This post was provided by Michael Murgolo a Senior Consultant with Microsoft Services, U.S. East Region.  This post (and any updates) can also be found on the Deployment Guys blog here.

Anyone who had been doing operating system deployments long enough has had to deal with configuring default settings for users that log on to the computer after the image is deployed. Some examples of these are folder settings, desktop wallpaper, and screen saver options. Most of these will be initial settings for user preferences that users will be able to change (unlike policies which are enforced). This is done so that users will have a consistent, known experience when logging on to any client computer for the first time.

This can be done in a number of ways.  Below are the methods I have seen or used with what I feel are pros and cons of each.

Implementing Default User Settings by modifying the Default User Profile

There are three main methods that have been used to configure the Default User profile.  Only one method (B) is now officially supported and I recommend that you use this method.

A. Manual or scripted copy of a configured profile over the Default User profile (unsupported)

The traditional solution for this (developed during the Windows NT Workstation days) was to configure the Administrator account (or another designated account) with the settings, then copy the Administrator (or designated account) user profile over the Default User profile.  This was previously documented in numerous Knowledge Base articles (which have now been deleted).  A tool called CopyProfile was even created to script this process during unattended installations of Windows XP.

However, there are problems with using this procedure.  It is very old procedure from NT4, when the shell was much simpler.  The shell is more complicated for Windows 2000 and higher.  This process will copy settings that should not be copied to the default user profile.  It may seem to work but you will find subtle problems.  Windows XP and later have made those subtle problems more visible.

Also, the Default User profile contains some single run actions that occur when the user logs in for the first time, which then setup that user by running those custom actions.  If you overwrite the Default User profile, those single run actions do not take place.

The manual profile copy process can cause issues such as:

• Their list of most frequently run programs is not cleared
• Whether the user has been introduced to the Start menu (will be set to TRUE for the source account, but should be FALSE for new users). Windows Explorer does some special things the first time you log on to introduce you to the Start menu and other new features.
• Whether the user is an administrator (and should therefore see the Administrative Tools, etc).
• The personalized name for "My Documents" will be incorrect. All users documents folders will be called "Administrator's Documents".  This is documented in the Knowledge Base article "The Desktop.ini File Does Not Work Correctly When You Create a Custom Default Profile" (http://support.microsoft.com/?id=321281).
• The default download directory for IE will be set to the Administrator's Desktop folder.
• The default Save and Open locations for some application with point to the Administrator's documents folder.
• Windows 7 Libraries are broken.

Because of these issues, this process is no longer supported in Windows XP and all later operating systems.  Unfortunately, the ability to copy a profile over the Default User profile was not blocked in Windows XP, Windows Server 2003, Windows Vista, or Windows Server 2008.  This allowed many administrators to continue using the process and putting their Windows installations into an unsupported state.  To prevent this, Windows 7 and Windows Server 2008 R2 now block this scenario by having the Control Panel System applet gray out the option to overwrite the Default User profile.

At this time the only supported way to configure the the Default User profile using a copy of a configured profile is to use the next method described here, the automated profile copy associated with using Sysprep.

B. Automated profile copy with Sysprep (supported)

First introduced in Windows XP Service Pack 2 (http://support.microsoft.com/?id=887816), Minisetup was modified so that it will copy customizations from the local administrator account to the default user profile.  All subsequent versions of Windows will also do this with the proper entries in the answer file.  This process was designed to avoid the problems with method A and is already automated. 

I won't dwell on how the automated profile copy is used since it is documented in several Knowledge Base articles:

How to customize the default local user profile when you prepare an image of Windows Vista, Windows Server 2008, Windows XP, or Windows Server 2003
http://support.microsoft.com/?id=959753

How to customize default user profiles in Windows 7
http://support.microsoft.com/?id=973289

However this process does have a drawback.  It does not propagate all settings to Default User and there is no known documentation as to what will and will not be propagated.  It also can be difficult to determine if a setting did not carry over to a new user because it was considered inappropriate (i.e. not copied to Default User by design) or is being reset by Minisetup/Specialize or first logon processes.

