Roaming user profile

Last updated
Icons-mini-page url.gif C:\Documents and Settings\{username}
  Icons-mini-folder.gif Application Data
  Icons-mini-folder.gif Cookies
  Icons-mini-folder.gif Desktop
  Icons-mini-folder.gif Favorites
  Icons-mini-folder.gif Local Settings
   Icons-mini-folder.gif Application Data
   Icons-mini-folder.gif History
   Icons-mini-folder.gif Temp
   Icons-mini-folder.gif Temporary Internet Files
  Icons-mini-folder.gif My Documents
   Icons-mini-folder.gif My Music
   Icons-mini-folder.gif My Pictures
   Icons-mini-folder.gif My Videos
  Icons-mini-folder.gif Recent
  Icons-mini-folder.gif NetHood
  Icons-mini-folder.gif PrintHood
  Icons-mini-folder.gif SendTo
  Icons-mini-folder.gif Start Menu
  Icons-mini-folder.gif Templates
  Icons-mini-page text.gif NTUSER.DAT
  Icons-mini-page text.gif ntuser.dat.LOG
  Icons-mini-page text.gif ntuser.ini
Folder layout of typical Windows 2000/XP user profile. Normally everything except the items within "Local Settings" is stored on the file server as part of a roaming profile.

A roaming user profile is a file synchronization concept in the Windows NT family of operating systems that allows users with a computer joined to a Windows domain to log on to any computer on the same domain and access their documents and have a consistent desktop experience, such as applications remembering toolbar positions and preferences, or the desktop appearance staying the same, while keeping all related files stored locally, to not continuously depend on a fast and reliable network connection to a file server.

Contents

Method of operation

All Windows operating systems since Windows NT 3.1 are designed to support roaming profiles. Normally, a standalone computer stores the user's documents, desktop items, application preferences, and desktop appearance on the local computer in two divided sections, consisting of the portion that could roam plus an additional temporary portion containing items such as the web browser cache. The Windows Registry is similarly divided to support roaming; there are System and Local Machine hives that stay on the local computer, plus a separate User hive (HKEY_CURRENT_USER) designed to be able to roam with the user profile.

When a roaming user is created, the user's profile information is instead stored on a centralized file server accessible from any network-joined desktop computer. The login prompt on the local computer checks to see if the user exists in the domain rather than on the local computer; no pre-existing account is required on the local computer. If the domain login is successful, the roaming profile is copied from the central file server to the desktop computer, and a local account is created for the user.

When the user logs off from the desktop computer, the user's roaming profile is merged from the local computer back to the central file server, not including the temporary local profile items. Because this is a merge and not a move/delete, the user's profile information remains on the local computer in addition to being merged to the network.

When the user logs in on a second desktop computer, this process repeats, merging the roaming profile from the server to the second desktop computer, and then merging back from the desktop to the server when the user logs off.

When the user returns to the first desktop computer and logs in, the roaming profile is merged with the previous profile information, replacing it. If profile caching is enabled, the server is capable of merging only the newest files to the local computer, reusing the existing local files that have not changed since the last login, and thereby speeding up the login process.

Limitations

Performance

A roaming profile that is several years old can contain tens of thousands of cookies, which make network login and logout extremely slow, and contribute to file system fragmentation. 15395 cookies in 4 yr old roaming profile.PNG
A roaming profile that is several years old can contain tens of thousands of cookies, which make network login and logout extremely slow, and contribute to file system fragmentation.

Due to the profile copying at login and logout, a roaming profile set up using the default configuration can be extremely slow and waste considerable amounts of time for users with large amounts of data in their account.

When Microsoft designed Internet Explorer, the programmers made an explicit decision to store cookies and favorites as tiny individual files less than a kilobyte each, rather than storing this data as a single large consolidated file. Microsoft also stores shortcut files in the Recent profile folder, linking to recently opened files and folders.

File servers tend to only transfer large files several megabytes in size at the fastest possible network speed. Hundreds of very small files only a kilobyte per file can reduce network performance by 90%. As a profile ages and accumulates hundreds to thousands of cookies, favorites, and Recent items, the login and logout times become progressively slower, even though these files occupy only a few megabytes of profile data.

