresh group policy by running gpupdate /force from the command line
• Log the user off and then back on
• Double click the Profile Storage Space icon in the system tray

Ideally, you want to get profile size below 50MB. Below is the list I’ve compiled that has taken care of this issue for most of my users. This should work for Windows Vista and later desktop users. AppData\Roaming\Microsoft\Windows\PrivacIE;AppData\Roaming\Microsoft\Windows\Cookies; AppData\Roaming\Mozilla;AppData\Roaming\Adobe;AppData\Roaming\Macromedia;$Recycle.Bin; AppData\Local;AppData\LocalLow

In the next article, I’ll discuss how customizing the three-headed monster (Indexing, System Restore, and Windows Error Reporting) can improve user logon and desktop performance for domain users.

• Folder Redirection – Part 3: Explanation of folder permissions (4)
• Folder Redirection – Part 1: Introduction (0)
• Troubleshoot slow logon – Part 2: The 3-headed monster (0)
• How to disable the Shutdown Event Tracker in Windows Server 2008 R2 (1)
• FREE: Smart Defrag – A defragmentation tool (9)

You can view all user profiles on a Windows computer either by navigating to the user profiles folder (C:\users on Windows 7 and Vista, and C:\Documents and Settings on Windows XP) or in the Control Panel (System, System and Security, System, Advanced System Settings). With NirSoft’s UserProfilesView, you will probably be quicker because you just have to double-click the tool.

Moreover, the free portable tool gives you some useful additional information, such as last load time, folder created time, folder modified time, registry modified time, registry file size, user SID, and state (local, domain). This information can be useful for troubleshooting roaming user profiles because it allows you to check when a user first and last logged onto a specific computer.

Since UserProfilesView can also be run from the command prompt, and since you export the data to a text or HTML/XML file, you can use the tool to get an overview of which machines users have logged on to. For this, you have to write a little startup script that collects this information from the computers in your network.

I tested UserProfilesView v1.01 on Windows 7.

UserProfilesView

• Folder Redirection – Part 3: Explanation of folder permissions (4)
• Folder Redirection – Part 1: Introduction (0)
• Troubleshoot slow logon – Part 1: Profile size (0)
• Windows 7 background upload of roaming user profiles (4)
• If Group Policy settings don’t take effect immediately (8)

This is the original text in the Windows 7 reviewer’s guide:

Windows 7 makes Roaming User Profiles more useful and reliable by enabling IT professionals to automatically synchronize users’ profiles with the server while users are still logged on. Prior to Windows 7, this synchronization occurred only when users logged off. With this improvement, users can roam from one PC to another while remaining logged in to both PCs—and still have the same consistent environment.

As I read this, the whole user profile is synchronized with the server while the user is logged on. This was one of the features that had been on my wish list since I worked with roaming user profiles in Windows NT 4. In some organizations people tend to log on and log off at the same time, i.e. in the morning when they start working and in the evening before they leave work. Users who have just come out of a rush hour traffic jam are usually not very patient when they have to wait for ages until their profiles are downloaded because the company network is jammed or because the file servers are too busy.

There are several ways to remedy this problem. For example, you can redirect the document folders to a file server or work with offline files. I always found these workarounds not very convenient and also error-prone. Hence I was curious to try this new Windows 7 feature. Unfortunately, I was a little disappointed when I had a closer look at the background upload of roaming user profiles with Windows 7 RTM. It appears that not the whole profile but only the ntuser.dat file is synchronized with the server while the user is still logged on.

I only found one new Group Policy setting related to the background upload feature (Computer Configuration | Administrative Templates | System | User Profiles). It clearly states that only ntuser.dat is affected by this function. You probably know that ntuser.dat contains the HKEY_CURRENT_USER registry hive; that is, it stores all user settings, those of Windows and most applications.

I have only tried the feature with a Windows Server 2008 R2 domain controller (functional level R2), but the new Group Policy reference guide says that this features is independent of the Active Directory functional level. Thus it should also work in a Windows Server 2003 domain.

There are two scheduling methods. You can set an interval or a specific time of the day when ntuser.dat is synchronized with the server. The shortest interval is one hour, so new user settings won’t be synchronized immediately.

The background upload of roaming user profiles is certainly a useful feature. If a user has logged onto two different machines, then all settings will be transferred between the two machines without needing to log off. However, it would be much better if the whole user profile including the My Documents folder were synchronized. Perhaps Microsoft originally planned this feature and will add it a later time. At least the reviewer’s guide of the Windows 7 beta reads like this. It is also possible that I missed something here.

Update: The last paragraph might not be correct. Please check the comments below. I will update this article as soon as I know more.

• Folder Redirection – Part 3: Explanation of folder permissions (4)
• Folder Redirection – Part 1: Introduction (0)
• Troubleshoot slow logon – Part 1: Profile size (0)
• FREE: UserProfilesView – View user profiles (0)
• If Group Policy settings don’t take effect immediately (8)

The cause for this problem could be that Group Policy Objects (GPOs) are processed asynchronously, by default. This means that processing occurs while Windows is still working on presenting the logon screen.

There are some Group Policy settings that need exclusive access to the computer or user environment. The most prominent ones are Software Installation and Folder Redirection. The latter might become important when you work with roaming profiles and start deploying Vista. Check out this post about Windows XP and Vista interoperability of roaming user profiles for more information.