One final important point to remember is the difference in behavior between Windows XP/Windows Server 2003 and Windows Vista and higher with respect to when the answer file setting must be present for the automated profile copy to occur.  On Windows XP and Windows Server 2003, if you want to change the behavior of the automated profile copy, the UpdateServerProfileDirectory entry must be present in Sysprep.inf when Sysprep is run.  This is because the profile copy happens when Sysprep is run on Windows XP and Windows Server 2003.  The exact opposite is true for Windows Vista and higher.  The CopyProfile setting must be set to True in the final answer file that is present when the OS restarts after Sysprep (Specialize phase) or the answer file used when Setup is used to deploy the custom image.  This setting does not necessarily have to be present in the answer file used during the image build when Sysprep is run (Generalize phase).  This is because the profile copy for Windows Vista and higher happens only during the Specialize phase.  So if you are using a deployment tool like ConfigMgr or MDT that may modify/replace the Unattend.xml, make sure that CopyProfile is configured in the answer file used for deployment.

C. Targeted changes to the Default User Registry hive and profile folders

I used to use this method in the before the automated profile copy existed.  I can be useful when only a small number of targeted changes are required.  It can be described as follows:

1. Identify the needed Registry changes.  Then use a tool like Reg.exe or KiXtart to load the Default User hive into a temporary location into the Registry, write only the needed settings, and then unload the hive.  The Knowledge Base article "How to run a logon script one time when a new user logs on" (http://support.microsoft.com/?id=284193) shows how to do this manually.  This can be scripted for an unattended installation using Reg.exe as shown in this example (these lines may wrap due to page width):

:: ***** Configure Default User
:: *** Load Default User hive
reg load "hku\Test" "%USERPROFILE%\..\Default User\NTUSER.DAT"
:: *** Disable Desktop Cleanup
reg add "hku\Test\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz" /v NoRun /t REG_DWORD /d 1 /f
:: *** Unload Default User hive
reg unload "hku\Test"

2. Copy only needed files or shortcuts to the Default User profile folder.

This has the advantage that all changes to Default User are known and predictable.  However, this requires that all changes be reduced to "scriptable" items (i.e. Registry or file system changes, no manual configuration). 

To get this method to work properly on various service pack versions of Windows XP or Windows Server 2003 you have to disable the automated profile copy.  In some cases you have to either install the hotfix from this KB article: http://support.microsoft.com/?kbid=887816 or set UpdateServerProfileDirectory=0 in Sysprep.inf.  Which service packs versions have the automated profile copy enabled by default are documented in KB959753.  In Windows Vista and higher the automated profile copy is disabled by default.  You would then do the Default User hive registry edits before Sysprep runs.

This method can also be used to make changes to the Default User profile for machines that are already deployed in production.

You should exercise caution using this method.  Try to keep all changes limited to only the individual Registry or file system changes needed for a particular desired result (e.g., a Windows or application setting).  Do not do wholesale export and import of Registry keys or folder trees.  This can potentially lead to the same problems as a manual profile copy.  You can use a tool like Sysinternals Process Monitor to identify the individual changes.

Implementing Default User Settings by Using Scripts or Group Policy

The following methods are not for configuring the Default user Profile directly.  However, they can be used to achieve the same effect (configuring settings the first time a new user logs on).  And they have the added advantage of potentially being centrally managed.

D. Local logon script in the RunOnce Registry key

This is documented in "How to run a logon script one time when a new user logs on" (http://support.microsoft.com/?id=284193).  This manual process can be scripted with reg.exe.

There are several advantages to using a script in the default user RunOnce key.  It completely avoids Sysprep, CopyProfile, Minisetup/Specialize, or first logon processes effects.  Also, if after deployment the default initial user settings need to changed, only the script file needs to be updated (instead of having to script a load/unload of the default user hive and fixing multiple settings).   Finally, it is easy to "reset" a user's setting to the defaults because the script can be kept up to date and present on every box through software distribution or Computer Startup Scripts.  This method also requires that all changes be reduced to "scriptable" items.

E. Local or Domain GPO logon script

A Group Policy logon script can be used to set "default settings" once by having the script set a flag after it first runs (perhaps an HKCU Registry entry) that it will look for and exit if found on subsequent runs.  A Domain logon script has the added benefit of being centrally managed.  This method also has the same advantages as method D.  This method also requires that all changes be reduced to "scriptable" items.

F. Group Policy Preferences

Group Policy preferences first shipped as part of the Group Policy Management Console (GPMC) in Windows Server 2008.  GP preferences consist of more than 20 Group Policy extensions that expand the range of configurable settings within a Group Policy object (GPO). Many of these extensions can configure settings that are commonly configured as default settings in a desktop image. Unlike policies, GP preferences can be changed by the user in most cases. Also, GP preferences can be configured to "apply once and do not reapply". This allows them to behave exactly like initial default settings configured in an image but has the benefit of being centrally managed and updated.

GP preferences cover many of the areas where default settings are usually configured such as:

• Environment Variables
• Files
• Folders
• INI File Settings
• Registry
• Shortcuts
• ODBC Data Sources
• Folder Options
• Internet Settings
• Local Users and Groups
• Network Options
• Power Options
• Regional Options
• Scheduled Tasks
• Start Menu

The main disadvantages GP preferences are that it requires either Windows Server 2008, Windows Server 2008 R2, the Remote Server Administration Tools (RSAT) update for Windows Vista with Service Pack 1 or higher, or the RSAT update for Windows 7 to manage them and client-side extensions (CSEs) have to be installed for Windows Vista RTM, Windows XP with Service Pack 2, and Windows Server 2003 with Service Pack 1 or higher.  For those still managing Windows 2000 images, you will have to use one of the previous methods mentioned since GP preferences will not work on Windows 2000.

I believe that GP preferences will likely be the best way to manage this going forward. Simply create GPOs using GP preferences, target them as needed, install the CSEs into the image(s) as needed, and you no longer need to worry about configuring these settings in the client image(s).

For information about Group Policy preferences see the following web resources:

Group Policy Preferences Overview

http://www.microsoft.com/downloads/details.aspx?FamilyID=42e30e3f-6f01-4610-9d6e-f6e0fb7a0790

Group Policy Preferences Frequently Asked Questions (FAQ)

http://technet.microsoft.com/en-us/windowsserver/grouppolicy/cc817590.aspx

Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in the Terms of Use.

This post was provided by Michael Murgolo a Senior Consultant with Microsoft Services, U.S. East Region.  This post (and any updates) can also be found on the Deployment Guys blog here.

I have written several posts on this topic before.  However, changes were made to Windows 7 and Windows Server 2008 R2 that warrant a full revisit of this topic.

Now that Windows 7 is available, are you looking for some security baseline recommendations from the experts? Then here’s another timely release from the Microsoft Solution Accelerators team! Today, new security baselines for Windows® 7 and Windows® Internet Explorer® 8 are available for download.

Over the past few months, the Solution Accelerators team collaborated with Microsoft security experts, multiple government agencies worldwide, and a large community of IT security professionals to develop and test these new security baselines.All of these baselines are free for you to use.

In case you are not familiar with all of the security baselines available for Microsoft products, they ship as part of the Security Compliance Management Toolkit (SCMT) Series. The SCMT helps you to plan, deploy, and monitor security baselines for Windows® operating systems, Internet Explorer, and 2007 Microsoft® Office applications. It contains background information about compliance, and planning advice about how to automate security compliance. It also refers you to other tools and guidance that you can use to establish and deploy a security baseline, and then monitor and maintain compliance with your established configuration.

Where do you start?

At a high level, security compliance consists of four basic steps:

1. Plan how to meet security baseline requirements.
2. Deploy security baseline configurations.
3. Monitor security baseline configurations.
4. Remediate security baseline configurations.

The tools, guidance, and recommendations in the SCMT help you through each step of this process and give you the support to make key decisions about security baseline settings for your specific environment.

Here’s what you get:

• Security guide – The toolkits include new and updated security guides for Windows 7, Windows Vista, Windows XP, Windows Server 2008, Windows Server 2003 SP2, Microsoft Office 2007 SP1, and Internet Explorer 8. The guidance provides you with best practices and automated tools to help you plan and deploy your security baselines.
• Attack Surface Reference workbook – A resource that lists the changes introduced as server roles are installed on computers running Windows Server 2003 and Windows Server 2008.
• Security Baseline Settings workbook – A resource that lists all of the prescribed settings for each of the preconfigured security baselines that the guides recommend.
• Security Baseline XML – XML files that allow you to consume the data defined in the security baseline settings workbooks.
• GPOAccelerator tool – A tool that you can use to create all of the Group Policy objects (GPOs) you need to deploy your chosen security configuration. This release also supports creating security configurations on computers not joined to a domain.
• Baseline Compliance Management Overview – The overview discusses best practices on how to monitor security baselines for Windows operating systems, Office applications, and Internet Explorer 8.
• DCM Configuration Pack User Guide – A step-by-step prescriptive user guide about how to use Configurations Packs with the DCM feature in Configuration Manager 2007 R2.
• DCM Configuration Packs – Configuration Packs that provide prescriptive security information, which you can use to check the compliance of systems in your environment.

What should you do next?

