Windows Server 2003 Profiles

[Basher]

OK, I am currently setting up a curriculam network, just need to a little help on how to do the following:

What we want to do is have 3 different profiles set up (with regards to dekstop items and start menu items) these will be pupils, staff and admins, so all pupils will see the same desktop/start menu, all staff will see a different desktop/start menu etc etc.

Now, only domain admins should be able to edit desktop/start menu items.

Right, we also want it so XP/Server2003 doesn't copy profiles to the local machine, instead just reads off the file server, how do we do this as we are having real problems getting this to work,

Would appreciate any help at all,

[Richie]

I can help with points 2 and 3 off the top off my head -

Now, only domain admins should be able to edit desktop/start menu items.

Once you have made the default profiles you should edit the "dektop" and "start menu" folders within the profile folder so that the "pupils" group (if you have made a "pupils" user group) and any other group you dont want to be able to modufy it only has READ and EXECUTE permissions and not MODIFY or DELETE - for example, in WinXP it would be "C:\Documents and Settings\<profile folder>\Desktop" and "C:\Documents and Settings\<profile folder>\Start Menu"

The directory path will be diff dependant on where your profiles are stored but you get the idea.

Right, we also want it so XP/Server2003 doesn't copy profiles to the local machine, instead just reads off the file server,

Not sure if this is entirely possible. It is possible to stop the local machine from caching local profiles tho so it deletes them when the user logs off if this helps ??

Start --> Run ---> gpedit.msc

Computer Configuration ---> Administrative Templates ---> System ---> User Profiles --->"Delete cached copies of roaming profiles - set this to ENABLED



I'll get back to you on question 1. Just been messing about with this myself on 2003 so not upto speed yet

[Jiff Lemon]

Does each student have a separate login or will each student sign in with "student" account?
you can redirect the several folders (including desktop) using GPO, or simply assign the user a profile using the ADUC snap in.

[Basher]

Cheers for the help guys that's great, each pupil has a separate login (approx 3000 logins in total), I set up an OU for pupils so GPO is applied to teh OU and I have been playing with folder redirection. I'll try the above at work tomorrow and let you know how I get on, cheers again

[Basher]

I'll get back to you on question 1. Just been messing about with this myself on 2003 so not upto speed yet

It's ok, I've worked this out now. I've made 3 OU's and simply massed changed the users profile path for each OU pointing it to a different progile for pupil/staff etc. Then just set teh relevant permissions