Friday, September 10, 2010

Changing the Default Profile on Windows 7

It has become increasingly obvious to us in recent months that people are downloading and installing our User Profile Manager software just in order to use the “Set As Default Profile” feature on Windows 7. Presumably they are then uninstalling the software again afterwards…

The problem is that Windows 7 has greyed out the “Copy To…” feature in the “User Profiles” dialog box that admins have used for years to set up a default profile for users logging onto a Windows workstation.

Why Microsoft have done this is not altogether clear. Responses on the Microsoft’s support forums say things like “There were many issues with it in the prior OSes, even though those issues were not always apparent…” (Mmm… the old invisible problem problem) and that this is “due to the User Account Control (UAC) and other security settings of the user account…” - which doesn’t really ring true either. I suspect that the problem is more to do with the profile folder structure and its reliance on junction points which cannot simply be copied over. But whether this is the case or not, why didn’t Microsoft just fix it? The most likely answer to that is that they just didn’t think it was important enough to spend any time on – which betrays a certain disconnect between Microsoft and those tasked with installing Windows on company machines around the globe.

However, installing User Profile Manager just to set the default profile is like going to a movie just to eat the popcorn. So what we’ve done is to take the "set default profile" code out of User Profile Manager and put it is a small command line utility – DefProf – that you can download for free.

How does it work?
DefProf does not simply delete the old “Default” profile folder and copy over a profile that you specify. Instead it keeps the existing Default profile in place and empties it; this preserves the folder structure with all junctions points and folder security settings. DefProf then copies over the files and settings from another profile that you specify. Additionally, DefProf loads the registry for the specified profile and cleans it up so that any user specific settings (that we know about) are removed.

It is worth emphasizing here that DefProf uses the existing folder structure. This means that if you have already messed up the Default user profile folder, DefProf won't fix it.

Using DefProf
Using DefProf is very easy. Firstly you setup a profile to the way you want just like you always do. Say you create a ‘Setup’ account to do this, and Windows creates a C:\Users\Setup profile folder when you logon. When you’re done making the profile look the way you want, you open a Command Prompt as an Administrator and just type the folder name:

c:\>Defprof setup

That’s it!

We’ve done our testing, and DefProf seems to be working fine on Windows 7, 32 and 64-bit, and in a variety of languages. However, if you think we have missed anything please post a comment on the Forum and we'll do our best to fix it.

You can download DefProf here.

Labels: ,


Anonymous Anonymous said...

Hi, I just used the DefProf with Win 7 Ultimate 32bit and it worked fine except that the desktop gadgets in the source profile didn't open in the target?

Any ideas?


10:06 AM  
Anonymous Anonymous said...

It doesn't work for me; I know i'm not doing something right. Say I have an existing profile that I've been using called Mike located at C:\Users\Mike that I want to copy to make a new profile for Susan to use. How would I make this applet do this and what would be the syntax? I put the executable in C:\Temp and added this to the Enviornmental Variables. Thanks.

12:17 AM  
Blogger David Rowe said...

DefProf modifies the default Windows profile so that anyone logging onto the machine for the first time gets a new profile based on the documents and settings of the user profile you specify. If, in your example, Susan has already logged onto the machine, or you want Susan to have a copy of Mike's profile, you should look at our User Profile Manager software.

Please use the ForensiT Support forum to raise any issues with DefProf.

4:10 PM  
Anonymous Anonymous said...

For windows 8 this works like a charm, thank god I found you guys. BUT.. (always a but isnt there) I cant seem to copy over all the "pinned" windows 8 tiles that I have on my default. It only seems to have a few tiles for a new user and thats all.

Any advice?
At first I thought it might be under windows\winstor but I gave "everyone" permissions to that folder and still nothing.

7:58 PM  
Anonymous Anonymous said...

Any tips on what's going on when DefProf fails to save the Chrome default home page from the template user created to customize the default profile for a lab full of computers? AFAIKT, it's the only setting that isn't being transferred.

10:28 PM  
Anonymous Anonymous said...

Same issue with me, everything's fine, just the Windows 8 Start Menu doesn't copy over.

11:34 AM  
Anonymous Anonymous said...

Hi, just to check if let's say the "setup" account happens to be a local admin and I use this method to make it the default profile for new users to copy, does that mean that the users will inherit admin rights as well?


5:35 AM  
Anonymous Anonymous said...

I just ran DefProf on Win7 Ultimate, 32bit. It work great..... Except, the IE11 Compatibility View list is not maintained in the newly created profile. Future enhancement?

3:51 PM  
Blogger Unknown said...

downloaded Defprof and extracted.
From command prompt as admin ran the command c:\>Defprof setup
Receive: 'defprof' is not recognized as an internal or externa command, operable program or batch file.

Win 8 or 8.1 same result

If I change directory to Defprof then Defprof setup, it returns this:
Defprof v1.7 - Set Default PROFILE
Copyright 2010-2013 Forenst Limited Forensit

The system cannot find the path specified

9:37 PM  
Anonymous Anonymous said...

Is there a way to reverse what DefProf does and go back to using the Default profile as the default profile?

7:14 PM  
Anonymous said...