• Learn more about the Security Compliance Management Toolkit Series.
• Download the Security Compliance Management Toolkit Series.
• Find other Windows 7 Solution Accelerators here: Windows Desktop Solution Accelerators.
• The Solution Accelerators team is developing a new tool called the Security Compliance Manager. It will help you manage your security and compliance process for the most widely used Microsoft technologies. Join the Beta review program and provide your feedback on the features you want most.
• Get all the step by step guides, whitepapers, how to’s and screen casts on deploying and managing Windows 7 in your environment from the Springboard Series on TechNet.

This post was written by Devrim Iyigun, a Senior Product Manager here in Redmond.

I had a chance to attend Gartner Symposium/ITxpo 2009 last week in Orlando, Florida. For those of you who are at the early stages of deploying Windows 7, looking for some insider information and did not have the opportunity to attend the conference, I have a great resource I would love to share with you.

Gartner Symposium/ITxpo 2009 is one of industry’s largest and most important annual gathering of CIOs and their senior IT leaders. This year’s event focused on how business technology can help customers return to growth by balancing cost optimization and risk mitigation. Microsoft was helping customers to understand how they can realize the benefits of Windows 7. With the general availability date for Windows 7 being October 22nd, this year’s event was quite special for the Microsoft team.

One of the Microsoft –sponsored sessions that took place is Windows 7 Early Adopter Customer Panel. In this highly visible discussion, featured Gartner Research VP & Distinguished Analyst Michael Silver facilitated the panel around Windows 7 planning, deployment and customer experience with Windows 7 Early Adopter Customers: ADP, BMW, Energizer and Pella.

The panel includes discussions about topics of importance for enterprises considering the move to Windows 7 such as application compatibility and deployment goals. ADP, BMW, Energizer and Pella share their perspective on business drivers to adopt Windows 7 and the benefits they expect to achieve with deploying Windows 7. These companies also share their deployment experience and recommendations for companies new to Windows 7 deployment.

This is your chance to get valuable insider information from Microsoft Customer industry leads.  Please click here for a replay of this webcast.

For more enterprise company case studies, information on Windows 7 cost savings or our webcast series just visit our Windows Enterprise site.

For all of your Windows 7 IT pro information, visit the Springboard Series on TechNet. The destination for Windows desktop IT professionals to Discover & Explore, Pilot & Deploy and Manage Windows 7.

Beginning today, 26 October, the Springboard/Microsoft Learning “Get On The Bus” tour will kick off an 11-city European road show that will begin in Milan and end at Tech-Ed Europe in Berlin on 9 November. At each tour stop, you’ll get an exclusive preview of Microsoft Windows 7, Microsoft Windows Server 2008 R2, Microsoft Desktop Optimization Pack (MDOP), Med-V, App-V, and Microsoft Exchange Server 2010. The Career Express tour spotlights new training and certification opportunities that will sharpen your skills on next year’s hottest technologies.

Join us at a stop near you for technical training, professional networking, hands-on experiences, and real world guidance from industry experts.

Where will the bus be? Tour Dates:Milan, 26 Oct | Zurich, 27 Oct | Paris, 28 Oct | London, 29 Oct | Brussels, 30 Oct | Amsterdam, 2 Nov | Frankfurt, 3 Nov | Munich, 4 Nov | Vienna, 5 Nov | Prague, 6 Nov | Berlin, 9 Nov

We even have a web page showing you exactly where the bus is right now.

We have some great Microsoft and community experts presenting on all the topics. I will even be on the tour doing the Windows 7 sessions starting in Amsterdam Nov 2nd. So if you can’t make it to TechEd EMEA this will be one of your best opportunities to meet the experts and see the new technologies from Microsoft live and in person.

For more information on the bus tour visit The Bus Tour or follow the Twitter feed here

Over the past months, my colleagues from the Microsoft Solution Accelerators team have been hard at work to develop the planning and design guidance for DirectAccess. Today, we are pleased to announce the release of the Infrastructure Planning and Design (IPD) Guide for DirectAccess.

In case you’ve been haven’t heard, the new DirectAccess feature in Windows 7 and Windows Server 2008 R2 now gives you the ability to allow remote users to access enterprise shares, websites, and applications without the need to connect to virtual private network (VPN) systems. DirectAccess also gives IT managers like you the ability to update remote PCs anytime they are connected to the Internet, without the user being logged on to the machine.

As you prepare to take advantage of DirectAccess, your first step should be about designing your infrastructure to support this access feature that provides different security options. But how do I know where to start?

This IPD Guide for DirectAccess covers four key steps in the design process for DirectAccess to help you just that.