Local caching of the user profile on a desktop computer hard drive can reduce and improve login and logout times, but at the penalty of cluttering up the hard drive with profile data from every cached user who logs in. Local caching is more suitable where people tend to use the same computer every day. Local profile caching is not useful where hundreds to thousands of students need to be able to use any computer across a school or university campus—the cumulative cached data from so many different profiles can consume all available lab computer disk space.

Users with a roaming profile can encounter crippling logon delays when logging in over a WAN. If connected to the domain from a remote site, after authentication, Windows will attempt to pull the user's profile from the location specified in Active Directory. If the location happens to be across a WAN link it can potentially slow the WAN down to a crawl and cause the logon to fail (after a very lengthy delay).

Users with a roaming profile working from a remote site should login to the machine before connecting to the network, (so that the machine uses its cached local copy) and connect to the network after logon has completed. Another option is to remove the roaming profile path from Active Directory prior to their departure.[ clarification needed ] This must be done in enough time that the change is replicated to the relevant Domain Controller at the remote site.

Profile size

Working with large files, such as editing raw videos, can cause excessive login and logout times, as Windows will copy files in the roaming profile to the computer on login and back to the server on logout.

In environments where the large files are not mission-critical and do not absolutely need to be backed up to a server on a per-login basis, the applications requiring such excessively large amounts of user data are instead usually run on a stand-alone local account that does not roam, to bypass these network storage and retrieval problems.

Example of third-party software (Sun Microsystems Java) storing temporary files and software updates in the roaming profile. The bloated roaming profile increases login and logout times. The stored updates shown are unnecessary after installation, yet they are not deleted. Java roaming profile bloat.PNG
Example of third-party software (Sun Microsystems Java) storing temporary files and software updates in the roaming profile. The bloated roaming profile increases login and logout times. The stored updates shown are unnecessary after installation, yet they are not deleted.

Network congestion

In a school environment, roaming can result in severe network congestion and slowness when an entire classroom of students log off computers at the same time, and then within minutes are attempting to log in somewhere else. Inconsistency in account data can result if the students begin to log into the second location before the profile uploading and log out from the first location has finished.

Misbehaving programs don't exit

Some programs installed on desktop computers do not properly release control of the User registry during logoff, and can result in corrupted profiles because the User registry copying never successfully completes. To deal with this, Microsoft created a utility known as the User Profile Hive Cleanup Service which will forcibly remap the file handles for these misbehaving programs so that the profile copying can finish successfully and the account logoff is successful. [1] However, the hung program may remain on the local computer still holding the local cached copy of the User registry in a busy state, until the computer is rebooted.

Synchronization at logoff

The most recent version of a file in a roaming profile without redirection is stored only on the local computer, and stays there until the user logs off, whereupon it transfers to the server. If nightly server backups are done, and a roaming user does not log off for days at a time, their roaming account documents are not being included in the nightly backup.

Further, if a roaming user uses standby or hibernation to turn off the computer at night, their profile is still not copied to the network. In this manner it is possible for a roaming account's documents to not be backed up for days to weeks at a time, and there is the potential for considerable data loss if the local hard drive suffers a catastrophic failure during these long periods of not logging off the roaming account from the local computer.

Access conflict

Due to the underlying file copying mechanism from server to desktop, roaming assumes the user account is logged on to only a single computer at a time. Documents in a roaming profile copied down to the local machine have no network awareness of each other, and it is not possible to use file locking to alert the user that the file is already open.

Logging onto multiple computers with one account, and opening the same document multiple times on each computer can result in inconsistencies and loss of saved changes if the file is modified on two different computers at the same time:

Compatibility

Different versions of Windows may employ different incompatible user profile layouts. As such, a user that roams between computers with different operating systems needs separate roaming profiles for each operating system. Windows Vista and Windows 7 add ".v2" suffix to the user profile folder to isolate it from the user profiles of Windows XP and earlier. Even so, Microsoft TechNet advises users not roam between computers running Windows Vista/Windows Server 2008 and Windows 7/Windows Server 2008 R2. User profiles in Windows 8/Windows Server 2012 and Windows 8.1/Windows Server 2012 R2 are also not entirely backward-compatible, although they initially used ".v2" suffix as well. Microsoft later released hotfix es and instructions to enable these operating systems to append ".v3" and ".v4" suffixes respectively, segregating them from cross-OS access. [2] [3] [4] [5]

Folder redirection

To deal with these profile copying problems, it is possible to override the default operation of roaming, and set up user accounts so that certain parts of the profile are accessed by the local computer directly on a central file server rather than copying to the local computer first. [6] If the server goes down, users can still access some files with Offline Files Enhancements.

