In this blog post I’m trying to explain how-to create a mandatory profile for Server 2012 and Windows 8. This is only for a clean windows installation. The Microsoft best practices are saying that you need to update the Mandatory profile after each software installation/update on the system.

The Test User

First we create a user named: Manny. This user is used to create the profile. You can name it any way you want. Don’t give it any profile. You can create a local user, but my test machine is also a domain controller, so I only can create an AD user.

Update2: (On top of this post, just for your convenience)

There is a much easier way

1. Open an elevated command prompt on Windows 7
2. Open Diskpart
3. List volume (remember the volume number of the usb stick)
4. Select volume # (3 = the number of the usb stick)
5. Clean (This will wipe the USB stick)
6. Create partition primary
7. Select partition 1
8. Format fs=fat32 quick
9. Assign
10. Active
11. Leave Diskpart
12. Copy the installation DVD on the usb stick
13. Happy installing

---

In this tutorial I explain how to create a bootable USB stick for installing Windows 2008/2008 R2/Vista/windows 7. First, format the stick. Fat32/ntfs doesn’t matter. (Remember that fat32 doesn’t support files larger then 4GB)

On the Windows 7 / Server 2008 install media in the folder "Boot” there is an executable named: Bootsect.exe

Open a command prompt, navigate to the directory boot (on the media).
And run: Bootsect.exe /nt60 F: (where f: is the formatted USB stick)

Now, copy the installer media to the USB stick. Or, in my case, the Task Sequence Bootable Media. (SCCM 2007)

Your, bootable media is ready.

Update:

Q: Hey Jeroen, bootsect.exe doesn’t work.. I’m getting an access denied.

A: Run you command prompt in elevated mode

When installing a new server/workstation with Server 2008 R2 or Windows 7. I’m having a strange problem.

For instance, my D partition on my laptop (which runs Windows 7) has default the built in USERS group with right to read the partition. Oké lets remove those rights. Now the partition has only Administrators and System with Full Control. But when opening the partition we are getting a Access Denied warning .

How is that possible? Well, the explorer process is still running in ‘User’ mode. When opening the explorer in ‘Admin’ mode we still getting the Access Denied warning.

Why? Well, actually the explorer isn’t started in elevated mode. But only the first process. That triggers a DCOM to open the Explorer, witch runs in ‘User’ mode

How do we disable that? First open regedit en navigate to: HKEY_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E0207520C2}

Rename the RunAs to something else, like: _RunAs (Become owner first )

And now it’s possible to open the explorer in elevated mode. And it’s possible to set the correct permissions without adding your own account first.