How create an mandatory profile?

A mandatory profile is a read-only profile. If you want to create a profile that does not save all changes the user makes, you will have to create a mandatory profile.

1. Log in with an account that has Administrator rights;
2. Create a folder on the hard drive where the mandatory profile should be placed. For example C:\Profiles;
3. Share the folder by right-clicking on the folder and then pressing Properties;
4. Go to the Share tab;
5. Press the Share button;
6. Type in Everyone and then click Add;
7. Click on the right at Permission level and click on Read and change it to Read/Write;
8. Click Share;
9. Copy the path (\\computer1\Profiles) that you then get, you will need this later;
10. Click Done;
11. Launch Local Users and Groups console (lusrmgr.msc);
12. Create a new account;
13. Find the user and double-click on the user;
14. Go to the Profile tab;
15. Under Profile path, enter the path of the mandatory profile (see no. 9);
16. Click Save and close the window;
17. Log out and log in as the user you just created;
18. Make the adjustments you would like to have in the mandatory profile and log out;
19. Log in again as Administrator;

Now rights need to be set on the folder and subfolders. In addition, the user must also have registry hive rights.

The mandatory profile folder with subfolders must have the following rights:

1. ALL APPLICATION PACKAGES – Full Control (Start Menu does not work properly without these rights);
2. Authenticated Users – Read and Execute;
3. SYSTEM – Full Control;
4. Administrators – Full Control.

The same permissions must be assigned to the user registry hive by loading ntuser.dat profile file using File -> Load Hive in regedit.exe.
Daarna File -> Unload Hive

Then log in

Then rename NTUSER.dat into NTUSER.man in the the user profile folder.