Mar 17, 2016 Or they can create a folder redirection - in MS RDP on the Mac, edit the Remote Desktop settings for the PC, click on Redirection then add a new link to ther Desktop or whichever folder they wish. This is the correct answer. If the clipboard sharing stops working, kill and restart rdpclip.exe on the windows session. Fixed a folder redirection bug that was causing data loss when copy and pasting folders. Fixed a folder redirection issue that caused incorrect reporting of folder sizes. Fixed a regression that was preventing logging into an AAD-joined machine using a local account. Fixed bugs that were causing the session window contents to be clipped.
-->We regularly update the Remote Desktop client for macOS, adding new features and fixing issues. Here's where you'll find the latest updates.
If you encounter any issues, you can always contact us by navigating to Help > Report an Issue.
Updates for version 10.3.9
Date published: 4/6/20
In this release we've made some changes to improve interoperability with the Windows Virtual Desktop service. In addition, we've included the following updates:
- Control+Option+Delete now triggers the Ctrl+Alt+Del sequence (previously required pressing the Fn key).
- Fixed the keyboard mode notification color scheme for Light mode.
- Addressed scenarios where connections initiated using the GatewayAccessToken RDP file property didn't work.
Note
This is the last release that will be compatible with macOS 10.12.
Updates for version 10.3.8
Date published: 2/12/20
It's time for our first release of 2020!
With this update, you can switch between Scancode (Ctrl+Command+K) and Unicode (Ctrl+Command+U) modes when entering keyboard input. Unicode mode allows extended characters to be typed using the Option key on a Mac keyboard. For example, on a US Mac keyboard, Option+2 will enter the trademark (™) symbol. You can also enter accented characters in Unicode mode. For example, on a US Mac keyboard, entering Option+E and the 'A' key at the same time will enter the character 'á' on your remote session.
Other updates in this release include:
- Cleaned up the workspace refresh experience and UI.
- Addressed a smart card redirection issue that caused the remote session to stop responding at the sign-in screen when the 'Checking Status' message appeared.
- Reduced time to create temporary files used for clipboard-based file copy and paste.
- Temporary files used for clipboard file copy and paste are now deleted automatically when you exit the app, instead of relying on macOS to delete them.
- PC bookmark actions are now rendered at the top-right corner of thumbnails.
- Made fixes to address issues reported through crash telemetry.
Updates for version 10.3.7
Date published: 1/6/20
In our final update of the year, we fine-tuned some code and fixed the following behaviors:
- Copying things from the remote session to a network share or USB drive no longer creates empty files.
- Specifying an empty password in a user account no longer causes a double certificate prompt.
Updates for version 10.3.6
Date published: 1/6/20
In this release, we addressed an issue that created zero-length files whenever you copied a folder from the remote session to the local machine using file copy and paste.
Updates for version 10.3.5
Date published: 1/6/20
We made this update with the help of everyone who reported issues. In this version, we've made the following changes:
- Redirected folders can now be marked as read-only to prevent their contents from being changed in the remote session.
- We addressed a 0x607 error that appeared when connecting using RPC over HTTPS RD Gateway scenarios.
- Fixed cases where users were double-prompted for credentials.
- Fixed cases where users received the certificate warning prompt twice.
- Added heuristics to improve trackpad-based scrolling.
- The client no longer shows the 'Saved Desktops' group if there are no user-created groups.
- Updated UI for the tiles in PC view.
- Fixes to address crashes sent to us via application telemetry.
Note
In this release, we now accept feedback for the Mac client only through UserVoice.
Updates for version 10.3.4
Date published: 11/18/19
We've been hard at work listening to your feedback and have put together a collection of bug fixes and feature updates.
- When connecting via an RD Gateway with multifactor authentication, the gateway connection will be held open to avoid multiple MFA prompts.
- All the client UI is now fully keyboard-accessible with Voiceover support.
- Files copied to the clipboard in the remote session are now only transferred when pasting to the local computer.
- URLs copied to the clipboard in the remote session now paste correctly to the local computer.
- Scale factor remoting to support Retina displays is now available for multimonitor scenarios.
- Addressed a compatibility issue with FreeRDP-based RD servers that was causing connectivity issues in redirection scenarios.
- Addressed smart card redirection compatibility with future releases of Windows 10.
- Addressed an issue specific to macOS 10.15 where the incorrect available space was reported for redirected folders.
- Published PC connections are represented with a new icon in the Workspaces tab.
- 'Feeds' are now called 'Workspaces,' and 'Desktops' are now called 'PCs.'
- Fixed inconsistencies and bugs in user account handling in the preferences UI.
- Lots of bug fixes to make things run smoother and more reliably.