It works great but does not actually copy over the entire profile. My profile is 125Mb but after running this the Default profile is only 3Mb. I really need a way to copy the whole profile over and still have my Tiles working. Would love to chat with you or another solution.

8:02 PM  
Blogger Tal Aloni said...

Thanks a lot! Great Tool!

9:12 AM  
Anonymous Anonymous said...

I am using defprof on a daily basis preparing images for future deployment with ghost/acronis, for years already.

I love it, love it, love it.

Are there problems? Yes. Not with defprof. I have never had any errors if I am doing everything properly:

-work with virgin defprof account
-run defprof as local admin
-run defrof after reboot
-run defprof without ever logging back into the source account after this reboot!

What does this mean?

-setup windows, give windows username "owner" to use so it creates the stupid admin account microsoft likes so much.
-enable local admin (built in account)
-set up buil-in admin account as you would want user account to be setup.
-log in to owner
-place defprof in root of c:
-run cmd as admin (yes, I know)
-browse in cmd to root of c:
defprof administrator
-login to administrator
-delete owner if you like, or keep, don't matter.

It works for me on XP awesomely.

On W7, not so much. Not fault of defprof! This is because microsoft has made the maximum effort to prevent administrators from pre-tuning windows for other users.

Why? Because sysadmins rip off all the stupid things microsoft leaves in the system, but those things are exactly what makes windows fail. And if it doesn't fail, then there will not be any need to buy new and updated next operating system.

So, microsoft goes out of their skin to make sure sysadmin fails, and every user sees and clicks on every stupid welcome message, every baloon, every malware and bloatware install shortcut, etc.

Windows 7 uses "advertized shortcuts". These things exist for two obvious purposes:
1- ensure the user cannot keep their software working, because clicking on those re-runs setup and erases user modifications (like renamed, replaced files, patched dlls, etc).
2-make underpowered hardware appear fast in the store and few days after purchase (bloatware is not installed, but appear installed) therefore you are seeing the system operating in top third of hard drive spin speed, not where you will be after you click on those shortcuts at home.

These adv.shortcuts are made in a way that purposefully prevent copying. This is why on W7, typically the start menu will not be copied correctly. Don't create any shortcuts, dont pin anything before defprof. After defprof, do some of this work, but use regular shortcuts.

2:28 AM  
Blogger KASD said...

This is a great tool! We run this tool on a lot of machines at the same time along with a page full of other instructions prior to and following the execution of this tool. Is there a way to display a large alert if the copy profile process fails? We have missed some failed installations and I'm trying to be able to identify them easier.

5:56 PM  
Blogger KASD said...

This is a great tool! We use it on a lot of machines running updates at the same time. We have a list of steps that we perform before and after running the defprof tool. During the copy process of the profile, is there a way to display an eye catching alert if the process fails the copy? We had a group of computers that we did not catch the failed copy attempt when we ran the tool.
Thank you!

6:01 PM  
Blogger oliver-osmers said...

I tied to run this tool DefProf v1.11, but always an error occurs. It takes so much time. Access denied. Error 5. This occurs with Windows 10 Pro (10.0.10240) logged in as local administrator.

10:43 AM  
Blogger Chooch said...

Oliver, make sure you are not logged in as the account you are trying to copy. I got error 5 when I forgot to use a different account from the one I was trying to copy as the default. Also make sure when you call up cmd, you right click and run it as an administrator. Just being logged in as the local admin and running cmd will not guarantee it is being run as an admin, you have to right click and specify.

4:47 PM  
Anonymous Greg said...

I did what Chooch suggests and still get "Cannot copy C:\Users\newuser\AppData\Roaming\Microsoft\Windows\Start Menu. Error 5
Access is denied." Rebooted the pc after changing "newuser". I'm running cmd as admin.

3:54 PM  
Anonymous Joe said...

Defprof is wonderful. Currently using on business usage especially for Windows 10 where there are tons of unwanted Apps and need to remove .
In the Organisation where deploying workstation is wonderful.
Just wondering is it not allow to use it for business purposes?

9:50 AM  
Anonymous Support said...

DefProf is Freeware. You are welcome to use it for business purposes. There are no restrictions.

10:29 AM  
Blogger David Hoyt said...

Wonderful, Fantastic tool...
Truly wish this tool would have an optional upgrade to purchase to use for RDP services on windows servers. I do use it, BUT not without ramifications. I needed to disable many services such as CDPSvc, CDPUserSvc, OneSyncSvc, PimIndexMaintenanceSvc, UniStoreSvc, UserDataSvc, and WpnService. Depending on what the end users are doing I found no need for these services. If they are running, the Defprof will generate duplicated Services on each login creating an instant overload on a server setup for RDP (Terminal Server Access). With these disabled, the server are very fast.

4:35 PM  
Blogger Thomas Goodman said...

I've run this on Server 2016 without issue. Anyone run this on Server 2019 yet?

10:01 PM  
Blogger Mark said...

I noticed, when I use DefProf with Windows 10, the first logon animation (Windows says 'Hi') doesnt appear anymore. Not even if I manually add a EnableFirstLogonAnimation=0x000000001 key in the ntuser.dat of the new default profile. Is there any possibility to turn EnableFirstLogonAnimation on again?

3:27 PM  

Post a Comment

<< Home