User profiles

User profiles automatically create and maintain the desktop settings for each user's work environment on the local computer.

  • To find features that have been moved in the Microsoft® Windows® Server 2003 family, see New ways to do familiar tasks.
  • For tips about using user profiles, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


New ways to do familiar tasks

The following table lists common tasks for configuring user profiles. The user interface for performing these tasks is different in this version of Windows from the way was in Windows NT 4.0.

Note

  • XOX
If you want to | In Windows NT 4.0 use | In this version of Windows use
Add a path to a user profile | User Manager in Administrative Tools | Active Directory Users and Computers, and then click Users.
View the contents of a user profile | The profile is stored in Profiles typically in C:\Windows or C:\Winnt\UserName | Windows Explorer. The profile is stored in the \Documents and Settings\UserName folder.
Copy a user profile | System utility in Control Panel | System Properties, click the Advanced tab, and then, under User Profiles, click Settings.
Add a home directory to a path | User Manager in Administrative Tools | Active Directory Users and Computers, and then click Users.
Add a logon script to a user profile | User Manager in Administrative Tools | Group Policy accessed through Active Directory Users and Computers


Best practices

Allow for different hardware configurations.

  • Because user profiles can be used on various types of client computers, you should keep in mind that these client computers can have different hardware configurations, particularly different video cards and display monitors.
  • Because a user profile determines screen placement and window size, a workstation's display hardware affects how well the user profile works. For example, the window setup in a user profile created for a computer with a Super VGA monitor might not look correct when loaded on a computer with a regular VGA monitor.

Use the same type of video hardware when you create or edit a user profile for a single user.

  • When you create or edit a user profile for a single user, use a computer with the same type of video hardware as the computer that the user typically uses.

Create a single mandatory user profile for a group of users only if they all use computers with the same type of video hardware.

  • When you create a mandatory user profile for several users, create a single user profile for the whole group of users only if they all use computers with the same type of video hardware.

Do not use Offline Folder caching on roaming user profile shared directories.

  • It is important to turn off Offline Folder caching for shared directories where roaming user profiles are stored. If you do not turn off Offline Folder caching for a user's profile, you might experience synchronization problems when both Offline Folders and roaming user profiles try to synchronize the files in a user's profile. This does not affect your ability to use Offline Folders with redirected folders such as My Documents.

Do not use Encrypted File System (EFS) on files in a roaming user profile.

  • The Encrypted File System (EFS) is not compatible with roaming user profiles. If you encrypt profile folders or files in the user profile using EFS, the user's profile will not roam.

Do not set disk quotas too low for users with roaming user profiles.

  • If a user's disk quotas are set too low, roaming user profile synchronization might fail. Make sure enough disk space is allocated to allow the system to create a temporary duplicate copy of a user's profile. The temporary profile is created in the user's context as part of the synchronization process, so it debits the user's quota.

When creating a roaming profile shared directory, limit access to only those users that need access.

  • Because a users roaming profile can contain personal information such as confidential documents and EFS certificates, care should be taken to protect access to the shared directory. Restrict access to the shared directory to only those users that need access. You can also create a security group for users that have profiles on a particular shared directory, and limit access to only those users.
  • Only give users the minimum amount of permissions needed.
  • When creating the shared directory, hide it by putting a $ after the share name. This hides the shared directory from casual browsers, and it will not be visible in My Network Places.

Use at least Windows 2000 servers to host user roaming profile shared directories.

  • Because a users roaming profile contains personal information which is copied to and from a client computer, and the server hosting the roaming profile, it is important to ensure that data is protected as it travels over the network. Potential threats to the privacy and integrity of a user's data come from intercepting the data as it passes over the network, tampering with the data as it passes over the network, and spoofing the server hosting the user's data. Features such as Kerberos, IPSec, and Server Message Block (SMB) signing included in Windows 2000 and the Windows Server 2003 family can help to secure a user's data.

Always use the NTFS file system for volumes holding user's data.

  • Configure servers hosting roaming profiles to use the NTFS File System. Unlike FAT, NTFS supports Discretionary access control lists (DACLs) and system access control lists (SACLs), which control who can perform operations on a file and what events will trigger logging of actions performed on a file.


How to...

  • Create a roaming user profile
  • Copy a user profile
  • Delete a user profile
  • Create a preconfigured user profile
  • Create a mandatory user profile
  • Add a home folder to a profile
  • Switch between a roaming and local user profile


Create a roaming user profile

Microsoft Windows graphic

To create a roaming user profile

  1. Open Active Directory Users and Computers.
  2. In the details section, right-click the applicable user account, and then click Properties.

    Where?

    • Active Directory Users and Computers
    • applicable domain
    • applicable container (such as Users)
    • applicable user account
  3. Click the Profile tab.
  4. In Profile path, type the path information.

