Outlook Messaging Profiles with Mandatory Profiles on WinDD

Microsoft's Windows NT Server 4.0 Terminal Server Edition platform has created quite a stir. Terminal Server is a combination of thin-client-based technology and NT. This technology isn't new. An earlier application of thin-client-based technology is Tektronix' WinDD Server. WinDD—based on Citrix' WinFrame 1.7, a hybrid of NT 3.51—lets UNIX workstation, PC, Macintosh, and other users run NT programs installed on a centralized WinDD server. The thin-client approach offers several advantages, including reduced hardware costs, office infrastructure requirements, and support. In addition, it provides excellent service for low-bandwidth connections and can extend the life of legacy PCs. (For more information about thin-client technology, see "Related Articles in Windows NT Magazine.")

To control the corporate desktop, many WinDD administrators are using mandatory user profiles. (For more information about profiles, see see "Related Articles in Windows NT Magazine.") Mandatory user profiles let you tightly control the look and feel of the desktop over the NT environment and limit what users can access and do. For example, you can restrict the use of screen savers; animated cursors; File, Run commands; and the Office Assistant, because their performance overhead becomes unacceptable in a multiuser system. Mandatory user profiles help reduce troubleshooting and administration costs because users can't easily make undesirable configuration changes, such as inefficient software installs. Surprisingly, users don't usually resist mandatory profiles. Many users appreciate the performance benefits of having servers protected from unauthorized activity.

Although mandatory user profiles can be advantageous, they can also cause problems, especially in a WinDD environment. For example, our large organization recently began migrating to Microsoft Outlook and Microsoft Exchange. When we tested the Outlook client in the WinDD environment, problems started to occur. Outlook stores individual messaging profile information (e.g., mailbox and Exchange server names) in users' individual user profile. This storage method is fine for regular NT users but presents a problem if you want to use WinDD with mandatory user profiles. Mandatory user profiles are read-only; therefore, when users log out of WinDD, they lose any dynamic changes they've made to the Outlook messaging protocol. The only solution to this problem is to develop a way to separate the Outlook user profiles from the mandatory profiles while retaining mandatory user profiles over the WinDD environment.

At first, we thought we would have to remove mandatory user profiles and go back to using roaming personal user profiles. However, we found that with some changes to the current WinDD environment, we could configure a solution: We can keep the current shared mandatory user profiles but create Outlook profiles on the fly each time a user logs on. This scheme lets us separate the Outlook features, including individual views and print settings, from the mandatory profile features.

The following explanation assumes that you have a working knowledge of distributed Windows administration and NT Server 3.51. The principles we describe apply to Terminal Server with the NT 4.0 interface, but we haven't tested this configuration.

Outlook Installation
Before you install Outlook on a WinDD 3.5 server, load the standard Workstation versions of Microsoft Office 97 and Microsoft Internet Explorer (IE) 3.02. (We haven't tested IE 4 and Outlook 98.) Before you install Outlook 8.03 from the Exchange CD-ROM, use File Manager (in Terminal Server, use NT Explorer) and be sure that the local administrator has at least Change access permission on Microsoft OfficeTemplates on your WinDD server, as you see in Screen 1. In a multiuser environment, making the Microsoft OfficeTemplates folder read-only prevents the spread of macro viruses. However, the Outlook installation needs to create Microsoft OfficeTemplates files, so the administrator needs permission to access the templates.

Configure Outlook to make file and Registry changes. To create separate Outlook files for users, you need to modify the Registry. However, first you need to set up Outlook to make these changes.

Enter Registry changes. You must change the Outlook section of the Registry to set up Outlook log files and preferences files for Favorites, Views, and Print Settings and to prevent the default Welcome to Microsoft Outlook message from appearing every time a user logs on to WinDD and runs Outlook.

If the setting isn't holding, reenter this key.

Clean Up Files
To complete the Outlook installation with the modified profiles, you need to clean up several files. On the WinDD server, delete

office welcome.msg 

to avoid the welcome messages and sample tasks each time a user logs on to Outlook. Delete

c:winddoutlook.prf

because you are providing users with their own .prf profile. Change the permissions on

c:winddformsfrmcache.dat

to give Change access to Everyone. Otherwise, you'll have problems opening attachments. Edit the Outlook program item to make the working directory blank. This action will point Outlook to the user's WinDD folder windows if it wants a working directory.

User Setup
To put the profile changes into effect, you need to make three changes to the user setup. First, you need to edit the Registry to make the First-Run change for each mandatory profile. Run regedt32 against each of the mandatory profiles at the subtree

HKEY_CURRENT_USERSoftware MicrosoftOffice8.0Outlook

as you did during the Outlook installation. Second, all users must have a default.prf file in their windows folder. This file is the standard .prf file that the Outlook installation creates, with the changes that Listing 1 shows. The commands change the profile name, home server, mailbox name, and path to the Personal Address Book (PAB). Finally, call a batch file (e.g., startup.bat) from the Startup group in all the mandatory profiles to execute the following commands at logon. (This post-logon batch file is the most convenient method because this method doesn't use Domain Admin access. Domain Admin access would let you use the logon batch file—domain logon script—directly.) Run the Microsoft NEWPROF utility (available on the Exchange CD-ROM) to create a profile on the fly from the default.prf you created. As Screen 6 shows, make a direct patch to this new profile in the Registry at

HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWindowsMessaging SubsystemProfilesa0d020000000000c000000000000046

to locate the link browser program. This program lets messages containing URLs find IE. Your path to iexplore.exe might be different, and you must substitute the appropriate user ID in each case. We need the script to perform these actions every time a user logs on because NT can't save these changes to the mandatory profile.

Outstanding Issues
Outlook users on WinDD need to be aware of some quirks. Outlook 98 has resolved a few of them, however

Separate Profiles
For our large organization, WinDD has an ever-increasing role, and the migration to Outlook, while retaining the original principles of a controlled desktop environment, has been a great success. We have maintained most settings (e.g., views, print views) for each individual. We have locked only the workspace options (e.g., Outlook Bar, Folder List). This article illustrates one technique that can help you satisfactorily run applications in the thin-client Windows environment.