Updates for version 10.3.3
Date published: 11/18/19
We've put together a feature update and fixed bugs for the 10.3.3 release.
First, we've added user defaults to disable smart card, clipboard, microphone, camera, and folder redirection:
- ClientSettings.DisableSmartcardRedirection
- ClientSettings.DisableClipboardRedirection
- ClientSettings.DisableMicrophoneRedirection
- ClientSettings.DisableCameraRedirection
- ClientSettings.DisableFolderRedirection
Next, the bug fixes:
- Resolved an issue that was causing programmatic session window resizes to not be detected.
- Fixed an issue where the session window contents appeared small when connecting in windowed mode (with dynamic display enabled).
- Addressed initial flicker that occurred when connecting to a session in windowed mode with dynamic display enabled.
- Fixed graphics mispaints that occurred when connected to Windows 7 after toggling fit-to-window with dynamic display enabled.
- Fixed a bug that caused an incorrect device name to be sent to the remote session (breaking licensing in some third-party apps).
- Resolved an issue where remote app windows would occupy an entire monitor when maximized.
- Addressed an issue where the access permissions UI appeared underneath local windows.
- Cleaned up some shutdown code to ensure the client closes more reliably.
Updates for version 10.3.2
Date published: 11/18/19
In this release, we fixed a bug that made the display low resolution while connecting to a session
Updates for version 10.3.1
Date published: 11/18/19
We've put together some fixes to address regressions that managed to sneak into the 10.3.0 release.
- Addressed connectivity issues with RD Gateway servers that were using 4096-bit asymmetric keys.
- Fixed a bug that caused the client to randomly stop responding when downloading feed resources.
- Fixed a bug that caused the client to crash while opening.
- Fixed a bug that caused the client to crash while importing connections from Remote Desktop, version 8.
Updates for version 10.3.0
Date published: 8/27/19
It's been a few weeks since we last updated, but we've been hard at work during that time. Version 10.3.0 brings some new features and lots of under-the-hood fixes.
- Camera redirection is now possible when connecting to Windows 10 1809, Windows Server 2019 and later.
- On Mojave and Catalina we've added a new dialog that requests your permission to use the microphone and camera for device redirection.
- The feed subscription flow has been rewritten to be simpler and faster.
- Clipboard redirection now includes the Rich Text Format (RTF).
- When entering your password you have the option to reveal it with a 'Show password' checkbox.
- Addressed scenarios where the session window was jumping between monitors.
- The Connection Center displays high resolution remote app icons (when available).
- Cmd+A maps to Ctrl+A when Mac clipboard shortcuts are being used.
- Cmd+R now refreshes all of your subscribed feeds.
- Added new secondary click options to expand or collapse all groups or feeds in the Connection Center.
- Added a new secondary click option to change the icon size in the Feeds tab of the Connection Center.
- A new, simplified, and clean app icon.
Updates for version 10.2.13
Date published: 5/8/2019
- Fixed a hang that occurred when connecting via an RD Gateway.
- Added a privacy notice to the 'Add Feed' dialog.
Updates for version 10.2.12
Date published: 4/16/2019
- Resolved random disconnects (with error code 0x904) that took place when connecting via an RD Gateway.
- Fixed a bug that caused the resolutions list in application preferences to be empty after installation.
- Fixed a bug that caused the client to crash if certain resolutions were added to the resolutions list.
- Addressed an ADAL authentication prompt loop when connecting to Windows Virtual Desktop deployments.
Updates for version 10.2.10
Date published: 3/30/2019
- In this release we addressed instability caused by the recent macOS 10.14.4 update. We also fixed mispaints that appeared when decoding AVC codec data encoded by a server using NVIDIA hardware.
Updates for version 10.2.9
Date published: 3/6/2019
- In this release we fixed an RD gateway connectivity issue that can occur when server redirection takes place.
- We also addressed an RD gateway regression caused by the 10.2.8 update.
Updates for version 10.2.8
Date published: 3/1/2019
- Resolved connectivity issues that surfaced when using an RD Gateway.
- Fixed incorrect certificate warnings that were displayed when connecting.
- Addressed some cases where the menu bar and dock would needlessly hide when launching remote apps.
- Reworked the clipboard redirection code to address crashes and hangs that have been plaguing some users.
- Fixed a bug that caused the Connection Center to needlessly scroll when launching a connection.
Updates for version 10.2.7
Date published: 2/6/2019
- In this release we addressed graphics mispaints (caused by a server encoding bug) that appeared when using AVC444 mode.
Updates for version 10.2.6
Date published: 1/28/2019
- Added support for the AVC (420 and 444) codec, available when connecting to current versions of Windows 10.
- In Fit to Window mode, a window refresh now occurs immediately after a resize to ensure that content is rendered at the correct interpolation level.
