@Arrowhead-IT
Here’s the startup script.
the directory that you see the output being redirected to is a read/write folder for everyone where I can review results of the default profile deployment and update. It’s a share folder located at \\mb1\logs$\Startup_Script\<filename>
The script looks for a file locally (in this version) called %SystemDrive%\DefaultProfile\Default\Aug_24_2015.txt which on most systems is just C:\DefaultProfile\Default\Aug_24_2015.txt
If that file exists, then nothing is done.
If it doesn’t exist, it goes through the steps of obliterating the last deployed default profile and copying down the new one and setting permissions.
In group policy, this is set as a startup script and it’s a computer-based policy.
echo %date%_%time% >> "\\mb1\logs$\Startup_script\%computername%.txt"
REM
REM Above line just records the date for the log entries placed below it.
REM
REM
REM
IF EXIST "%SystemDrive%\DefaultProfile\Default\Aug_24_2015.txt" (
REM
REM Above command checks to see if a specific file exists.
REM The file is %SystemDrive%\DefaultProfile\Default\Aug_24_2015.txt
REM
REM If the file exists, Do nothing.
REM
) ELSE (
REM
REM
REM IF the file does not exist, do this stuff.
REM
net use /delete z: >> \\mb1\logs$\Startup_script\%computername%.txt
net use /delete y: >> \\mb1\logs$\Startup_script\%computername%.txt
net use /delete h: >> \\mb1\logs$\Startup_script\%computername%.txt
REM
REM Above commands are used to delete any existing map drives.
REM The output gets appended to a log so we can see what's happening.
REM
REM
REM
set username=mb\serviceaccount
set password=MyAwesomePasswordWentHere
REM
REM the above lines set the username and password for accessing the share, using a account with read-only perms.
REM
net use z: \\10.2.1.5\Software$ %password% /user:%username% >> \\mb1\logs$\Startup_script\%computername%.txt
REM
REM Above command mounts a maped folder to z:, using MB's service account and password.
REM
REM
REM
rmdir %SystemDrive%\DefaultProfile /s /q >> \\mb1\logs$\Startup_script\%computername%.txt
REM
REM Above command recursively removes a directory.
REM
mkdir %SystemDrive%\DefaultProfile >> \\mb1\logs$\Startup_script\%computername%.txt
mkdir %SystemDrive%\DefaultProfile\Default >> \\mb1\logs$\Startup_script\%computername%.txt
REM
REM Above commands makes some folders.
REM
REM Below command may contain a 2 for testing only.
REM
xcopy "z:\DefaultProfile\*.*" "C:\DefaultProfile\Default" /y /d /e /c /i /f /h /k /v /s >> \\mb1\logs$\Startup_script\%computername%.txt
REM
REM Above command recursively copies everything from "defaultprofile" on the server to the local folders.
REM
icacls "%SystemDrive%\DefaultProfile\Default" /T /C /grant "everyone:(OI)(CI)F" >> \\mb1\logs$\Startup_script\%computername%.txt
REM
REM Above command sets permissions on the newly created folders and files to EVERYONE, so that it can be used as a default profile.
REM
net use /delete z: >> \\mb1\logs$\Startup_script\%computername%.txt
REM
REM Delete the mapdrive used.
REM
)
In the same group policy, I have a registry edit set:
This is the cutoff key path: SOFTWARE\MICROSOFT\WINDOWS NT\CurrentVersion\ProfileList
here is the settings tab of the policy with everything expanded.
I use a tool called “Evil Finger Enabler” to enable the greyed out “copy profile” button after I have my default profile setup the way I want using a local and normal account.
It enables this button in Windows 7:
If anything isn’t clear, just point it out and ask about it.
