DOCUMENT:Q168476  09-AUG-2001  [winnt]
TITLE   :How to Create Mandatory Profiles with Windows NT 4.0
PRODUCT :Microsoft Windows NT
PROD/VER::4.0
OPER/SYS:
KEYWORDS:kbnetwork

======================================================================
-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0 
 - Microsoft Windows NT Server version 4.0 
-------------------------------------------------------------------------------

SUMMARY
=======

This article describes how to create mandatory profiles for Windows NT version
4.0.

MORE INFORMATION
================

To create a mandatory profile for Windows NT 4.0, perform the following steps:

1. Create a user called "Template" who will have the same privileges and rights
   as the users in the group for which you are creating the mandatory profile.
   (This step is very important so that you do not have conflicting permissions
   while setting up shares, programs, and so on.)

2. Log on to the computer running Windows NT Workstation as the new Template
   user and set up the profile (set up the desktop, install applications, and so
   on) to your specifications and log off the computer. The profile will not be
   created until you log off.

3. Log back on to the computer running Windows NT Workstation as a user with
   administrator privileges on the local workstation as well as on the domain
   and start the System tool in Control Panel. Select the User Profiles tab.

4. Highlight the profile for your Template user and select Copy To. In the Copy
   To dialog box, you will need to specify where you want to copy the profile
   and who is permitted to use it.

   a. Under the Permitted To Use section of this dialog box, click Change and
      select the user or group who will be permitted to use this profile.

   b. Next, you will need to specify where you want to COPY PROFILE TO. For a
      server based mandatory profile, you will need to specify the following
      information:

   \\ServerName\Sharename\Name of Profile

For example, \\PENDRAGON1\Profiles\mandatory.

If you are using mandatory profiles, go to step 5; otherwise, go to step 6.

5. Windows NT 4.0 has implemented two levels of security in mandatory profiles.

   The first level is to rename the Ntuser.dat file to .man. This will allow the
   users of a mandatory profile to log on to the domain using cached
   information, if the profile is unavailable on the central server.

   a. The steps to implement the first level of mandatory security: Change the
      user's profile path in user manager to reflect the mandatory profile.

   \\servername\sharename\profilename

Rename the Ntuser.dat to Ntuser.man under the profile directory

The second level is to add a .MAN extension on the directory name. When using the
.man extension, if the profile is unavailable, the workstation will not log the
user on and it will return to the CTRL+ALT+DELETE logon screen.

   b. The steps in getting the second level of security are:

      1. Add .man extension to profile path in user manager:

   \\servername\sharename\profilename.man

      2. Add .man extension to server based profile DIRECTORY and the Ntuser.dat
         file needs to be renamed to Ntuser.man

6. Click OK to copy the profile to where you have specified. Open Windows NT
   explorer and connect to the path where you have copied the profile. Open the
   directory and rename the Ntuser.dat to Ntuser.man. This will prevent users
   from being able to modify the profile. If this is not renamed, it will not
   function as a mandatory profile.

7. In User Manager for Domains, select the users you want to use the mandatory
   profile and in the properties for each user, select Profile and specify the
   path to where the mandatory profile exists in the User Profile Path box. This
   must be a UNC path so it must be in the form of \\Server\Share\Profile (all
   users who are going to be using this profile must have at least read access
   to the root share and the profile folder).

8. Test by logging on to the workstation as another user who has just been
   granted the mandatory profile.

Additional query words: roaming

======================================================================
Keywords          : kbnetwork 
Technology        : kbWinNTsearch kbWinNTWsearch kbWinNTW400 kbWinNTW400search kbWinNT400search kbWinNTSsearch kbWinNTS400search kbWinNTS400
Version           : :4.0
Issue type        : kbinfo

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

Copyright Microsoft Corporation 2001.