Disable UPD for administrator account on RDS Farm

Hello,

To exclude the administrator account from using the user profile disk in an RDS deployment, you can try the following steps:

First, open Remote Desktop Services in Server Manager. Navigate to the collection you are using and click "Properties" to edit it. In the collection properties, go to the "User Profile Disks" tab and specify which users or groups should have the user profile disk.

Then, use Group Policy to specify the users/groups to include or exclude to complete the exclusion.

For Group Policy, the general configuration direction is as follows:

1. From the Group Policy Management Editor, navigate to the following path:

Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Profiles.

2. Find the setting "Set the path for Remote Desktop Services roaming user profiles" and double-click it to edit the policy setting. Set it to "Enabled" and enter the roaming profile path you want standard users to use. Click "OK" to apply the setting.
3. To ensure that the policy does not affect administrators, you need to use security filtering. In the Scope tab of the GPO, find the "Security Filtering" section. Delete the "Authenticated Users" group. Add a new security group that includes all Remote Desktop Services (RDS) users, but excludes administrators.
4. After configuring the GPO, force an update of Group Policy using the "gpupdate /force" command (run on the RDS server) or simply wait for the next automatic policy refresh. Then, test logging on as an administrator to ensure that roaming profiles are not applied.

Note: Be careful when editing GPOs, as incorrect settings can affect your entire domain. Always test new settings on a limited scale before putting them into production, and consider creating a backup of existing GPOs before making changes.

I hope this helps.

Best regards,

Jacen Wang

Thank you for reply. But this solution will not exclude administrators. It will exclude other users. I need to exclude UPD only for administrators

For your information I follow your proposed solution but still not working. I still have Temp profile for administrator

Hello, please ensure that the GPO is correctly configured to apply only to the specific user groups you defined and not to administrators. If multiple group policies exist, make sure the precedence is set correctly. Use the "gpresult /R" command to check which policies are being applied to the administrator account.

Since you are using an RDS collection, double-check the collection properties to ensure that the UPD is not configured to be attached to all users without exception, including administrators. Also check the NTFS and share permissions of the folder where the UPD is stored.

Hello,

...

First, open Remote Desktop Services in Server Manager. Navigate to the collection you are using and click "Properties" to edit it. In the collection properties, go to the "User Profile Disks" tab and specify which users or groups should have the user profile disk.

...

 

 

Best regards,

Jacen Wang

Where are you seeing a place to specify which users or groups should have the user profile disk? I have an RDS in Azure running Server 2022 Datacenter.

When I go to the Session Collection -> User Profile Disks tab I have

a tick box for Enable user profile disks

Location:

\myserver\myshare

Maximum size in GB

50

User profile disks data settings

(o) Store all user settings and data on the user profile disk

Exclude the following folders (Add button and remove button)

(o) Store only the following folders on the user profile disk

All other folders in the user profile will not be preserved

Contacts

Desktop

Documents

..

..

..

Include the following folders:

(Add button and remove)

My "User Groups" tab in the Session Collection properties specifies a single Security group with just a few users in it, but anyone and everyone who logs on to the server, whether by RDP, or via a console logon, get's a User Profile Disks. Ideally, I want only the members of that Security group to have user profile disks, and everyone else to have a local profile in c:\users

Thanks

Mike