With Windows 10 now into its latest edition, the 1607 “Anniversary” update, it now appears, for better or worse, to be here to stay. It has generated a lot of interest; supposedly the “last version of Windows”, many expected it to be akin to Windows 7 – an improvement following a much-maligned previous Windows version. However, the reality has turned out to be somewhat different from what many were expecting.
Microsoft are now “cloud first, mobile first”, and a lot of this new strategy shows through – sometimes somewhat cynically – in Windows 10. For my sins, I’ve been involved in a Windows 10 deployment since August of 2015, so now, just over a year in, it is maybe time to share the things I’ve learned in the hope that it may give some of you a bit of help when it comes to deploying (or not deploying!) this new version of Microsoft’s flagship operating system.
This set of articles is going to expand at the rate of one a day over the next week or so, and cover a wide range of issues for those of you deploying Windows 10 – whether it be fully virtualized via Citrix XenDesktop or the like, or simply a general physical deployment. Hopefully, it will be everything you need to know!
Don’t forget to read the first parts of this series too – EDITIONS, SERVICING BRANCHES, MODERN APPS, TELEMETRY, THE START MENU and ROAMING.
PROFILES
Kind of following on from the ROAMING section, we’re going to have a quick discussion about profiles in Windows 10. It is interesting to note how profile sizes have changed in the most recent versions of Windows – here’s some data showing the average size of a user profile at first logon
Windows 7 – 20MB
Windows 8.1 – 61MB
Windows 10 – 122MB
A sixfold increase in profile size from Windows 7 to Windows 10 – quite impressive!
Now historically, most of us have mitigated against the issues caused by default profile sizes by using various methods to both reduce this size and increase the performance of the system. Using different profile types has often been a key part of this. Some discussion about the different profile types is below.
Mandatory and super-mandatory
There’s not much difference between these two – a mandatory profile is defined on the user object or by GPO, and loads a specific locked-down profile (pre-created by an administrator) which is discarded from the endpoint at logoff. Super-mandatory is exactly the same, except the user can’t log on if the mandatory profile is unavailable.
These options have long been used in XenApp and XenDesktop environments, and also in high-volume non-persistent enterprises. Unfortunately, on Windows 10 (currently) both mandatory and super-mandatory profiles don’t work. Because of the Start Tiles database, a mandatory profile ends up with user information hard-coded and therefore the OS detects the database as corrupted, and the Start Menu doesn’t function. We’re told by Microsoft they have this logged as a bug and are going to fix it eventually, but no timescale is available as of yet and it seems to be a low priority for them.
Roaming
Roaming profiles allow the user’s profile to be saved out to the network at logoff and restored at next logon, effectively moving the saved profile from device to device. As we already covered in the ROAMING article, though, on Windows 10 these profiles a) don’t currently work, and b) can’t save the Start Tiles database anyway, because it is stored in %LOCALAPPDATA%.
Local
Local profiles are exactly that – a copy stored local to the device. They don’t roam from machine to machine and are simply stored wherever the user logged in. Microsoft recommend that everyone on Windows 10 use local profiles, but that doesn’t lend itself to roaming or non-persistent environments, it doesn’t protect the user’s data and configuration in the event of primary device failure, and it assumes that each user has a dedicated device. Also, if you’re in an environment where multiple users utilize different machines (such as public access areas), you may find hard disk space filling up with hundreds or even thousands of copies of local user profiles.
Currently on Windows 10 there isn’t a real way to utilize anything but local profiles without hitting some issues. So if you’re have a roaming requirement or non-persistent solution, you need to leverage some form of UEM tool to achieve this with local profiles. If you’re in a dedicated “one device per person” environment, then this is all well and good – but you’re still going to hit problems when it comes to failed devices or migrating settings before feature upgrades land.
Removing cached copies of local profiles
If you want to remove cached copies of local profiles in multi-user environments to stop disk space filling up, you have a few options:-
1. Add all your users to the Guests group – this works and the profiles are discarded at logoff, but strangely, being a Guest on Windows 10 means that certain Start Menu functions are missing, so I wouldn’t recommend using this method.
2. Spoof a mandatory profile – you can do this by setting up a logon script to run the following PowerShell (lines will wrap)
$USERSID = ([Security.Principal.WindowsIdentity]::GetCurrent()).User.Value
$regpath = “HKLM:\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\$USERSID”
$name = “State”
Set-ItemProperty -Path $regpath -Name $name -Value “5”
This will mark the profile as mandatory just after login, avoiding the issues with mandatory profiles because it actually loads a local profile, but forcing the OS to discard the profile at logoff. This actually works quite well, especially as you can use a security filter to apply this to only specific groups of users.
