3

I have a Windows Server 2003 box which will be acting as a terminal server. It will actually be running Citrix, but I don't believe that to be relevant here.

There has been a request for every user to use a single mandatory profile. I've used mandatory profiles before, but there have been generally different profiles for different users so I've always used the "Terminal Services Profile" tab to good effect.

What I'd like this time is a single setting, such as a Group Policy or similar that simply forces every non-domain admin user logging on to the box into using the mandatory profile. We'll be using Folder Redirection to take care of everything else.

I'm aware of the following GPO:

Computer Policy\Computer Configuration\Administrative Templates\Windows Components/Terminal Services

Set path for TS Roaming Profiles

But, as that's a computer policy, will it not apply to all users including administrators? If so, is it possible to exclude admins somehow?

4
  • WMI Filter to apply GPO only to not Administrative users? Sep 6, 2012 at 15:18
  • @HopelessN00b But (presumably) it's a HKLM policy so it would still effect all users once the policy is active.
    – Dan
    Sep 6, 2012 at 15:25
  • Though I have thought about it a bit more and I always do pretty blank Mandatory Profiles (As opposed to using them as a cheats way to tweak things) so in actuality it shouldn't really make any difference to the admins. I'd still rather avoid the situation, though.
    – Dan
    Sep 6, 2012 at 15:26
  • 1
    Yeah, I'm not sure, so I made it a comment with a question mark, instead of an answer with a period. P.S.: a/s/l/wanna cyber? :p Sep 6, 2012 at 15:27

2 Answers 2

1

This is probably going to be disappointing, but there is no way to exclude admins (or anyone for that sake) when you use a computer policy.

We're in the same bucket here, where administrators get a roaming profile. We've tried tons of different approaches, but it's just not possible to get away from unless you use the terminal services profile field in AD.

2
  • I'm hoping that this is somehow fixed in Windows Server 2012, but I've yet to make the effort to actually research it.
    – pauska
    Sep 7, 2012 at 14:28
  • This appears to be the general concenus from Googling, too. I'll leave this up for a few more days and accept the answer if I don't come up with something
    – Dan
    Sep 7, 2012 at 14:42
0

Since this is a Computer Policy it applies to everyone regardless of access. You did mention Citrix; if you have enterprise or platinum edition, you may be able to achieve something close to what you want by using Profile Manager.

You would set up the Citrix Profile Management .admx template and create a GPO specifying a "template profile" instead of a mandatory profile. In the policy you can then either specify "processed groups" or disable the "Process logons of local administrators".

The template profiles don't allow the use of mandatory profiles exactly, so you can't use an ntuser.man, it would have to be a ntuser.dat.

Feel free to downvote this, my initial answer was totally wrong and this answer isn't great either. I had somehow overlooked the fact that it is indeed a computer policy.

1
  • I don't follow you - this is a computer policy, not a per user policy.
    – Dan
    Sep 7, 2012 at 8:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .