Is there a trick to getting Windows 7 to use the Guests group function correctly? I know how to set it up in Windows XP, I have several hundred XP desktops with Domain Guest accounts working perfectly. But I can’t get the Guests function to work correctly under Windows 7. I create a Domain Account with a roaming profile. Setup the defaults for that profile; make it a member of the Domain Guests group, and make Domain Guests group a member of the Local Guests group on each PC. In windows XP this results in a public account that can be used on any pc but whose settings never get saved to the server. That way the account is kept clean for all guest users. However in Windows 7 even though the profile has a status of temporary in the User Profiles settings page every logoff gets saved; which is exactly what is not supposed to happen with Guest accounts. Any suggestions would be appreciated, Jim

Hi, Thanks for the post. Based on my expirience, the Guests always use a temporary profile which will be deleted upon logging off. In this case, I assume that the Guests account you create are also located in the Users group, so this happened. Please check this again. If you want this kind of user to use a same profile enviroment, you may consider useing Mandatory User Profile. please refer to the following article. http://technet.microsoft.com/en-us/library/cc786301(WS.10).aspx Juke Chou TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”

Thanks for the suggestion Juke, I’m not sure your understanding is completely correct in a domain profile environment. The current XP accounts are Domain Guests and Domain Users, but I have several hundred Windows XP SP3 PCs running in this manner. At every shutdown they do not copy the profile to the server and they do delete their local profile copy. At every boot up they copy a template account located on a file server to the local pc and use that as their local profile cache. Windows 7 does not do this. Windows 7 also does not honor the Group Policy that instructs the account not to save desktop changes to the server copy. It does not even revert to the default local PC profile. Windows 7 completely ignores domain users who are Domain Guests and treats them as a Doman User. In addition the Windows 7 Domain joining process no longer adds the Domain Guests group to the local guests group. This is published behavior that Windows 7 is not following. What use would a Guest account be for an enterprise if there was no way to standardize that profile for users? The user's desktop and settings would vary widely for every different computer that the user logged on to. Currently with XP when I need to make a change to a profile I log on as an account that shares the profile but is not a Domain Guest, make my changes and logoff again. The changes are copied to the server and automatically used by every PC in the enterprise. I have many different Guest profile sets that I manage this way. Requests by managers to make changes to department guests can be easily and quickly fulfilled by jr IT staff or even power users. I am very familiar with the mandatory profiles option that you suggest. And I had used them frequently in the past before using the Domain Gusts group. Aside from being more difficult and time consuming to manage, the real problem here is that Microsoft has depreciated the ability to copy profiles on Windows 7. In the past I could create a fully usable profile and copy it to a network location and change it to mandatory. But that can no longer be done. The only profile that can be copied anywhere is the local default PC profile. And there is no way to customize that profile or overwrite it. The only supported Windows 7 method requires scripting a sysprep process which takes a ridiculous amount of time just to make even a single change. Sysprep is also now restricted to run only 3 times before you have to completely reimage the pc to a state before the third sysprep. All these changes make use of mandatory profiles under Windows 7 very difficult if possible at all. I would be very interested in your suggestions for a function method to manage Guest use profiles in an efficient way. Thank you, Jim

Hi, Thanks for your feedback. I would like to advise that you can use skiprearm option if the sysprep command will be run several times on a computer. You can access the following link regarding customizing default profile. http://support.microsoft.com/kb/973289 Juke Chou TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”

I did not know about skiprearm I will have to take a closer look, Thanks. Also thank you for that link. It does a good job of consolidating everything that is needed for mandatory profiles to work. It also illustrates my need to make the Domain Guest account work correctly. This is 6o minuet 37 step process needed for every profile. Additionally the process can no longer be delegated to a junior technician due to its technical and security requirements. If we can get I can get the Domain Guest to work the way it has in the past and the way it is published to the same process will be a 3 step 5 min process. I really don’t mean to be difficult, but I have 50+ unique mandatory profiles across my user base with one or two change requests a week. Windows XP can handle this without a second thought. I don’t believe that it is realistic to believe that http://support.microsoft.com/kb/973289 will scale to that environment. Actually the education space is having a really difficult time with this. Check some of the other forums. There are thousands of complaints from the higher education space regarding this; and it has become a stopping point for hundreds of Windows 7 projects across the education market. Everyone I communicate with that is rolling out Windows 7 in large campuses is using unsupported hacks to make the profile copy process work like it did in Windows XP. If I can get Domain Guests to behave as I think it is suppose to I think I can bypass that entire problem. Thanks, Jim

Hi, Only one Mandatory profile is enough If you want all the guest users to use the same manadatory profile. Juke Chou TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, How's going? Please feel free to give us any update. Juke Chou TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Sorry Juke, I was pulled into another project for a few days. I appreciate your trying to help me with a solution here even if it is different than Guests. I am very familiar with mandatory profiles. We used them for many years going back to Windows 98. I don’t want to get too drawn off topic here about making Domain Guests work, but let me explain the nuances here as I understand them to give a my understanding. I have over 50 different active profile sets in service for different business units and departments and dozens of people who currently make changes. Managing the permissions to grant each set of users’ access to the correct set of mandatory profiles is not an easily scalable solution, not to mention the training of low level staff to lock and unlock profiles. We did it this way for years. We have looked at biting the bullet and going back to it, but Windows 7 breaks it and here is why. While great if not wildly underutilized the biggest weakness of mandatorily profiles that that they are not manageable in a live environment. If you follow the full process you will see what I mean. To make a change you have to make the account standard roaming. Make your changes and re-lock the account. That could take a few minutes to a few hours. If you are sharing that profile with other stations; which you probably are doing if you are using mandatory profiles in the first place, and one someone else logs on while the account is temporarily roaming; they now have an unlocked profile. When they log off; if they log off after you, their roaming version of the profile will overwrite your mandatory version on the server. Now everyone else who uses the profile will now also be unlocked roaming. In a lab with 40-80 computers per profile the likelihood that someone will reboot a computer every 30 min is pretty high, and your entire mandatory infrastructure is broken. The only way to recover is to somehow find every active computer using that profile, and disable it untill you can correct the network mandatory profile. If you miss just one you have to start all over again. To service department change requests in a real world mandatory environment and avoid this there is a solution. You need to create a second offline profile for every in use profile. You then have to copy the active profile to the offline profile, unlock the offline profile, make changes to the offline profile, and finally re-lock the offline profile. Then either distribute the new profile username and password to everyone who needs it which is near impossible and very time consuming or copy the new updated profile back ontop of the network location of the in-use profile. It’s not fun and is a time waster but was largely workable. BUT... How can you do that in windows 7. The copy profile feature has been removed. To the best of my knowledge it looks like Microsoft has depreciated one feature inadvertently crippling another. I think you can see the problem here. While I love Mandatory profiles and has used them frequently in the past; without the ability to copy them around they really are not usable in a live environment, which brings us back to the Domain Guest function. It largely accomplishes a similar function as mandatory profiles when it is working. But I cannot seem make it work in Windows 7. Again any guidance would be greatly appreciated.

Hi, I understand what kind of situation you encounter. But I am wondering that the copy profile feature has not been removed from Windows 7. Please refer to the steps below to check it. 1. Open System Properties. 2. Click Advanced System Settings. 3. Hit Advanced tab, then click Settings under User Profiles. 4. Please select the profile which you want to copy=>then copy the profile to a shared folder and change the permission. Regarding the Guests, you may also try to remove the user from User Group in the Domain and add this user into local Guests Group. This will make the account always create a temporary profile. Juke Chou TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I'll try both and let you know, Thanks.

Hi, How's going? Juke Chou TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, Thanks for posting in Microsoft TechNet forums. As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as ‘Answered’ as the previous steps should be helpful for many similar scenarios. If the issue still persists, please feel free to reply this post directly so we will be notified to follow it up. You can also choose to unmark the answer as you wish. BTW, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems. Thanks for your understanding and efforts. Best Regards Juke Chou TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thanks Juke, I am on another project right now but I did get time to test last night. What version of window 7 are you using? While the copy to button for profiles is there it is disabled for all profiles except Default Profile on every Win 7 version I have used. From the numerous forum complaints I assume it is missing from most other's also. Also there was no change with the Guests situation. Adding the domain user directly into the local Guests group had no difference; Windows 7 still treated the account as a standard roaming profile. Thanks, Jim

Hi, You should remove the user from Domain User group first. Then add this user into local Guests group. Regarding copy to button, please access the following link for the workaround. http://social.technet.microsoft.com/Forums/en-US/w7itprogeneral/thread/5a5d44b6-116a-4a21-bc64-53379218ecc6/ There is no document to indicate why the copy to button is disabled by default. But you can still copy the user profile to another location via some methods. Best Regards Juke Chou TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”

Hi, Have you tested this? Please feel free to give us any update. Best Regards Juke Chou TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, I will mark this thread because of this thread that has been quiet for a while, If the issue still persists, please feel free to reply this post directly so we will be notified to follow it up. You can also choose to unmark the answer as you wish. Best Regards Juke Chou TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Sorry Juke, I am ballancing several projects right now and only have a day or two a week to test this on right now. I will try your suggestions and let you know in the next day or two.