Updating Mandatory Profiles

[UPDATE 17/01/2012 – The process detailed in this post has been simplied in the Updating Mandatory Profiles Part 2 post]

In a RES Workspace Manager environment it’s is typical (although not required) to store Mandatory profiles within the RES Workspace Manager Custom Resources. By doing this, we remove any reliance on the network, avoid the typical profile error messages when logging on to laptops offline and reduce the network load on RDS/XenApp servers. Every once in a while there will be the need to update the NTUSER.MAN file with additional settings, e.g. the ActiveSetup keys when software is added to the RDS/XenApp servers.

In this example we will update the Mandatory profile with the ActiveSetup keys from our desktop image. We accomplish this by logging on to the desktop with our standard Mandatory profile (the Workspace Composer should not active at this point!). All being well, the ActiveSetup components should run on log in, populating the ActiveSetup registry keys.

After ActiveSetup has run we can launch REGEDIT from within the user session and export the required key(s) to a .REG file that we can import into the Mandatory profile later. To do this, navigate to HKCU\Software\Microsoft\ActiveSetup\InstalledComponents registry key and export to a .REG file.


In our example I’ve saved the file as ActiveSetup.REG. If we edit this file with Notepad we can see all the references point to HKEY_CURRENT_USER. Before we load the NTUSER.MAN registry hive, we need replace the HKEY_CURRENT_USER references with the hive name that we will mount it as with in REGEDIT. In our example, we’ll replace all references with HKEY_USERS\MANDATORY using Notepad’s “Find & Replace” functionality.


Once updated, we can save the ActiveSetup.REG file and launch REGEDIT once again. The Mandatory profile NTUSER.MAN hive can be loaded by clicking the HKEY_USERS hive and then clicking the File > Load Hive menu option.


Navigate to the Mandatory profile NTUSER.MAN file and when prompted for the Key Name we need to enter the same key we used in the File and Replace option earlier. In our instance, this needs to be MANDATORY, hence the HKEY_USERS\MANDATORY reference.


Once the hive is loaded we can import our modified ActiveSetup.REG file into the NTUSER.MAN hive. Once the import is complete you can confirm that the settings have been imported into the correct location:


Be sure to unload the registry hive by clicking the HKEY_USERS\MANDATORY key and then clicking File > Unload Hive. When prompted to save the changes make sure to click Yes. When you log off and back on again the ActiveSetup components should not run again. Note: if you install additional software on to the desktop image and it utilises ActiveSetup, you will need to perform this process again (unless you utilise the RES Workspace Manager “Disable Active Setup (skips first-time shell init)” option).

Good luck! Iain


  1. Anthony Ide on April 20, 2011 at 14:15


    nice post but one question: do you need to rename the ntuser.man to ntuser.dat to import ActiveSetup.REG?
    If not the mandatory profile is read-only. Or am I wrong here.


  2. iainbrighton on April 21, 2011 at 10:12

    Hi Anthony,

    No you don’t need to rename the file back to .DAT to update with changes. It’s read-only by the fact that Windows will not save changes back the .MAN file when a user logs off, the file attributes are not set so it is a read-only file.

    Regards, Iain

  3. Anthony Ide on June 9, 2011 at 18:08

    So if I understand correct, it is best to create a mandatory profile on a server which has all software installed. I always create a mandatory profile on a “clean” server that has not installed the software

  4. Iain Brighton on June 9, 2011 at 21:54

    I always recommend a clean profile, i.e. the default NTUSER.DAT as a starting point. Use the process in this post to update the profile with any changes you need. This example uses the Active Setup keys as this is probably the most frequent update required to a mandatory profile, e.g. getting rid of the “setting up of Windows components” window every time a user logs on with a mandatory profile.

    The Virtual Engine Toolkit release in a few weeks will include a new tool to do all this for you.. Keep your eyes pealed!


  5. Anthony Ide on June 9, 2011 at 23:55

    Thanks for your answer.
    when I Disable Active Setup through res powerfuse I still get “setting up windows components” each time I log on which my mandatory profile. How come?


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.