To the end-user, folder redirection generally does not appear to function any differently from using a normal standalone computer. Redirecting the user's My Documents and Desktop to be accessed directly on a file server are the first two big steps for speeding up roaming profiles. However, as 3rd party software have begun to store more and more data in the Application Data portion of the roaming profile, it has also become useful to redirect that to also be accessed directly on the server.

The question may be raised as to why the entire roaming profile can not be accessed directly on the server, and no copying needs to be done at all. The reasoning for this appears to be that certain Microsoft programs running all the time on the client computer can not tolerate the sudden loss of their data folders if the server goes down or the network is disconnected. Some portions must still be copied back and forth before the desktop appears so that these folders are available if the network-redirected folders go down.

Caveats

Some programs do not work properly with redirected profile folders that refer to a UNC file path on a server share: \\server\share\username\Application Data

These problems with UNC paths can usually be fixed by having the folders redirected to a drive mapping for the UNC share:

However, use of drive mappings is generally deprecated by Microsoft, and UNC-only redirection paths are the preferred implementation.

Mandatory profiles

Folder redirection with mandatory profiles

Folder redirection may be used with mandatory profiles, and is useful in situations where it is desirable to "lock down" the general desktop appearance but still allow users to save documents to the network. For example, this can be used as a generic account for anyone to use without a password for temporary use.

Redirecting My Documents and the Desktop in a mandatory profile will allow documents to be saved, but at logoff, any changes to the desktop appearance such as the desktop picture, Internet Explorer cookies, Favorites, and the Recent documents opened list are reverted to the original state. [10]

Folder redirection with mandatory profiles is accomplished by denying write access to the central copy of the profile. When users log off, they may expect to regularly receive an error that the profile could not successfully be copied back to the server. A user should also be aware that storing data in certain locations may cause their data to be lost. For example, if the desktop is reset every time a user logs on with the mandatory profile's desktop, then although it seems fine to save files on the desktop, when the user logs off, the profile does not get copied to the server, and when the user logs back on, any work saved on the desktop is permanently lost without any advance notice other than the error on logout that the profile could not be copied.

Setup methods

Active Directory

When user U logs into a Windows computer C joined to a domain, then C will consult the following locations to determine if the user has a roaming profile path configured:

  1. the “Set path for Remote Desktop Services Roaming User Profile” group policy for C, if the login is to a terminal server
  2. the msTSProfilePath attribute of U's LDAP object, if the login is to a terminal server
  3. the “Set roaming profile path for all users logging onto this computer” group policy for C
  4. the profilePath attribute of U's LDAP object

The first of these configuration settings that has a value overrides any later ones. LDAP attributes can be set by a domain administrator, or anyone else who has write access to the respective LDAP user object according to its access-control list. The value configured as the profile path is typically given as a UNC path to folder on an SMB file server, and the path typically contains the variable “%USERNAME%” to make it specific to the user. The roaming profile for Remote Desktop Server users is specified under the "Remote Desktop Services Profile" tab.

In Windows 2000 and later versions, a GUI interface for setting the profilePath attribute is available in the Active Directory Users and Computers snap-in. Windows NT 4.0 and earlier used the User Manager for Domains program. From many other operating systems, such LDAP attributes can be accessed e.g. with OpenLDAP command-line tools ldapsearch and ldapmodify (after SASL/GSSAPI authentication).

