Cortana/Windows Search breaks in default profile

[Twilems]

The scripts are working fine. But my problem is that i want to use the default profile to use as mandatory profile. When i do that i get an error “the service Group Policy Client prevents logon”. What can i do about it?

Is there anyone uses Mandatory Profiles for Windows 10?
It’s for our environment. It’s a school with students. So we don’t want they can make any changes in the profile. That’s the reason we choose for a mandatory profile.

[Quazz]

@Twilems http://www.linuxgfx.co.uk/karoshi/documentation/wiki/index.php?title=Creating_a_Windows_10_Mandatory_Profile might help.

Basically you need to alter the registry key permissions and ownerships of the default ntsuer.man

[Wayne Workman]

@Twilems I work in a school as well. I’m not concerned about the students customizing what they are allowed to customize. A great deal of things are locked down via group policy, to include wallpaper, screensavers, themes, resolution, control pannel, access to the command prompt, numerous file extension screenings and rules, no access to the c:\ drive. However, if they want to re-arrange the tiles in the start menu I don’t care about that, also re-arranging or customizing the task bar icons, that’s fine with me. Maybe they have a good reason for it, maybe it makes their life easier.

[JJ Fullmer]

@Wayne-Workman said in Cortana/Windows Search breaks in default profile:

@Arrowhead-IT can you make a git repo with your two scripts in it, with a read me and a GNU GPLv3 license?

I made the repo where they will go.

I was trying to decide whether I wanted to make one repo or a bunch for a few other fog-snapin/image prep type scripts.
For now it’s just the one repo. I’d prefer it to be in the fog-project group of repos, but it doesn’t have to be. I’ll link to the fog-project repos for sure though.

https://github.com/darksidemilk/Create-and-Deploy-Windows-Default-Profiles

[Quazz]

@Arrowhead-IT Just a fyi, you can modify it slightly to allow for spaces in share names/paths by putting quotation marks whenever the share variables are called. I tested this earlier and it works great.

Your script is pretty awesome

[Wayne Workman]

Yeah, this script was a life saver for me. It accomplishes SO much stuff that I’d otherwise have to set a TON of bloated Microsoft group policy for. I’m not scared of group policy at all, in fact I’m really good at it. But I’ve learned through experience that overall, less group policy is better group policy. So now I always always always try to find alternatives to it before using it. This script being a great example, fog snapins and printer management being another great example. Hell even startup scripts or login scripts are more safe than a pile of bloated group policy. Group Policy usually works, but it slows things down. I’ve ran extensive tests on this, recording times for different things, recording environment setups, making tables of results, and replicating results from scratch to confirm, for months on end (Scientific Method). Group Policy is always my last choice now.

[Quazz]

Apparentally, to prevent Windows search from breaking after copying the profile over, all you have to do is delete

AppData\Local\Microsoft\Windows\UsrClass.dat

Windows will create one on login.

[Wayne Workman]

@Quazz That definitely needs integrated into the script.

[Quazz]

@Wayne-Workman Due to the difficulty in removing this file under Windows (close to impossible), this should be deleted after the profile is copied to the NAS, so that when you deploy it it gets deployed without the incorrect metro registry settings.

[Quazz]

@Quazz Scratch that, it still seems to cause issues, but I’m looking into some ntuser.dat stuff to fix it.

[Quazz]

@Quazz Well that didn’t solve anything, so I’m going to try out a little program called Defprof which should supposedly be compatible with W10 and do everything I hope it does.

[JJ Fullmer]

@Wayne-Workman said in Cortana/Windows Search breaks in default profile:

@Quazz That definitely needs integrated into the script.

I believe it already is integrated in the script. The only .dat files it should copy are the ntuser.dat files. But I could be wrong on that one.
I’m still planning on some serious work on this to make it only edit the ntuser.dat hive for each setting stored there instead of copying the whole thing. But I have a lot of other projects that have to take priority at the moment. I will make a note to add in an explicit exclude in the copy for the UsrClass.dat just to be safe.

[JJ Fullmer]

@Arrowhead-IT Of course since it is in github now, anyone is welcome to help with commits and contributions

[Quazz]

@Arrowhead-IT Editing the ntuser.dat is far more difficult than copying it over, though.

I’m not sure if it’s feasible to do so for this. For example, the taskbar icons are stored in a very unfamiliar format. (perhaps possible to query the data from the current user and plant that in ntuser.dat though). Other issues are Microsoft using version numbers for apps in their registry (who on earth thought that would be a good idea?).

Also, another oddity on Windows 10 is that directly editing the ntuser.dat seems to not actually apply the changes to new profiles! But copying over an existing ntuser.dat does! This is very different from Windows 7 and endlessly more frustrating. Not to mention it makes no sense.

I will report tomorrow on how things went with defprof (they seem to use a specific program they wrote for the Windows Store Apps, so I’m guessing that will be key) and see if that can help to figure out this mess.

[Quazz]

Defprof was able to do everything I hoped, everything is working exactly as it should.

One of the key parts I noticed is they have their own program which you have to install to handle the Windows Apps.

Also default wallpapers need to be placed in the Users/Public

There’s a ntuser.dat hiding there as well which might have an impact on default profiles.

For now though, I have a way to handle Windows 10 perfectly.

Additionally, from what I gather from Defprof is that it’s a bad idea to remove the Default folder becuase of the junction points contained in it.

[x23piracy]

@Quazz i you should also notice delprof2: https://helgeklein.com/free-tools/delprof2-user-profile-deletion-tool/
It’s more advanced then the old ms one.

Regards X23

[Quazz]

@x23piracy Delprof is a nice tool for stubborn profiles, but not really necesarry or useful for creating a default profile unless I’m mistaken?

I think Delprof and Defprof are being confused here, perhaps.

[Wayne Workman]

Well… on Win10 Enterprise, this script decreased login times down to 4 seconds.

We’re playing with Win10 LTSB now, and the script is increasing login times. Same script, just a different OS. And it appears the tiles I pinned to the task bar and start menu are no longer staying pinned.

What a bummer. I’m going to have to dig into this another time.

[JJ Fullmer]

@Wayne-Workman That’s odd. I know that I had to create a different profile for LTSB but it certainly worked in LTSB. The profile I made in Win 10 Enterprise CB won’t work in LTSB and vice versa. Gotta create a new one. It’s lame I know.
My login times are much longer than 4 seconds though. But I have a lot of customziations. Little common fixes and startup scripts and backgrounds and stuff, so my first login for any user is like 2 or 3 minutes, but only a few seconds after that first time.