Customizing the Default Profile

This article is part of Helge’s Profile Toolkit, a set of posts explaining the knowledge and tools required to tame Windows user profiles.

Administrators frequently have the requirement to adapt newly created user profiles to corporate standards. This is typically done by modifying the default profile, the profile Windows uses as a template when creating new user profiles during logon.

Popular but Unsupported

For more than a decade a popular and officially santioned method of customizing the default profile went like this: log on with a typical user account. Customize that user’s profile. Log off and use either Microsoft’s CopyProfile tool or the User Profile control panel applet to copy the customized profile over the default profile.

Well, that method is no more. As the Deployment Guys describe in a very readable article, Microsoft eventually found out that, because the profile is not cleaned up in the copying process, certain undesired parts of the template user’s personality make it into every user’s profile. As a consequence they:

  • declared this method as unsupported,
  • removed the CopyProfile tool and
  • disabled the button “Copy to…” for all but the default profile in Windows 7.

Would it not have been more logical to fix the copying process so that unwanted information is removed?

Microsoft did build a fixed copying process – though not into Windows, but into Sysprep instead. The problem with that is that there is no documentation available as to what exactly is removed when the template profile is copied to become the default profile. This introduces an element of chance not desired in enterprise environments.

Doing it Right

There is only one alternative to using Sysprep to copy a modified profile over the default profile: modify the default profile directly. This involves identifying where a specific setting is stored, loading the default profile’s registry hive and setting the desired value. The advantage of this approach is that you have full control over the process, which is typically scripted. The downside is that it is more complex. Just logging on and clicking around until the desktop looks good is much easier than hunting down specific settings with Process Monitor.

, ,

7 Responses to Customizing the Default Profile

  1. Andrew Morgan December 7, 2011 at 22:40 #

    Yes, yes and YES!

    The new process for creating a default and madatory profile is a pain in the ass. The MS article is vague and hard on the eyes. The process also leaves a lot to be desired (create an admin user, delete the local Admins account, login again as the local admin, delete the created admin, make your changes then have to sysprep and reconfigure the server). http://support.microsoft.com/?id=973289

    Not only that but the actual items you can configure on the users desktop, start menu and task bar is also poor: http://blogs.technet.com/b/askcore/archive/2010/03/16/how-to-customize-the-windows-7-start-menu-and-taskbar-using-unattend-xml.aspx

    I find procmon a little overkill for tracking reg / file changes so I always favour RegShot, its cleaner and easier for this specific task:

    http://sourceforge.net/projects/regshot/

    • Helge December 7, 2011 at 23:40 #

      Sounds like we have similar views ;-) And I like Regshot, too.

  2. Remko Weijnen December 8, 2011 at 00:34 #

    @Andrew: I used regshot too in the past, does indeed a good job.

    I tend to collect all registry keys in a .reg file and document it, /selfpromo mode: this is described here: http://www.remkoweijnen.nl/blog/2011/01/04/default-user-profile-remkos-solution/ /exitselfpromo

  3. George December 8, 2011 at 15:19 #

    I have used the DefProf tool (Free, http://www.forensit.com/support-downloads.html) to update (and not break) the Default User profile on Win7/Svr2k8. Eaier than doing things manually.

    • Helge December 8, 2011 at 15:41 #

      DefProf looks like a nice tool and certainly works well, but its usage is almost certainly not supported my Microsoft. Though I have to admit many companies use tools and procedures that “void the profile warranty”.

      • George December 8, 2011 at 17:36 #

        Would be nice if there was a “reset default profile” option/tool (other than restoring a backup).

  4. Greg December 13, 2011 at 16:06 #

    Try “Windows Enabler” to turn on the “Copy To” button. Works for me.

Leave a Reply