3. Configure the GPO to delete profile copies over a certain number of days – this is found at Computer Config | Admin Templates | System | User Profiles | Delete user profiles older than a specified number of days at system restart. The minimum value is 1, so on restart any profiles over a day old will be removed. This works fairly well as long as you restart regularly – it can be a little problematic if the user has got multiple profile copies on the device, or if there are specific accounts (such as service accounts) that you don’t want to be removed.
4. Use a tool like delprof2.exe to delete unused user profiles – you can run this at many different times, but my favourite is simply using a Scheduled Task that runs once a day and clears out any other user profiles. You can set filters to allow specific accounts (such as admin or service accounts) to be ignored, and many other parameters which are detailed in the link above. I find this method to be excellent if you need to filter down the scope of your deletion rather than removing all user profiles.
Out of these methods, I’d recommend either 2, 3 or 4, dependent on the environment. 2 or 4 are most suitable if you need control of which users you apply this to – 3 is a bit of a sledgehammer approach.
Custom default user profile
One of the best performance enhancements I’ve done in Windows 10 is to create a custom default user profile by using Audit Mode. However, because it is Windows 10, you actually need to sanitize your custom default user profile after creation, because otherwise you may encounter issues with the Start Menu due to that pesky database! If done properly, it will allow you to significantly reduce the logon time of first users, especially when combined with the removal of all unneeded Modern Apps.
Here is the process for creating it that I follow – feel free to adapt this as necessary to your environment.
Launch Windows 10 build until it reaches the following point
Press Ctrl-Shift-F3 to trigger Audit Mode
Create an XML file with the following text:-
<settings pass=”specialize”>
<component name=”Microsoft-Windows-Shell-Setup” processorArchitecture=”amd64″ publicKeyToken=”31bf3856ad364e35″ language=”neutral” versionScope=”nonSxS” xmlns:wcm=”http://schemas.microsoft.com/WMIConfig/2002/State” xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”>
<CopyProfile>true</CopyProfile>
</component>
</settings>
<cpi:offlineImage cpi:source=”wim:D:/sources/install.wim#Windows 10 Enterprise” xmlns:cpi=”urn:schemas-microsoft-com:cpi” />
</unattend>
Changing the settings in bold to those as required in your environment (the path to the install files, and the Windows 10 Edition)
Delete C:\Users\Default\AppData\LocalLow
Delete C:\Users\Default\OneDrive
Remove everything from C:\Users\Default\AppData\Local EXCEPT the following folders:-
\Microsoft\Windows\Shell (you need this folder for Start Tiles)
\Microsoft\Windows\WinX (you need this folder for the right-click Start Menu)
Remove everything from C:\Users\Default\AppData\Roaming EXCEPT the following folder:-
\Microsoft\Windows\Start Menu\Programs (you need this for the All Apps Start Menu)
Open the Registry hive from C:\Users\Default\ntuser.dat in regedit.exe
Check the Registry permissions allow all users Read permissions at least
Search for and remove all references to the base username (normally Administrator)
Remove the following Registry keys from the loaded hive (if they exist):-
\EUDC
\GameConfigStore
\Appxbackup
SOFTWARE\RegisteredApplications
SOFTWARE\Policies
SOFTWARE\AppDataLow
SOFTWARE\Microsoft\Fax
SOFTWARE\Microsoft\GameBar*
SOFTWARE\Microsoft\OneDrive
SOFTWARE\Microsoft\SkyDrive
SOFTWARE\Microsoft\F12
SOFTWARE\Microsoft\UserData
SOFTWARE\Microsoft\UE-V
SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationToasts
Unload the loaded hive (DO NOT FORGET TO DO THIS STEP!)
Remove temporary Registry files (.regtrans-ms and .blf extensions in the user root folder)
Use local profiles, combined with a roaming technology if necessary to accommodate roaming requirements, recovery from device failure or OS upgrades
If you need to remove cached profile copies, use delprof2.exe or a spoofed profile so you can filter this to your needs
Always try to create and sanitize a custom default user profile, it takes time but will afford better performance at first logon
The post Everything you wanted to know about virtualizing, optimizing and managing Windows 10…but were afraid to ask – part #7: PROFILES appeared first on HTG | Howell Technology Group.