Notes

  • XOX
  • XOX
  • Use a full path in each user account:

    • \\Server\ShareName\UserName

  • The user profile path location can be on any server. It does not have to be a domain controller. When the user logs on, Windows checks the user's account to see if a user profile path exits. If it does, the user profile is located by the system and copied to the local computer.
  • To provide better security, user profiles and home folders should be created on an NTFS volume.
  • The user account can be created in any organizational unit or container within the domain. The default location for the user account is the Users folder.
  • The Windows Server 2003 family does not support the use of encrypted files within the roaming user profile.
  • Roaming user profiles that are used with Terminal Services clients are not replicated to the server until the interactive user logs off and the interactive session is closed.

Related Topics


Create a mandatory user profile

Microsoft Windows graphic

To create a mandatory user profile

  1. Open Active Directory Users and Computers.
  2. In the details section, right-click the applicable user account, and then click Properties.

    Where?

    • Active Directory Users and Computers
    • applicable domain
    • applicable container (such as Users)
    • applicable user account
  3. Click the Profile tab.
  4. In Profile path, type the path information ending with the .man file name extension.

Notes

  • XOX
  • XOX
  • A mandatory user profile is a preconfigured user profile. The user can still modify the desktop, but the changes are not saved when the user logs off. The next time the user logs on, the mandatory user profile is downloaded again. User profiles become mandatory when you rename the NTuser.dat file on the server to NTuser.man. This extension makes the user profile read-only.
  • Mandatory user profiles do not allow changes to be applied to the user profile stored on the server.
  • Profile management should be done preferentially by policy. Mandatory profile use, although permitted, is less manageable and more prone to create administration problems, thus it is not recommended.
  • Use a full path in each user account:

    \\Server\ShareName\UserName

    For ShareName, create a Profiles folder if it does not already exist, and share the folder with authenticated users allowing read-only permissions. The shared folder must be created before the user profile can be used.

  • To provide better security, user profiles and home folders should be created on an NTFS volume.
  • When creating a mandatory profile, make sure you set the appropriate access permissions for the user or groups of users who will use this profile.
  • You can also create a mandatory user profile by using Windows Explorer to rename the NTuser.dat file to NTuser.man.
  • The administrator can assign the same mandatory user profile to as many users as needed.

Related Topics


Add a home folder to a profile

Microsoft Windows graphic

To add a home folder to a profile

  1. Open Active Directory Users and Computers.
  2. In the details section, right-click the applicable user account, and then click Properties.

    Where?

    • Active Directory Users and Computers
    • applicable domain
    • applicable container (such as Users)
    • applicable user account
  3. Click the Profile tab.
  4. In Home Folder, type the directory folder path information.

Notes

  • XOX
  • XOX
  • The Windows Server 2003 family includes a folder called My Documents, which offers an alternative to home folders, but does not replace them. All users have a My Documents folder in their user profile.
  • To provide better security, user profiles and home folders should be created on an NTFS volume.
  • Users can change the target folder location of their My Documents folders by clicking Start, right-clicking My Documents, clicking Properties, and then specifying a new location in Target. This capability can be enabled or disabled by the system administrator.
  • You can use Group Policy to change the target folder location of any user's My Documents folder, disable a user's ability to change the target folder location, remove the My Documents icon from the desktop, and choose whether programs use My Documents or a different folder as the default location for opening and saving files.
  • If you do not assign a home folder, the system uses the local user profile folder as the home folder (by default, systemdrive\Documents and Settings\UserName). The home directory can use the same location as the My Documents folder.
  • When you use Terminal Services on computers running Windows Server 2003 operating systems, the user profile is the default home directory.
  • When creating the user's home folder, the folder corresponding to the user's account name is immediately created if it does not exist. This is in contrast to roaming user profiles, where the profile folder for the user is created after the user logs on.

Related Topics


Concepts

This section provides general background information about user profiles.

  • New features and changes to user profiles
  • User profiles overview
  • Understanding user profiles
  • Using user profiles


New features and changes to user profiles

The following new features and changes in the Windows Server 2003 family affect user profiles:

New location for User Profile configuration
User profiles is located on the Advanced tab of the System Properties dialog box.
Error Message changes
All events have unique identifications and details.
Roaming profiles are saved to the server at logoff with user registry keys open
Previously, applications that kept registry keys open at logoff time prevented the system from saving any changes to roaming profiles until those registry keys were closed. With the Windows Server 2003 family, roaming profiles that are changed during a session will save these changes even if registry keys are open.
Delete and Copy To button availability
The Delete and Copy To buttons are unavailable for the profile belonging to the currently logged on user or for any user whose profile is in use.
Group Policy changes
The following changes to Group Policy in the Windows Server 2003 family affect user profiles:
  • User profiles policies now have their own node in the Group Policy.

    • Where?

