Active Directory Users

[Tim Hunter]

I am running Windows Server 2016 on my Domain Controller where I have my Active Directory Users setup. How do I setup users so if they login to a different computer they will see the same desktop icons, etc. Right now, the users are able to logon to any network computer with no issues, however, there desktops do not follow them. Did I miss a step in the setup process? I am a novice to AD, so any help or guidance would be appreciated. Thanks!

[#2]

The feature you are looking for is roaming profiles: https://docs.microsoft.com/en-us/windows-server/storage/folder-redirection/deploy-roaming-user-profi...

[#3]

@Tim Hunter - Did you setup Roaming Profiles? Or are you wanting to use "Mandatory Profiles" where they cannot change anything (or at least it will revert to the settings the next time they log in?

I'm not sure what you did, so I cannot ascertain if you have "missed a step" as you mention. Can you provide us with the steps that you did do then we can evaluate?

If you want to look through some of the steps, here is a guide for Roaming Profiles. 
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj...

Hope this helps!

[#4]

@Edward Dake  @Vasil Michev 

The AD was already built when I arrived. It doesnt look like any of the users are setup as Roaming Profiles. Is it easy to switch the users to a Roaming Profile? Is there any negatives to making users have Roaming Profiles?

[#5]

@Tim Hunter - Well, there are size considerations, etc. There are trade-offs, between local profiles and roaming profiles. There are Pros and Cons to each. 

What is the end goal? Are you trying to just provide the same icons/shortcuts on the desktop for each user everywhere? Or are you trying to provide that user everything they have access to (i.e. documents, files, etc.) on every computer they log into?

Moving existing profiles that are local, to be roaming after the fact, can have some impact on the existing data. It can be done, but you have to do so with the user data in mind. What is your Office (specifically, Outlook) strategy? Do users leave all their email on the server (or O365) or do they create local .pst files?

How big are their profiles on their existing machines (when you go look at Properties, Advanced System Settings, User Profiles)? That data will have to be transferred across the wire to every workstation and then be synchronized at logon. 

There are many ways to approach this, depending on what you're wanting to provide for the user experience. It might be that there are some settings you can utilize (GPOs, Folder Redirection, etc.) that may better for the user and your network bandwidth. 

Edward

[#6]

@Edward Dake 

Edward, I appreciate all your feedback and information it is very helpful in my learning.

So basically, my users login to their local PC or laptop, then they have a Remote Desktop shortcut on their desktop to whichever server they are required to logon to. Also, they may have some favorites/bookmarks in their IE/Chrome browsers. I would like if the user logs on to a different PC in the office then their same RDP shortcut would be on the desktop no matter which network PC they logon to so they can easily remote into our server for working. Hope this makes sense. Am I over complicating it?

[#7]

@Tim Hunter - No Worries Tim! Glad to help. 

If all you're after is a Desktop Shortcut and some Favorites, you can do a lot of that with GPO or some other methods.

What is the OS that your clients run? What Browser are you/they using?

I know you said your Domain Controller is 2016. Let me know the other items and we can find you some ways to do this outside of full "roaming profiles". 

Edward

[#8]

@Edward Dake 

The users are running Windows 10. Some users are using Chome, other use IE and some use both.

The Remote Desktop shortcut is saved with the users specific logon details so they just have to click the icon, they don't have to logon each time. Not sure if there is a way to do this for all users. 

[#9]

@Tim Hunter - Wow. That might be a hard thing. You might have to have the user provide their own username and password. Hmmmm.... I'll need to think on that.

To get the RDP file (generic) for every user on the box, you can create the RDP file (pointing to servername, and whatever settings short of username/password) and then Save it. After saving it, you can then copy it to the C:\Users\Public\Desktop location (you'll need to provide admin "okay") and then once it is copied there, it will show up on every users desktop. That's for Windows 10. On other Versions, I think it is called "All Users".

For the Favorites in IE, there is a GPO that will allow you to do that. Here is one that I found:
https://blogs.msdn.microsoft.com/asiatech/2014/12/16/how-to-apply-favorites-links-to-ie10ie11-in-gpo...

I highly recommend you download the GPO Reference and do searches in the spreadsheet. Don't get overwhelmed! Here it is:

https://www.microsoft.com/en-us/download/details.aspx?id=25250

For Chrome, I know that you can control a number of settings with GPOs, but you have to add an Administrative Template to do so. Our organization does restrict a number of settings in IE and Chrome via GPOs, I just don't have enough experience to know if you can push Favorites in that Admin Template or not. Sorry! 

Here is one article that talks about Chrome settings via GPO:
http://woshub.com/how-to-configure-google-chrome-via-group-policies/

Edward

[#10]

@Edward Dake 

So when I copy the shortcuts that I want to C:\Users\Public\Desktop do I need to do that on each PC/laptop individually?

[#11]

@Tim Hunter - Yes, you'll need to do that to each machine. If you have access to them as admin or domain admin, you should be able to connect to the C$ share of each one and copy them remotely. If there isn't too many machines. You could write a script to do this... Or you could do a logon or startup script to do this via GPO. ;) Lot's of ways to approach this.... 

NOTE: If the users have "Admin" rights on the machine, they could be able to delete that RDP file from their desktop and or "modify" it, so test what you might need to do to make that "read only" or "show up each time if it is deleted... Just a word to the wise. 

Again, I'm just throwing things out there. There might be some better ways to do this. Although, I don't know of any way at this point to do individual username passwords for multiple desktops. That might have to be a "folder redirection thing" and you have them on individual shares with "shortcuts" to them on their desktop. But remember, that also requires the network to be up and working all the time. 

I hope I'm not clouding any of your thoughts and confusing things! 

Edward