I have a Windows Server 2003 box which will be acting as a terminal server. It will actually be running Citrix, but I don't believe that to be relevant here.

There has been a request for every user to use a single mandatory profile. I've used mandatory profiles before, but there have been generally different profiles for different users so I've always used the "Terminal Services Profile" tab to good effect.

What I'd like this time is a single setting, such as a Group Policy or similar that simply forces every non-domain admin user logging on to the box into using the mandatory profile. We'll be using Folder Redirection to take care of everything else.

I'm aware of the following GPO:

Computer Policy\Computer Configuration\Administrative Templates\Windows Components/Terminal Services

Set path for TS Roaming Profiles

But, as that's a computer policy, will it not apply to all users including administrators? If so, is it possible to exclude admins somehow?

  • WMI Filter to apply GPO only to not Administrative users? – HopelessN00b Sep 6 '12 at 15:18
  • @HopelessN00b But (presumably) it's a HKLM policy so it would still effect all users once the policy is active. – Dan Sep 6 '12 at 15:25
  • Though I have thought about it a bit more and I always do pretty blank Mandatory Profiles (As opposed to using them as a cheats way to tweak things) so in actuality it shouldn't really make any difference to the admins. I'd still rather avoid the situation, though. – Dan Sep 6 '12 at 15:26
  • 1
    Yeah, I'm not sure, so I made it a comment with a question mark, instead of an answer with a period. P.S.: a/s/l/wanna cyber? :p – HopelessN00b Sep 6 '12 at 15:27

This is probably going to be disappointing, but there is no way to exclude admins (or anyone for that sake) when you use a computer policy.

We're in the same bucket here, where administrators get a roaming profile. We've tried tons of different approaches, but it's just not possible to get away from unless you use the terminal services profile field in AD.

  • I'm hoping that this is somehow fixed in Windows Server 2012, but I've yet to make the effort to actually research it. – pauska Sep 7 '12 at 14:28
  • This appears to be the general concenus from Googling, too. I'll leave this up for a few more days and accept the answer if I don't come up with something – Dan Sep 7 '12 at 14:42

Since this is a Computer Policy it applies to everyone regardless of access. You did mention Citrix; if you have enterprise or platinum edition, you may be able to achieve something close to what you want by using Profile Manager.

You would set up the Citrix Profile Management .admx template and create a GPO specifying a "template profile" instead of a mandatory profile. In the policy you can then either specify "processed groups" or disable the "Process logons of local administrators".

The template profiles don't allow the use of mandatory profiles exactly, so you can't use an ntuser.man, it would have to be a ntuser.dat.

Feel free to downvote this, my initial answer was totally wrong and this answer isn't great either. I had somehow overlooked the fact that it is indeed a computer policy.

  • I don't follow you - this is a computer policy, not a per user policy. – Dan Sep 7 '12 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.