    • Group Policy object
    • User Configuration or Computer Configuration
    • Administrative Templates
    • System
    • User Profiles
  • Prevent Roaming Profile changes from propagating to the server—This policy determines if the changes a user makes to their roaming profile are merged with the server copy of their profile. If this policy is set at user logon, the user will receive their roaming profile, but any changes a user makes to their profile will not be merged to their roaming profile at logoff.
  • Add the Administrator security group to roaming user profiles—This policy allows an administrator to choose the same behavior as Windows NT version 4.0, and permit the administrators group to have full control of the user's profile directories. In Windows 2000, the default file permissions for newly generated roaming profiles are full control, or read and write access for the user, and no file access for the Administrators group.
  • Only allow local user profiles—This setting determines whether roaming user profiles are available on a particular computer. By default, when roaming profile users log on to a computer, their roaming profile is copied to the local computer. By using this setting, an administrator can prevent users configured to use roaming profiles from receiving their roaming profile on a specific computer.


User profiles overview

On computers running Windows Server 2003 operating systems, user profiles automatically create and maintain the desktop settings for each user's work environment on the local computer. A user profile is created for each individual user when the user logs on to a computer for the first time.

Advantages of using user profiles

User profiles provide several advantages:

  • More than one user can use the same computer. When users log on to their individual workstations, they receive the desktop settings as they existed when they logged off.
  • Customization of the desktop environment made by one user does not affect another user's settings.
  • User profiles can be stored on a server so that they can follow users to any computer running a Microsoft® Windows NT® or later operating system on the network. These are called roaming user profiles.

As an administrative tool, user profiles provide these options:

  • You can create a default user profile that is appropriate for the user's tasks.
  • You can set up a mandatory user profile that does not save changes made by the user to the desktop settings. Users can modify the desktop settings of the computer while they are logged on, but none of these changes are saved when they log off. The mandatory profile settings are downloaded to the local computer each time the user logs on. For more information on mandatory profiles, see To create a mandatory user profile.
  • You can specify the default user settings that will be included in all of the individual user profiles.

User profile types

A user profile defines customized desktop environments, which include individual display settings, network and printer connections, and other specified settings. You or your system administrator can define your desktop environment.

Types of user profiles include:

  • Local user profile—A local user profile is created the first time you log on to a computer and is stored on a computer's local hard disk. Any changes made to your local user profile are specific to the computer on which you made the changes.
  • Roaming user profile—A roaming user profile is created by the system administrator and is stored on a server. This profile is available every time you log on to any computer on the network. Changes made to your roaming user profile are updated on the server.
  • Mandatory user profile—A mandatory user profile is a roaming profile that can be used to specify particular settings for individuals or an entire group of users. Only system administrators can make changes to mandatory user profiles.
  • Temporary user profile—A temporary profile is issued any time that an error condition prevents the users profile from being loaded. Temporary profiles are deleted at the end of each session. Changes made by the user to their desktop settings and files are lost when the user logs off.


Understanding user profiles

This section covers:

  • Contents of a user profile
  • Settings saved in a user profile


Contents of a user profile

Every user profile begins as a copy of Default User, which is a default user profile stored on each computer running a Windows Server 2003 family operating system. The NTuser.dat file within Default User contains Windows Server 2003 family configuration settings. Every user profile also uses the common program groups contained in the All Users folder.

The user profile folders contain various items including the desktop and Start menu. The following table lists and describes the contents of each user profile folder.

User profile folder | Contents
Application Data | Program-specific data (for example, a custom dictionary). Program vendors decide what data to store in this user profile folder.
Cookies | User information and preferences.
Desktop | Desktop items, including files, shortcuts, and folders.
Favorites | Shortcuts to favorite locations on the Internet.
Local Settings | Application data, history, and temporary files. Application data roams with the user by way of roaming user profiles.
My Documents | User documents and subfolders.
My Recent Documents | Shortcuts to the most recently used documents and accessed folders.
NetHood | Shortcuts to My Network Places items.
PrintHood | Shortcuts to printer folder items.
SendTo | Shortcuts to document-handling utilities.
Start Menu | Shortcuts to program items.
Templates | User template items.

NTuser.dat file

The NTuser.dat file is the registry portion of the user profile. When a user logs off of the computer, the system unloads the user-specific section of the registry (that is, HKEY_CURRENT_USER) into NTuser.dat and updates it. For more information about the registry, see Registry structure.

All Users folder

Although they are not copied to user profile folders, the settings in the All Users folder are used to create the individual user profiles. The Windows Server 2003 family supports two program group types:

  • Common program groups are always available on a computer, no matter who is logged on.
  • Personal program groups are private to the user who creates them.

Common program groups are stored in the All Users folder under the Documents and Settings folder. The All Users folder also contains per-computer settings for the Desktop and the Start menu.

