Setting up roaming profiles is a multipart process. First you must configure a network share to use for storing the roaming profiles. Then you must configure user accounts to use a roaming profile rather than a standard local profile.
The network share you use for roaming profiles can be on any server in the organization. However, a bit of planning should go into the rollout. Because profiles can be quite large, you typically don’t want users to have to retrieve or update profiles over remote networks. Many other factors go into this consideration, of course, such as whether you will also be redirecting user data folders, but you will typically want the profile server to be in the same geographic location as the users.
Caution
Unlike redirected folders, the network share you use for profiles should not be configured for offline file use or encryption. With this in mind, you should disable offline file caching (as discussed in Microsoft Knowledge Base article 842007) and also turn off the Encrypting File System.
To create the shared folder for the roaming profiles, follow these steps:
Log on to the profile server using an account that has administrator privileges.
In Windows Explorer, locate the folder you want to share. Right-click it, and then choose Sharing And Security.
Select Share This Folder, and then click Permissions.
By default, the special group Everyone has Read access to the share. Modify the permissions so the Authenticated Users group has Full Control. This ensures that client computers can access the share and users have appropriate permissions with regard to their profiles.
Click OK twice.
Once you create and configure the profile share, you can configure user accounts with roaming profiles to use the share. Typically, you use Active Directory Users And Computers or Server Manager to configure roaming profiles. With these tools, you use the %UserName% environment variable to act as a placeholder in the profile path. The server then creates a subfolder for the user based on the user’s account name.
Tip
The %UserName% variable is what tells the server to create subfolders on a per-user basis. For example, if you set the profile path to \NYServer08Profiles\%UserName% and you are configuring the account for ZachM, the profile path will be set as \NYServer08ProfilesachM. The subfolder, ZachM, is created automatically, and the roaming profile is then stored in this folder. By default, when Windows creates this user-specific folder, NTFS permissions are set so that only the user has access to read and manage its contents. If you want administrators to have access to the profile, you must enable Add The Administrators Security Group To Roaming User Profiles in Group Policy, as discussed in the "Modifying the Way Profile Data Can Be Accessed" section in this chapter.
If you are using Active Directory Users And Computers to configure roaming profiles, follow these steps:
Start Active Directory Users And Computers. Click Start, point to Programs or All Programs, Administrative Tools, Active Directory Users And Computers.
Double-click the user account you want to work with. Click the Profile tab.
Tip
You can easily edit multiple accounts simultaneously. To do this, hold down Ctrl or Alt so that you can select multiple accounts to work with, right-click, and then select Properties. When you click the Profile tab, any changes you make to the profile path will then be made to all the selected accounts.
In the Profile Path box, specify the Uniform Naming Convention (UNC) path to the server, share, and folder to use, in the form \ServerNameShareName\%UserName% (where ServerName is the name of the server, ShareName is the name of the share created for storing roaming profiles, and %UserName% is an environment variable that allows the profile path to be unique for each user).
Click OK. The profile folder will be created the next time the user logs on to the network. If a user is currently logged on, she will need to log off and then log back on.
As discussed in Chapter 13 of the Microsoft Windows Command-Line Administrator’s Pocket Consultant (Microsoft Press, 2004), you can also use the command line to change user profile settings. In fact, you can use a single command line to change the profile setting for every user in a selected site, domain, or OU. Here is an example:
dsquery user "OU=Tech, DC=cpandl, DC=com" | dsmod user -profile "\NYServer08profiles$username$"
If you were to type this command on a single line and press Enter, all user accounts in the Tech OU in the Cpandl.com domain would have their profile paths set to \NYServer08profiles\%username%. In this example, the quotes and the dollar signs are necessary to ensure proper interpretation of the command.
Note
When users log on to multiple computers or start multiple Terminal Services sessions, changes made to roaming profiles can get lost or overwritten because the profile of the last session is the one reflected on the profile server. To see why this happens, consider the following scenario: You are logged on to two terminal server sessions simultaneously. In session 1, you create a persistent network drive. When you log off session 1, this change is reflected in your profile, but then you log off session 2 and the profile from this session is uploaded, overwriting the changes from session 1. The next time you log on, the network drive will not be mapped as expected. To avoid this situation, you would need to ensure that the last session you log off is the one that contains the profile you want to save.