New Information:
Note, when I first made this post I just hacked around to see how I could copy the profile in Windows 7 since the "Copy to..." button was grayed out. Troy and Mikey turned me on to a tool called Evil Fingers Enabler that lets you re-enable the button to copy user profiles in Windows 7:
https://www.evilfingers.com/tools/enabler.php
Seems all Microsoft did was disable the "Copy to..." button, all the real code to copy the profile is still in the back end. Try enabler first, things should then work like they use to in XP, and only use the old information below if Enabler does not work. You will probable still have to do step 1 below however.
Old information Below:
While this is not directly security related, it should be helpful to those who are testing Windows 7. I'm posting it to help those who are searching the Internet for details on copying user profiles in Windows 7. It use to be that you could easily go into the profiles manager and copy any unlocked profile you wanted over the "Default User" profile. It seems that Microsoft has disabled this in Windows 7, the "Copy To" option is grayed out, and they expect you to use sysprep by putting:
The Steps: After setting up the profile for one user, lets call the account "adrian", do the following:
0. Login as an admin user, but NOT Adrian (you don't want the files in the profile to be locked).
1. Go to c: drive in Explorer (or whatever your system drive is), hit the ALT key, go to the Tools Menu-> Folder Options and start unchecking "Hides" so Explorer sees all files (system, hidden and what not).
2. Go to Users\ and rename "Default" to "Default Back" (we want to keep the old one around in case things go south and we need to but the original Default profile back).
3. Make a copy of "adrian", then rename the copy of "adrian" (not the original!!!) to "Default".
4. Right click on "Default" and set the permissions so that the "Everyone" and "Users" groups have "Read & Execute", "List Folder Content" and "Read" NTFS permissions (this was the default already when I tested). At this point, you can use the Right click Computer -> "Properties"-> "Advanced System Settings"->"User Profiles" tool to delete the Adrian profile if you like.
5. Try to login as an account that does not already have a profile. If the new user's profile looks like the setting you did for "adrian", all is good in the hood.
I have no idea what other problems may crop up later with this method, and keep in mind this is not the way Microsoft wants you to copy profiles. Use at your own risk, but so far these instructions have worked fine when I try to overwrite the Default user profile.
Note, when I first made this post I just hacked around to see how I could copy the profile in Windows 7 since the "Copy to..." button was grayed out. Troy and Mikey turned me on to a tool called Evil Fingers Enabler that lets you re-enable the button to copy user profiles in Windows 7:
https://www.evilfingers.com/tools/enabler.php
Seems all Microsoft did was disable the "Copy to..." button, all the real code to copy the profile is still in the back end. Try enabler first, things should then work like they use to in XP, and only use the old information below if Enabler does not work. You will probable still have to do step 1 below however.
Old information Below:
While this is not directly security related, it should be helpful to those who are testing Windows 7. I'm posting it to help those who are searching the Internet for details on copying user profiles in Windows 7. It use to be that you could easily go into the profiles manager and copy any unlocked profile you wanted over the "Default User" profile. It seems that Microsoft has disabled this in Windows 7, the "Copy To" option is grayed out, and they expect you to use sysprep by putting:
<CopyProfile>true</CopyProfile>in your unattend.xml and running the command:
sysprep /generalizeunattend:unattend.xmlBut this also resets a lot of other stuff, and that sucks when you are making a Ghost image for a lab environment. Below is the work around you can use to modify the Default profile by copying any profile you have previously modified over the Default profile. It is VERY much not supported by Microsoft, but for my limited tests seems to work.
The Steps: After setting up the profile for one user, lets call the account "adrian", do the following:
0. Login as an admin user, but NOT Adrian (you don't want the files in the profile to be locked).
1. Go to c: drive in Explorer (or whatever your system drive is), hit the ALT key, go to the Tools Menu-> Folder Options and start unchecking "Hides" so Explorer sees all files (system, hidden and what not).
2. Go to Users\ and rename "Default" to "Default Back" (we want to keep the old one around in case things go south and we need to but the original Default profile back).
4. Right click on "Default" and set the permissions so that the "Everyone" and "Users" groups have "Read & Execute", "List Folder Content" and "Read" NTFS permissions (this was the default already when I tested). At this point, you can use the Right click Computer -> "Properties"-> "Advanced System Settings"->"User Profiles" tool to delete the Adrian profile if you like.
I have no idea what other problems may crop up later with this method, and keep in mind this is not the way Microsoft wants you to copy profiles. Use at your own risk, but so far these instructions have worked fine when I try to overwrite the Default user profile.
Comments
Post a Comment