Notes

  • The My Documents, My Pictures, Favorites, Start Menu, and Desktop folders are the only folders displayed in Windows Explorer by default. The NetHood, PrintHood, Local Settings, Recent, and Templates folders are hidden and do not appear in Windows Explorer. To view these folders and their contents in Windows Explorer, on the Tools menu, point to Folder options, click the View tab, and then click Show hidden files and folders.
  • On computers running Windows Server 2003 operating systems with the NTFS file system, only members of the Administrators group can create, delete, or modify the common program groups.


Settings saved in a user profile

A user profile contains configuration preferences and options for each user.

The following table is a sample of the settings that are contained in a user profile.

Source | Parameters saved
Windows Explorer | All user-definable settings for Windows Explorer.
My Documents | User-stored documents.
My Pictures | User-stored picture items.
Favorites | Shortcuts to favorite locations on the Internet.
Mapped network drive | Any user-created mapped network drives.
My Network Places | Links to other computers on the network.
Desktop contents | Items stored on the Desktop and shortcuts.
Screen colors and fonts | All user-definable computer screen colors and display text settings.
Application data and registry hive | Application data and user-defined configuration settings.
Printer settings | Network printer connections.
Control Panel | All user-defined settings made in Control Panel.
Accessories | All user-specific program settings affecting the user's Windows environment, including Calculator, Clock, Notepad, and Paint.
Windows Server 2003 family–based programs | Any program written specifically for Windows Server 2003 family can be designed so that it tracks program settings on a per-user basis. If this information exists, it is saved in the user profile.
Online user education bookmarks | Any bookmarks placed in the Windows Server 2003 family Help system.

Note

  • The My Documents, My Pictures, Favorites, Start Menu, and Desktop folders are the only folders displayed in Windows Explorer by default. The NetHood, PrintHood, Recent, and Templates folders are hidden and do not appear in Windows Explorer. To view these folders and their contents in Windows Explorer, from the Tools menu, point to Folder options, click the View tab, and then click Show hidden files and folders.


Using user profiles

This section covers:

  • Using roaming user profiles
  • Local user profiles


Using roaming user profiles

Roaming user profiles enable users to log on to computers in a domain while preserving their user profile settings. User profiles are stored at an administrator specified server location. When a user logs on and has been authenticated within the directory service, the user profile, including user settings and documents, are copied to the local computer. User profile changes made on the local computer are then captured. Changes will then be copied to the user profile stored on the server and be applied the next time the user logs on. Mandatory user profiles are similar, but do not allow changes to be copied to the user profile stored on the server. For more information about implementing roaming user profiles, see To create a roaming user profile and To create a mandatory user profile.

From Active Directory, you can assign a server location for user profiles. If you type a user profile path into a user's domain account, a copy of the user's local user profile is saved both locally and in the user profile path location when the user logs off. The next time that user logs on, the profile stored in the user profile path location is compared to the copy in the local user profile folder, and the most recent copy of the profile is opened. The local user profile becomes a roaming user profile because of the centralized domain location. The user's settings and documents are available wherever the user logs on.

If the server is not available, the local cached copy of the roaming user profile is used. If the user has not logged on to the computer before, a new local user profile is created. In either case, if the centrally stored user profile is not available when the user logs on, it is not updated when the user logs off. If the user profile is not downloaded because of server problems, it is not loaded when the user logs off.


Local user profiles

The location of a user profile depends on whether the user is starting from a clean installation of a Windows Server 2003 family operating system or an upgrade from a previous version of Windows. The following table lists the operating system and the location of user profiles for that scenario.

Operating system | User profile location
Windows Server 2003 family clean installation (no previous operating system) | systemdrive\Documents and Settings (for example, C:\Documents and Settings)
Windows Server 2003 family upgrade from Windows 2000 | systemdrive\Documents and Settings (for example, C:\Documents and Settings)
Windows Server 2003 family upgrade from Windows NT 4.0 | systemroot\Profiles (for example, C:\Windows or C:\WINNT\Profiles)
Windows Server 2003 family upgrade from Windows NT 3.51 | systemdrive\Documents and Settings (for example, C:\Documents and Settings)
Windows Server 2003 family upgrade from Windows 95 or Windows 98 | systemdrive\Documents and Settings (for example, C:\Documents and Settings)

When no preconfigured server-based roaming user profile exists for a user, a user profile folder is created for that user when the user logs on to the computer for the first time. The contents of the Default User folder are then copied to the new user profile folder. The user profile, along with the common program group settings in the All Users folder, creates the user's desktop. When the user logs off, any changes made to the default settings during the session are saved to the new user profile folder. The user profile in the Default User folder remains unchanged.

If the user has a user account on the local computer in addition to a domain user account, or more than one domain user account, the local user profile is different for each account because different user profiles are generated for each user who logs on. When the user logs off, changed settings are saved to only one user profile, depending on which account the user used to log on to the computer.