When a user logs into a computer joined to a domain, the Windows shell will check the above-mentioned LDAP attributes and group policy files to determine the roaming user profile path. It then calls the LoadUserProfile function. Microsoft has not documented the precise file synchronization algorithm that this function implements, but it involves comparing for each file found in both the local and the roaming profile the timestamps, to then replace any older file found on the computer. When the user logs off, the Windows shell calls UnloadUserProfile, which applies a similar file synchronization algorithm in the opposite direction, to allow changes made to the roaming profile to migrate back to the location where the user's roaming profile is stored. In addition, since Windows 7, it has possible to specify a group policy “Background upload of a roaming user profile's registry file while user is logged on” to apply this synchronization process to the NTuser.dat file at regular intervals (default is 12 hours). Logging into Windows via OpenSSH for Windows does not load a roaming profile.

Windows 95, 98 or Me

Workstations running Windows 95, 98 or Me can also have roaming profiles, however the users roaming profile files in Windows 9x are stored in the users Home directory even if a separate location for roaming is specified. In order to use roaming profiles in Windows 9x each workstation needs to be set up to have separate profile settings for each user that logs into the local workstation enabled. Enabling separate desktop settings in Windows 9x is enabled under Passwords in the Windows Control Panel.

Roaming profiles on Windows 95, 98 and Me are all compatible with each other so if a network has mixture of Windows 95 and Windows 98 workstations the same user profile may be used for each workstation. This is also the case with Roaming profiles between Windows NT 4.0, Windows 2000, Windows XP but there may be some compatibility issues due to differences in each version of Windows. Roaming profiles in Windows Vista and Windows 7 are compatible with each other but these versions are not compatible with earlier versions of Windows. A separate profile folder with the extension .V2 will be created when using Roaming profiles with Windows Vista or 7. The easiest solution is to have all workstations running the same version of Windows. (see Compatibility section)

Novell eDirectory/Netware

For roaming to work with Novell servers, the Novell product "ZENworks Desktop Management" needs to be installed on the server, and its associated workstation management package installed on each of the client computers. Within the directory, a User Package object is created, which enables roaming, specifies where the roaming profile is stored, and also stores any associated group policies for each version of Windows where users will login. The User Package also enables Dynamic Local User, which functions similar to Active Directory, allowing an account created in eDirectory to log in on any desktop computer even if no local account exists in advance, and assigns local account privileges such as User, Power User, or Administrator to the newly created local user account. For Windows NT the user profile files are stored in the users home directory under a subfolder for each version of Windows, for example in Windows NT 4.0 the folder will be called "Windows NT 4.0 Workstation Profile" and in Windows XP the folder will be called "Windows NT 5.1 Workstation Profile"

The User Package can be associated with a specific user account in the directory, or is associated with an organizational unit that then applies to all user accounts within that OU. The User Package also enables additional ZENworks Desktop Management functions, such as remote view and remote control of the desktop computer, network printers that follow the user from one desktop to the next, and the scheduling of events that are to be run wherever the user is logged in.

Windows 3.x

While Windows 3.x does not contain user profiles it was possible for users to have their own personalised desktop in a business environment. Windows 3.x had an administrative setup option which network administrators could use by typing setup.exe /a Windows could then be installed to a network share. Windows setup was then run from each local machine to install a few local files making Windows 3.1 capable of being run over a network. The local files could be saved to a user's home directory on a Novell or Windows NT Domain network allowing the user to have his or her settings roam between machines, the local machine in this scenario did not require a hard drive and could have been booted from a floppy or network card.

Resetting a profile

Occasionally a users profile may need to be reset if the profile becomes corrupt or to resolve an issue with an application, a reset would normally be performed by a systems administrator or helpdesk staff. To perform a reset the affected user needs to log out of the system and then the folder where the users roaming profile is stored on the server is then renamed, the user profile must also be deleted from the local workstation the user logs into otherwise the user will take the locally stored profile on next login. When the profile has been cleared from the local machine when the user logs in a new profile will be generated using the default profile stored on the workstation, when the user logs out the profile will be copied back to the location where the users roaming profile was stored.

Advantages

Disadvantages

Each time a user logs into a workstation, all of the files and settings are transferred over the network; the result is that the login process takes longer than if the user were to use a local profile. This is particularly the case if the profile is large in size. The login time may be reduced if the profile is cached as some files can be loaded from the local workstation and by using folder redirection to redirect folders that can grow to a large size, like My Documents, to a network share.

