HOW TO: Assign a Mandatory User Profile in Windows 2000

This step-by-step article describes how to assign a mandatory user profile for Windows 2000-based client computers in a Windows 2000 domain.

A mandatory user profile is a user account in which the settings are preconfigured by the administrator. If you are using a mandatory user profile, you can modify the profile, but when you log off the computer, the changes are not saved to the profile location (the changes are non-persistent). When you log on to the computer again, the original mandatory profile is loaded on the computer.

How to Assign a Mandatory User Profile in Windows 2000

To assign a mandatory user profile in Windows 2000, follow the steps that are described in this section.

Step 1: Create a Profile

1. On a domain controller, create a template user account that has the same permissions as the user or the group for which you want to create the mandatory profile.
2. Use the template user account to log on to a workstation computer.
   
   A user profile is automatically created on the local computer in the Drive:\Documents and Settings\User_name folder.
3. Configure the desktop settings that you want to use in the profile, including shortcuts, appearance, and Start menu options.
4. Log off the computer.

Step 2: Copy the Profile to a Shared Folder

Copy the user profile that you created in the Step 1: Create a Profile section of this article to a shared network folder. To do so:

1. Create a shared folder on the network in which you want to store the mandatory profile, for example, C:\Profiles\Mandatory, and then share this folder. For example, create the following share:
   \\Server_name\mandatory
2. Assign at least Read & Execute permissions for the users or groups to whom you want to assign the profile.
3. Log on to the domain as an administrator from the workstation computer.
4. Click Start, point to Settings, and then click Control Panel.
5. Double-click System, and then click the User Profiles tab.
6. Under Profiles stored on this computer, click the profile that you created in the Step 1: Create a Profile section of this article, and then click Copy To.
7. In the Copy profile to box, type the Universal Naming Convention (UNC) path to the share that you created in step 1 (for example, type \\server_name\mandatory), and then click OK.
8. Under Permitted to use, click Change, click Mandatory profile user, and then click OK.
9. On the Windows 2000 Server-based computer, start Windows Explorer, and then locate the shared folder that contains the profile that you copied.
   
   This folder contains a file named Ntuser.dat.
10. Rename Ntuser.dat to Ntuser.man.

Step 3: Assign the Mandatory User Profile

1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2. Locate the container that contains the user account whose settings you want to modify.
3. In the right pane, right-click the user account that you want to configure, and then click Properties.
4. Click the Profile tab.
5. In the Profile path box, type the location of the profile that you want to assign.
   
   When you type the location, use the following UNC format, where Server_name is the name of the computer where the profiles are stored and Share_name is the shared folder that contains the mandatory profile:
   \\Server_name\Share_name
6. Click OK.
7. On the workstation computer, log on to the domain by using the account to which you have assigned the mandatory profile, and then test to make sure that the profile settings have been successfully applied.

For additional information about how to work with user profiles in Windows 2000, click the article numbers below to view the articles in the Microsoft Knowledge Base: