No Policies Applying, Temporary Login, Windows 7

No Policies Applying, Temporary Login, Windows 7 x64/x86

You have been logged in with a temporary profile..  even though the user in Active Directory (AD) is setup correctly and the NTFS/Share permissions are also.. setup correctly.

Whats going on? Hopefully this post will help.

Applies to: Windows 7 x86/x64, Windows 2008R2 Domain

Symptoms

• No Group Policies have applied to the profile
• No Mapped Drives/Printers
• No Preferences Applying
• Admin (like) control of the machine, no restrictions set
• An explanation mark (!) in a blue circle appears in the system tray
• A balloon appears/tries to appear notifying the user that they are logged in with a temporary profile
• The login is way too quick.
• If you log out and log back in sometimes the profile works fine, sometimes it logs back in again as a temporary profile. 
• The issue is intermittent with little/no pattern, sometimes does it, sometimes it does not. Not machine specific, not user specific.
• If you wait for a few seconds before logging in, the chances of the profile working correctly improves.
• Occurs more often on wireless devices than wired, but isn't limited to wireless.

Reasons

When Windows 7 was the new big thing, Microsoft had a page about all the cool new features of their brand new operating system.  There was one feature (which unfortunately I have forgotten the name of) but it boasted about priority, fast logins.  Essentially, it meant that if Windows 7 noticed there would be a delay in the logging in, it chose to prioritise just getting the user to the desktop rather than waiting to ensure the login was correctly done.

This is what you are encountering.  Some networks, particularily wireless ones take that little bit longer to establish a new IP address, down to poor signal strength or just generally the type of wireless card you have in your device.

So when a typical user, types in their username and password within seconds of the machine first booting, the chances are the computer hasn't yet got an IP address or stable connection with the server but still attempts to log them in regardless.  Windows 7, realising that there is a networking issue, rather than saying to the user, "Please wait a sec, I haven't fully established a trust with the server", it simply goes, "oh who needs a server, I know your credentials are correct, thats all I basically need, heres a desktop", perfect if you are a home user, really annoying if they are domain user.

Resolutions

Nice and Easy, theres a group policy for it.  Inside that needle in a haystack database there is a policy that ensures the computer (regardless of whether its wireless or not) will make sure the user will not be able to login until a stable connection is first established.

Located Here

Windows Server 2008R2
Computer Configuration -- Policies -- Administrative Templates -- System --  Logon

Windows Server 2003R2
Computer Configuration -- Administrative Templates -- System -- Logon

Policy Name

Always Wait For The Network At Computer Startup And Logon

Set to: Enable

How it works

This is a brilliant policy when applied as it ensures that when a computer is loading up and a user attempts to login the second they can type, it overrides the client operating system's decision to prioritise getting the user to the desktop. 

All policies will therefore come down to the client and apply to the user and computer, thus ensuring that their logins are correctly redirected and their resources (shared areas and Printers) are correctly applied in accordence to your ICT policy.



I hope this helps you all out, I understand that Windows 8 is out soon but for those looking to upgrade to Windows 7, this is a small bug i'm sure you will come across.

It is easy to ignore when testing as when it happens you log off and you log back in and it all seems fine, but bear in mind, you are a technician, you use computers in the way they should be used.  True testing comes from the end user and not the ICT department.

I'm happy to help out anyone with any more issues in relation to this, just leave a comment below.  Additionally, any other fancy features you may of found in the GPO Needle in a haystack database, which you feel will help optimise Windows 7's logging in speed and/or reliability, never hesitate to post a comment, we are all on the same team here, all help is much appreciated.

Speak to you all soon,

The ITMagician

Network Font Installation

Do you constantly get requested by users to install fonts? Or would you like to give users the ability to install their own fonts?

Save the code below as a vbs file, and add it the the computer startup. All you or your users have to do then is put any fonts you/they want installing, into the shared server folder (\\server\share\fonts in the example).

It's built as a subroutine, so you can easily add it to an existing script or run it on its own.

If you ever want to add a new font, just copy it to the server; next time the machines reboot they'll install it. I've made the shared folder available to end users so they can add their own, obviously they need to be aware not to copy hundreds at a time, otherwise other users are not going to be too please next time they start their PCs.

Code:

Sub InstallFonts

   on error resume next

   Const FONTS = &H14

   dim oFSO,oShell,oFolder1,oFolder2,sRoot

   sRoot=\\server\share\fonts\

   set oShell = CreateObject("Shell.Application")

   set oFSO=createobject("scripting.filesystemobject")

   set oFolder1 = oShell.Namespace(FONTS)

   set oFolder2=ofso.getfolder(sRoot)  

   for each oFile in oFolder2.files

   sName=lcase(oFile.name)

      if right(sName,4)=".ttf" then

         if not ofso.fileexists(oFolder1.self.path & "\" & sName) then

            oFolder1.copyhere sRoot & sName

         end if    

      end if  

next  

on error goto 0

End Sub

InstallFonts

Original Source: http://www.edugeek.net/forums/scripts/4756-script-install-fonts-workstations.html#post370283 Thanks to Steve Rochford for this code.

