Roaming Profile Permissions

[chrisukcov]

Hi guys,

We have a Windows 2k Server and a call centre using NT4 workstation. We have setup a roaming profile for the call centre with only the apps they need etc etc and we use Winlock to hide other desktop icons and restrict program access.

All seems ok sometimes but i need to lock the directories down to only the permissions they need. Can i make the whole profile read-only? or do certain directories in the profile need more rights?!?!

IF so which ones:
- Application Data
- Cookies
- Desktop
- Favourites
- History
- Local Settings
- Het Hood
- Reserved
- Print Hood
- Recent
- Sent To
- Start Menu
- Templates
- Temp Internet Files

Any Info would be great

Many Thanks

Chris

 

[brontosaurus]

You can't make a profile read-only, however, you can use mandatory profiles, so any changes a user makes will be undone after they log out.

 

[chrisukcov]

Yeah that would be good - how do we do that?!?

Chris

 

[brontosaurus]

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q323368

 

[chrisukcov]

Thanks for that - I did find a article on how to do it in the meantime too.

It doesnt seem to like it on the NT4 workstation. Is it only work on a Windows 2000 DC and Workstation not Win2k DC and Nt4 workstation?

Chris

p.s thanks for your help !

 

[brontosaurus]

It should work for NT, what's happening when you try it?

 

[chrisukcov]

The operating system is unable to log you on because your mandatory roaming profile is not available. Please contact your system administrator.(3)

Ive done what the a document says and renamed the shared folder and share name to ccprofiles.man {Call Centre Profiles} and renamed the ntuser.dat to .man
is that correct?

Chris

 

[brontosaurus]

That's fine. The share names not so important, the .dat rename is. How are the user file permissions set on the share directory?

 

[chrisukcov]

Full Access at the mo just to test, on the sharing and NT permissions.

Chris

 

[brontosaurus]

You tried it for W2K and it works, yes? Any event log errors?

 

[chrisukcov]

SORTED!

Didnt like the share name. Took off the .man ext off the end and just left the .man on the NTUSER and it loads and syncs no changes on exit - just what we wanted.

Many Thanks for all your help... fancy a job here

Chris

 

[brontosaurus]

Sure, why not! I love the UK.