However, this limitation has been addressed in Windows Server 2008 Active Directory by allowing folder redirection of almost all folders that were previously stored in a user's profile (including My Music, Favorites, and others) to a centralized and secured network share. This means that a user's roaming profile can easily be reduced to size smaller than 20MB, thus eliminating the long login times that were experienced with previous versions of AD. When using folder redirection and automatic caching of offline files, all of a user's files and preferences are available offline and synced in a much more efficient manner than previously possible when the computer is reconnected to the network using Remote Differential Compression (RDC).

Another problem is related to different set of applications installed on machines, applications stores information into Local Settings and some into the registry, but only the registry is transferred across. It can corrupt application functionality under roaming profile.

Redirected folder sharing

Redirected network folders are able to override the separation between 2000/XP and Vista/Win7. For example, both types of profiles can be redirected to use a single Documents folder, and a single Desktop folder, so that the user's account documents are consistent between the two profiles, even if all other account settings will be different.

Redirected sharing of folders such as Application Data may lead to data corruption, since Microsoft did not intend this for their application data to be shared between the different OS versions.

Alternatives

User virtualization programs (such as AppSense) manage user profiles, settings, and data, storing them in a network share or the cloud.

See also

Related Research Articles

The Encrypting File System (EFS) on Microsoft Windows is a feature introduced in version 3.0 of NTFS that provides filesystem-level encryption. The technology enables files to be transparently encrypted to protect confidential data from attackers with physical access to the computer.

<span class="mw-page-title-main">Windows Registry</span> Database for Microsoft Windows

The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry. The kernel, device drivers, services, Security Accounts Manager, and user interfaces can all use the registry. The registry also allows access to counters for profiling system performance.

<span class="mw-page-title-main">Group Policy</span> Feature of the Microsoft Windows NT family of operating systems

Group Policy is a feature of the Microsoft Windows NT family of operating systems that controls the working environment of user accounts and computer accounts. Group Policy provides centralized management and configuration of operating systems, applications, and users' settings in an Active Directory environment. A set of Group Policy configurations is called a Group Policy Object (GPO). A version of Group Policy called Local Group Policy allows Group Policy Object management without Active Directory on standalone computers.

<span class="mw-page-title-main">Diskless node</span> Computer workstation operated without disk drives

A diskless node is a workstation or personal computer without disk drives, which employs network booting to load its operating system from a server.

In computing, and specifically in the context of Microsoft Windows operating systems, Microsoft refers to Folder Redirection when automatically re-routing I/O to/from standard folders (directories) to use storage elsewhere on a network.

As the next version of Windows NT after Windows 2000, as well as the successor to Windows Me, Windows XP introduced many new features but it also removed some others.

My Documents is the commonly recognized name of a special folder in Microsoft Windows This folder is supposed to be a personal area where users store their personal non-shared documents. However, many software developers have ignored this convention and as a result, this folder has become a dumping ground for the application data such as files containing settings and saved games. Users cannot delete, move or organize these files without causing unwanted behavior in their software.

On Microsoft Windows, a special folder is a folder that is presented to the user through an interface as an abstract concept instead of an absolute folder path. Special folders make it possible for any application to ask the operating system where an appropriate location for certain kinds of files can be found; independently of which version or user language of Windows is being used.

Windows Vista introduced a number of new I/O functions to the Microsoft Windows line of operating systems. They are intended to shorten the time taken to boot the system, improve the responsiveness of the system, and improve the reliability of data storage.

There are a number of security and safety features new to Windows Vista, most of which are not available in any prior Microsoft Windows operating system release.

The NTFS file system defines various ways to redirect files and folders, e.g., to make a file point to another file or its contents without making a copy of it. The object being pointed to is called the target. Such file is called a hard or symbolic link depending on a way it's stored on the filesystem.

In computing, a shared resource, or network share, is a computer resource made available from one host to other hosts on a computer network. It is a device or piece of information on a computer that can be remotely accessed from another computer transparently as if it were a resource in the local machine. Network sharing is made possible by inter-process communication over the network.

