Managing Profiles 2

[sturm26]

I'm working with a PS 4.0 farm and need to find a way to limit profile size for the local profiles that use the published apps. The farm is using Win 2k3 servers in an AD environment. I know I can use AD to define where the profiles are being created with the Terminal Server Profile tab, but I want to actually limit the size of the profile.

I can't have the profiles be erased after log out, as a new app we'll be bringing on in the near future will require a license file to stay in the profile. If the profile is deleted, it uses another license up.

Any suggestions?

 

[patrickrouse]

You can limit the profile size via Group Policy -> uSER Configuration -> Administrative Templates -> System -> User Profiles -> Limit Profile Size.

You'll want to apply this to an OU that contains only the Terminal Servers, not user accounts, then enable loopback policy processing with the repllace option. On the policy security, enable apply policy for the groups of users that you want the policy to affect, and deny apply policy for administrators wo you want exempt from the policy.

http://www.sessioncomputing.com/security.htm

Patrick Rouse
Microsoft MVP - Terminal Server

http://www.sessioncomputing.com

 

[nanor9909]

Also, if you're limiting the profile size, you may want to use folder redirection to redirect profile hogs (like temporary internet files etc)out of the profile. Also, things like MyDocs can be redirected off to a network location, which can be backed up and virus scanned separately from the TS.

If you are only using the profile to contain this license file, and dont really need it to contain 'normal' profile information, you can use something like a flex profile - basically a hybrid of a mandatory profile with some redirected folders - Faster logons and fewer corrupt profiles. Have a look at

http://www.brianmadden.com/content/content.asp?id=315

 

[patrickrouse]

Also, you should always force the IE Temp File to a small size like 5MB, and force them to empty when the browser is closed. Both of these options are available via GPO.

Patrick Rouse
Microsoft MVP - Terminal Server

http://www.sessioncomputing.com

 

[sturm26]

Thank you all for the insight. I appreciate the assistance. Going to check these out now.

 

[NickSoefje]

Have you considered roaming profiles? I don't think I could tell if you are.
If not, I would look to go that direction...

Also, in 2003 server, you can set the profile or roaming profile in the local machine policy. Whatever is set in the GPO or local machine policy will override what is configured in the users account settings.

As suggested by Patrick, you can use this policy setting to limit the profile size, but in my experience this will not actually limit the profile size... the profile will grow during the users session and if it grows beyond the limit you set, the users will not be able to logoff until they delete files from the profile.

Depending on the number and type of applications you are using, you can typically make app changes or create scripts to control the size. Lotus Notes and SAP are great examples of these type of applications. I have found simple settings in the last few revs of Lotus Notes that allowed me to save around 15-20MB from the users roaming profiles. I currently have around 6,500 roaming profiles on a file server and they range from 18-43MB each.... I have a limit set at 50MB.

I constantly battle this since I run apps like Notes, AutoCad, VisView, Team Center Eng and many others.

Hope this helps.

"Whether you think that you can, or that you can't, you are usually right."
- Henry Ford

Nick Soefje

 

[KRPGroup]

patrickrouse

On the policy security, enable apply policy for the groups of users that you want the policy to affect, and deny apply policy for administrators wo you want exempt from the policy.

I see the GPO setting for the profile size but where do I find security setting to deny to selected staff.