4

I was a bit unsure how to phrase the title to this question so apologies for any confusion.

This is a lab environment (higher ed) with ~300 machines. We are upgrading our image to Windows 10 this summer but we need to address login and user-profile creation. What we want to do is authenticate users (using AD), but not use roaming profiles or have to wait for profile creation every time they log in. Keeping individual profiles on the machine is not an option. With our GPOs and other issues, logging into a domain account that needs created can take 2-5 minutes. We need students to be able to hit a desktop in under 30 seconds.

In the past we have used pGina to alter the login account once a user is authenticated. We maintain 2 local machine profiles (one for students, one for the public) and after authentication occurs we shunt the user into the proper local profile. This has worked pretty well for the past couple years. We get authentication, we get logging/auditing from the DC, no buildup of profiles, and fast login. However, pGina development has slowed or halted and currently does not work in Windows 10 with not word on when or if it will.

We are open to all suggestions - even commercial software if such exists. I cannot seem to find anyone else who has met this challenge, although it is inherently difficult to search for as all the related keywords bring up vastly different scenarios and problems.

Now I know what we really need is VDI or some virtualization tech most likely, but that requires more cooperation from the overall IT organization than we are likely to get in time to roll out a new image over the summer. So although I am open to all suggestions, even commercial ones, we are pretty limited to the environment and ecosystem we already have.

4
  • 4
    With our GPOs and other issues, logging into a domain account that needs created can take 2-5 minutes - ... change your GPOs and fix the other issues? Jan 12, 2016 at 20:01
  • Spot on, fix the issue don't work around it. +1
    – Nick Young
    Jan 12, 2016 at 20:07
  • 1
    Easy enough to say but hard to actually do in a large institution where sometimes other parties are not willing to admit there is actually a problem. Also, I have seen many others in higher-ed discussing long log-on times for roaming profiles. Even without any GPOs you are still looking at 60 seconds to setup the profile and this is just too long. Jan 12, 2016 at 20:25
  • If I has a 60 second logon time my CFO/CEO would be upset. we run roaming profiles with folder redirection and logon times are between 5-20 seconds in most cases (Even over WAN links). I get that it may be hard to get done, have you put actual requests in? Can you give specific GPO sections that take a while to complete? Drive Mapping? Folder Redirection?
    – Nick Young
    Jan 13, 2016 at 12:22

1 Answer 1

2

I would use Mandatory profiles which don't require a profile to be setup during every logon. They also have the added benefit of not saving anything between sessions.

7
  • I would use Mandatory profiles which don't require a profile to be setup - A mandatory profile needs to be set up in order to use a mandatory profile.
    – joeqwerty
    Jan 12, 2016 at 20:39
  • I was speaking on an ongoing basis, it would be once on each system. I will edit my Answer to be more clear on this point.
    – Nick Young
    Jan 12, 2016 at 20:40
  • Great. I just wanted to add some clarification so that there was no confusion.
    – joeqwerty
    Jan 12, 2016 at 20:42
  • Do you find the new wording more appropriate for this answer or is more clarification needed?
    – Nick Young
    Jan 12, 2016 at 20:43
  • Yeah, it's fine but I can't tell if you're serious or just giving me a hard time. ;)
    – joeqwerty
    Jan 12, 2016 at 20:48

Not the answer you're looking for? Browse other questions tagged .