Temporary Internet Files is a folder on Microsoft Windows which serves as the browser cache for Internet Explorer to cache pages and other multimedia content, such as video and audio files, from websites visited by the user. This allows such websites to load more quickly the next time they are visited.

A home server is a computing server located in a private computing residence providing services to other devices inside or outside the household through a home network or the Internet. Such services may include file and printer serving, media center serving, home automation control, web serving, web caching, file sharing and synchronization, video surveillance and digital video recorder, calendar and contact sharing and synchronization, account authentication, and backup services.

Windows Vista has many significant new features compared with previous Microsoft Windows versions, covering most aspects of the operating system.

Windows Vista contains a range of new technologies and features that are intended to help network administrators and power users better manage their systems. Notable changes include a complete replacement of both the Windows Setup and the Windows startup processes, completely rewritten deployment mechanisms, new diagnostic and health monitoring tools such as random access memory diagnostic program, support for per-application Remote Desktop sessions, a completely new Task Scheduler, and a range of new Group Policy settings covering many of the features new to Windows Vista. Subsystem for UNIX Applications, which provides a POSIX-compatible environment is also introduced.

<span class="mw-page-title-main">Windows SteadyState</span> Discontinued network configuration software produced by Microsoft (2005-08)

Windows SteadyState is a discontinued freeware tool developed by Microsoft that gives administrators enhanced options for configuring shared computers, such as hard drive protection and advanced user management. It is primarily designed for use on computers shared by many people, such as internet cafes, schools and libraries.

Remote Desktop Services (RDS), known as Terminal Services in Windows Server 2008 and earlier, is one of the components of Microsoft Windows that allow a user to initiate and control an interactive session on a remote computer or virtual machine over a network connection. RDS was first released in 1998 as Terminal Server in Windows NT 4.0 Terminal Server Edition, a stand-alone edition of Windows NT 4.0 Server that allowed users to log in remotely. Starting with Windows 2000, it was integrated under the name of Terminal Services as an optional component in the server editions of the Windows NT family of operating systems, receiving updates and improvements with each version of Windows. Terminal Services were then renamed to Remote Desktop Services with Windows Server 2008 R2 in 2009.

Microsoft Windows profile refers to the user profile that is used by the Microsoft Windows operating system to represent the characteristics of the user.

References

  1. "User Profile Hive Cleanup Service". Microsoft . Archived from the original on 2006-03-08. Retrieved 2010-02-22.
  2. "Deploy Roaming User Profiles". TechNet . Microsoft. 19 March 2014. Retrieved 22 September 2014.
  3. "Incompatibility between Windows 8 roaming user profiles and roaming profiles in other versions of Windows". Support (3.0 ed.). Microsoft. 26 January 2014. Retrieved 22 September 2014.
  4. "Incompatibility between Windows 8.1 roaming user profiles and those in earlier versions of Windows". Support (3.0 ed.). Microsoft. 18 December 2013. Retrieved 22 September 2014.
  5. Beach, David (31 July 2013). "Roaming Profile Compatibility - The Windows 7 to Windows 8 Challenge". Ask the Directory Services Team. Microsoft . Retrieved 22 September 2014.
  6. Microsoft TechNet, Windows Server 2008, Group Policy Management, User Folder Redirection, Folder Redirection Overview
  7. Adobe knowledge-base: Runtime error | Roaming Profile workflows | Acrobat, Reader 9 http://kb2.adobe.com/cps/404/kb404597.html%5B%5D
  8. bug report, Open Office 3.3 incompatible with redirected Application Data http://openoffice.org/bugzilla/show_bug.cgi?id=115778
  9. Alex Numann [@GuamDon] (September 5, 2013). "@AutoCAD Do I really need to pay for a subscription to get some tech support? Your product doesn't work with network users? Very surprising" (Tweet) via Twitter.
  10. Microsoft MSDN, 2012-06-06, "Mandatory User Profiles", Quote: "[...] a user can modify his or her desktop, but the changes are not saved when the user logs off.", http://msdn.microsoft.com/en-us/library/windows/desktop/bb776895(v=vs.85).aspx