There is a setting that tells Windows to process Group Policy synchronously. You can find it under Computer Configuration\Administrative Templates\System\Logon. You have to enable the policy “Always wait for the network at computer startup and logon“. This way, Group Policy will be processed synchronously. Note that this will increase the time needed to boot-up and logon.

• Folder Redirection – Part 5: Best practices (1)
• Folder Redirection – Part 4: Group Policy configuration (0)
• Folder Redirection – Part 3: Explanation of folder permissions (4)
• Folder Redirection – Part 2: Setting up your file server (0)
• Folder Redirection – Part 1: Introduction (0)

We always have problems with roaming user profiles whenever we move to a new Windows version. The worst change was from Windows NT 4.0 to Windows 2000. User using NT and Win2000 machines always had problems logging on to a Windows domain. This kept our help desk busy for months. In theory, Windows 2000 and Windows XP have the same profile structure. Unfortunately, this is only in theory. It seems that some applications just don’t know about this theory.

When one of our sysops told me some weeks ago that XP and Vista user profiles are incompatible, I assumed that it is just due to this well known chaos, we always have with Windows upgrades. But, then, I have read that Vista can’t even load roaming user profile created by XP. I was just stuck dumb. How can this work? What about our users who logon on three or four different machines? And our students who logon on every computer on the campus? Must we upgrade all our Windows PCs on one day?

My sys admin, then, handed me this white paper (Word file) which contains our salvation. It is called folder redirection. Folder direction also works with Windows 2000/XP. Basically, you redirect some crucial folders from the user profile to a share on a fileserver. We use this technique for our student machines because they use different computers daily. The advantage is that logon is faster when a student uses a computer for the first time since the data is accessible immediately. The disadvantage is that whenever the file server is unavailable, users can’t access their data. You can work with offline files to solve this problem, but I, often, have trouble with this.

The trick is to use Group Policy to redirect folders for XP and Vista machines. If you logon for the first time to a Windows domain on a Vista machine, a new roaming user profile will be created on the server. It has the extension V2 to distinguish it from the XP user profile. The documents folder, application data, etc. from the XP profile will be available thru redirection. If you logon again on an XP machine, Windows will load the old user profile and access the same redirected folders on the fileserver.

Well, that’s the theory. It is obvious that many things can go wrong here. The folder structure of user profiles in Vista and XP are quite different. Although Vista uses mechanisms to help legacy applications to get on with the new structure (junctions for example), I am sure that this will cause many problems. I highly recommend studying the afore mentioned white paper in detail even if you are not working with roaming user profiles. Many compatibility issues between XP and Vista will probably be caused by this change. The document lists all important modifications.

My last advice is directed to prevent users from working on machines with different Windows versions. Make a list of those users using multiple computers and upgrade them to Vista, first. I hope you belong to those lucky sys admins with this option. Unfortunately, we’re not that fortunate. I will share our experiences with this transition in the next months. Stay tuned!

• Folder Redirection – Part 3: Explanation of folder permissions (4)
• Folder Redirection – Part 1: Introduction (0)
• Troubleshoot slow logon – Part 1: Profile size (0)
• FREE: UserProfilesView – View user profiles (0)
• Windows 7 background upload of roaming user profiles (4)

• Folder Redirection – Part 3: Explanation of folder permissions (4)
• Folder Redirection – Part 1: Introduction (0)
• Troubleshoot slow logon – Part 1: Profile size (0)
• FREE: UserProfilesView – View user profiles (0)
• Windows 7 background upload of roaming user profiles (4)

The question is: What can you do if a roaming profile is not synchronized anymore with the server? That’s where it can get really annoying. If you check the Microsoft knowledge base you will find many possible causes. You will find even more possible causes if you google for that problem.

A typical cause is a filename in the user profile which is longer than 260 characters. Often Web Links in a the favorite folder are the cause for this. Another problem could be that the user encrypted files with EFS. However, there are several other reasons.

Today, I found a new interesting case when my own profile wasn’t saved anymore to the server. Somehow ntuser.dat which contains the user part of the registry had a problem. I was not able to rename it, even after rebooting and logging on with another administrator account. The file was still in use. Then I found out that Sophos antivirus caused the problem. One of its services was running under my own user account. I changed it to another account, et voilá, my user profile synchronized again with the server.

In my experience the easiest way to solve the problem with roaming profiles is to create a new profile and copy all the data from the old profile. Usually this is much faster than trying to find out what went wrong with the profile. Logon with an administrator account and rename the folder of the profile. Don’t try this with the account of the owner’s profile. You will only get an error message because ntuser.dat and ntuser.dat.log are in use. Don’t forget renaming the folder on the file server, too. When you have a new profile, you can copy all files from My Documents to the new local profile. Maybe you also have to copy some desktop icons. Some applications might lose their user specific settings.

If this is a serious problem for you or if you really are curious to find out what went wrong with your profile, you can check Usereven.log in c:\windows\debug\UserMode. Maybe you are lucky and can find some hints there. If you have problems with certain folders in your profile, you can try to exclude them from the synchronization process. All you have to do is adding them to user.ini in the root folder of the user profile.

• Folder Redirection – Part 3: Explanation of folder permissions (4)
• Folder Redirection – Part 1: Introduction (0)
• Troubleshoot slow logon – Part 1: Profile size (0)
• FREE: UserProfilesView – View user profiles (0)
• Windows 7 background upload of roaming user profiles (4)