Hide User Account on Welcome Screen in Windows

Windows operating system including Windows 7, Windows Vista and Windows XP allows multiple user accounts to be created on the computer, be it administrators or standard users. When there is more than one user accounts been defined and created on the PC, Windows will display Welcome Screen, with all available user accounts listed so that user can click and login.

However, showing and displaying of user accounts on the Welcome Screen is probably a weakness in the security point of view, more so if the user account is intended to be a hidden or backup user account. In fact, there is trick to make any user account or administrator account that normally been listed on the Welcome Screen to be hidden from view.
In order to hide a user account (which also means create a hidden user account) in Windows XP, Vista, or Windows 7, just go to Control Panel User module and create an additional user as usually do. If you already have an existing user that wants to be made hidden, invisible or disappeared from Welcome Screen, then go straight to guide below.

1. Run Registry Editor (RegEdit.exe).
2. Navigate to the following registry key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
   Note: If SpecialAccounts and UserList is not found, create new sub-key and name them accordingly.
   
3. Select UserList, and in the right pane, right click on any blank space, and point to New -> DWORD (32-bit) Value.
4. Name the new DWORD registry value name as the exact same name that match the name of the user account to be hidden.For example, if the user ID of the user account is ITNut, the name the registry value as ITNut.
5. Double click on DWORD registry value, and set the value data to 0 in oder to hide the account from Welcome Screen.
   Tip: To display the user account on Welcome Screen again so that it’s visible again, delete the registry entry, or set the value data to 1.
6. Exit Registry Editor.
7. Log off or restart computer to make the change effective.

Tip: In order to login into Windows using an user account that has made hidden and invisible, just press Ctrl+Alt+Del to bring up Windows Logon dialog, and then type in the user name and password manually.

Deploying Drivers

Have you ever just finished building a load of PCs, to have someone come up and ask for some dodgy piece of hardware to be installed on all PCs, and the drivers required are unsigned, and aren't pre-packaged in an easily deployable silent package or MSI. Or you've been given some dodgy new hardware (you know the companies I'm talking of), to install.

Well its easier than you think to deploy drivers as either a script or as part of an MSI package. I am assuming that you, the reader, are capable of writing a script and/or creating a suitable MSI, so I will not insult your intelligence by giving you a completed script/msi. If you're anything like me (God help you if you are!) you'll learn better by doing, rather than seeing.

Anyway, by using a small executable provide by Microsoft, DPInst.exe, available as part of the Windows Driver Kit (WDK), Download available here, we can indeed make drivers available on any windows OS system, to be installed as and when needed.

Once you have download and installed the WDK (btw you only need to install the tools part), you can find different architectural/language versions of the DPInst.exe in C:\WinDDK\7600.16385.1\redist\DIFx\dpinst (assuming you install to the default location, and the version number hasn’t changed since writing).

Place the correct version of DPInst.exe in with your driver .inf files. If you were to run the dpinst.exe now, you would be presented with a wizard for installing the drivers onto the system. If you were to step through the wizard, it will complete, but it will only be successfully if the drivers are signed.

However, that’s not what we really want, we need no user interaction at all, and we need to be able to install unsigned driver*. To install any drivers without the end user noticing, call the DPInst.exe with the following commands:

/Q  - This is for quiet install with no user interaction,
/LM – This is for unsigned drivers.

Now the drivers are installed, or technically they are made available to be installed when the hardware is connected. Now if your drivers are signed that is the end of the story, however, if like me, you have been given a host of cheap hardware made in china, with unsigned drivers, you will need to adjust the following 2 Group Policies*:

Computer Configuration>Windows Settings>security Settings>Local Policies>User Rights Assignment:
Policy: “Load and unload device drivers”
Setting: DomainName\Domain Users

User Configuration>Admin Templates>System>Driver Installation:
Policy: “Code signing for device drivers”
Setting: Enabled – ignore

Click here for a full overview of DPInst, and here for a full list of command switches.

* Please note that installing unsigned drivers and/or modifying Group Policy is done at the readers own risk, and the writers of “Thoughts of a Primary School Tech” are in no way responsible/liable for any loss/damage caused to any system(s) by following the instructions provided here. Whilst every effort has been made to ensure this works correctly on any windows system, your milage may vary.

Windows 7 Godmode

I thought I'd better introduce myself, I'm The IT Nut, a colleague of the Primary School Tech, and I will be dropping a few posts on here from time to time.

I'll be specialising in Powershell Tips and creating MSI packages for group policy rollout, along with links to a few projects of my own.

To start with though, I thought I begin with GodMode! I found out about this feature and thought it was rather neat.

GodMode is a hidden feature in Windows 7 as well as windows vista. By enabling this feature allows you to access all windows settings in a single place. It is a single folder that collects all of the control panel functions,interface customization,accessibility options etc..

Steps:
•Create a new folder
•Name the folder: GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}
•Then open it to show the GodMode window.

GodMode enabled.