The IPD Guide for DirectAccess is a member of the Windows 7 Solution Accelerators family that are designed to help you accelerate the planning, deployment and operations of Windows 7 and features such as DirectAccess. Download this guide today and get started!

Next Steps

1. Download the IPD Guide for Direct Access.
2. Download other best practices from the Infrastructure Planning and Design series for products such as Windows Server 2008 R2, Hyper-V, App-V, SQL Server 2008, Exchange Online, SharePoint Online, System Center and much more at the IPD home page on TechNet.
3. Learn how DirectAccess enables remote users to access the corporate network anytime they have an Internet connection, without the extra step of initiating a virtual private networking (VPN) connection. Find out how to use DirectAccess to provide a more secure and flexible corporate network infrastructure in which computers on and off the network can remain healthy, managed, and updated.
4. Visit the Deployment Zone on Springboard to learn more about Direct Access.
5. Check out other Windows 7 Solution Accelerators.

Unless you’ve been hiding in a cave this past year you probably know that today is the official market launch of Windows 7.  While Windows 7 has been available to commercial customers since July, this milestone marks the point where the final release is now available to the general public through retail purchase or preloaded on new PCs.

It has been quite a journey—from the first beta release in January, the Release Candidate (RC) in May through the final RTM in July, IT professionals have played in instrumental role in helping make Windows 7 the best performing, most reliable and most secure Windows operating system ever.  Thank you for all of your feedback, suggestions for improvement, and support during the development process!  If you haven’t downloaded the 90 day evaluation release, you can find it here.

We hope most of you are taking the steps to prepare for adopting Windows 7 into your environment—assessing your hardware, testing your applications, and learning about the new deployment tools.  You can find helpful guidance and resources on the Springboard Series on Technet, including our recent article on the “Five Steps to Application Compatibility Readiness.”  Take a look at the Windows 7 tab, and browse through the “Discover & Explore,” “Pilot & Deploy” and “Management” sections.  In addition, you’ll find great technical drill-downs in the “Top Task” zones down the left-hand side of the site.  Finally, be sure to visit www.talkingaboutwindows.com to hear back stories from the engineers responsible for Windows 7 development, join in the conversation with other IT professionals working to adopt Windows 7, and find local events where you can join your peers and learn more about how Windows 7 can help you streamline client management.

We also understand that as an IT professional, you are often expected to offer voluntary IT services to your friends and family – which can be painful and a little thankless to say the least!  So to help you get ahead of those time consuming requests, we thought we would point out how Windows 7 will help people avoid problems and quickly remedy issues without expert intervention—um, yours to be specific.  Check out this month’s feature article, “Why You Want Friends and Family on Windows 7” for a walk through of the new features and other capabilities will help keep users PCs healthy and productive and make it easier to resolve any issues that arise.  You can find more helpful information about home use of Windows 7 in the “IT Pro at Home” zone.

We want to take a moment and thank all of you who tested the Beta and the Release Candidates. We could not have made this great product without you. We also hope that you’ll join in the community

Thank you

Stephen Rose – Sr Community Manager

Thank you again for all of you who tuned in live for our most recent virtual roundtable. We had so many questions asked during the broadcast, we were unable to get to all of them so I am dedicating this blog post to the questions and to the answers provided by our product teams involved in the broadcast.

To view all the questions and answers, click here.

For more information and resources on application compatibility with Windows 7, please visit our page on TechNet here.

Did our VRT wrap-up post wet your appetite for more? Looking to learn about virtualization as a application compatibility tool? No need to worry if you missed the live event as the is now available to stream or download here.

Windows 7 Application Compatibility Part 2: Virtualization

In part two of this Springboard Series Virtual Roundtable on Windows 7 Application Compatibility, you'll hear from Microsoft Technical Fellow Mark Russinovich and a panel of experts on how virtualization tools can help you with application compatibility concerns whether you're migrating from Windows Vista or Windows XP.

 
Here’s your chance to get powerful insight into how presentation virtualization, desktop virtualization and application virtualization can reduce testing times, expedite deployment, and ultimately help you streamline PC management. Also covered are the latest desktop virtualization technologies from Microsoft including Microsoft Application Virtualization (App-V), Microsoft Enterprise Desktop Virtualization (MED-V), and Windows XP Mode for Windows 7.

To see part one of this Virtual Roundtable or to view any of our previous roundtables, click here.

As always, visit the Springboard Series for the latest tools, walkthroughs, FAQs and information for IT pros around Windows 7 and visit our Talking About Windows Event Portal to see all the latest IT pro events worldwide on Windows 7 and Server 2008 R2 in your area. More events are being added every day!