- Fixed a layout bug that caused feed headers to overlap for some users.
- Cleaned up the Application Preferences UI.
- Polished the Add/Edit Desktop UI.
- Made lots of fit and finish adjustments to the Connection Center tile and list views for desktops and feeds.
Note
There is a bug in macOS 10.14.0 and 10.14.1 that can cause the '.com.microsoft.rdc.application-data_SUPPORT/_EXTERNAL_DATA' folder (nested deep inside the ~/Library folder) to consume a large amount of disk space. To resolve this issue, delete the folder content and upgrade to macOS 10.14.2. Note that a side-effect of deleting the folder contents is that snapshot images assigned to bookmarks will be deleted. These images will be regenerated when reconnecting to the remote PC.
Updates for version 10.2.4
Date published: 12/18/2018
- Added dark mode support for macOS Mojave 10.14.
- An option to import from Microsoft Remote Desktop 8 now appears in the Connection Center if it is empty.
- Addressed folder redirection compatibility with some third-party enterprise applications.
- Resolved issues where users were getting a 0x30000069 Remote Desktop Gateway error due to security protocol fallback issues.
- Fixed progressive rendering issues some users were experiencing with fit to window mode.
- Fixed a bug that prevented file copy and paste from copying the latest version of a file.
- Improved mouse-based scrolling for small scroll deltas.
Updates for version 10.2.3
Date published: 11/06/2018
- Added support for the 'remoteapplicationcmdline' RDP file setting for remote app scenarios.
- The title of the session window now includes the name of the RDP file (and server name) when launched from an RDP file.
- Fixed reported RD gateway performance issues.
- Fixed reported RD gateway crashes.
- Fixed issues where the connection would hang when connecting through an RD gateway.
- Better handling of full-screen remote apps by intelligently hiding the menu bar and dock.
- Fixed scenarios where remote apps remained hidden after being launched.
- Addressed slow rendering updates when using 'Fit to Window' with hardware acceleration disabled.
- Handled database creation errors caused by incorrect permissions when the client starts up.
- Fixed an issue where the client was consistently crashing at launch and not starting for some users.
- Fixed a scenario where connections were incorrectly imported as full-screen from Remote Desktop 8.
Updates for version 10.2.2
Date published: 10/09/2018
- A brand new Connection Center that supports drag and drop, manual arrangement of desktops, resizable columns in list view mode, column-based sorting, and simpler group management.
- The Connection Center now remembers the last active pivot (Desktops or Feeds) when closing the app.
- The credential prompting UI and flows have been overhauled.
- RD Gateway feedback is now part of the connecting status UI.
- Settings import from the version 8 client has been improved.
- RDP files pointing to RemoteApp endpoints can now be imported into the Connection Center.
- Retina display optimizations for single monitor Remote Desktop scenarios.
- Support for specifying the graphics interpolation level (which affects blurriness) when not using Retina optimizations.
- 256-color support to enable connectivity to Windows 2000.
- Fixed clipping of the right and bottom edges of the screen when connecting to Windows 7, Windows Server 2008 R2 and earlier.
- Copying a local file into Outlook (running in a remote session) now adds the file as an attachment.
- Fixed an issue that was slowing down pasteboard-based file transfers if the files originated from a network share.
- Addressed a bug that was causing to Excel (running in a remote session) to hang when saving to a file on a redirected folder.
- Fixed an issue that was causing no free space to be reported for redirected folders.
- Fixed a bug that caused thumbnails to consume too much disk storage on macOS 10.14.
- Added support for enforcing RD Gateway device redirection policies.
- Fixed an issue that prevented session windows from closing when disconnecting from a connection using RD Gateway.
- If Network Level Authentication (NLA) is not enforced by the server, you will now be routed to the login screen if your password has expired.
- Fixed performance issues that surfaced when lots of data was being transferred over the network.
- Smart card redirection fixes.
- Support for all possible values of the 'EnableCredSspSupport' and 'Authentication Level' RDP file settings if the ClientSettings.EnforceCredSSPSupport user default key (in the com.microsoft.rdc.macos domain) is set to 0.
- Support for the 'Prompt for Credentials on Client' RDP file setting when NLA is not negotiated.
- Support for smart card-based login via smart card redirection at the Winlogon prompt when NLA is not negotiated.
- Fixed an issue that prevented downloading feed resources that have spaces in the URL.
Updates for version 10.2.1
Date published: 08/06/2018
- Enabled connectivity to Azure Active Directory (AAD) joined PCs. To connect to an AAD joined PC, your username must be in one of the following formats: 'AzureADuser' or 'AzureADuser@domain'.
- Addressed some bugs affecting the usage of smart cards in a remote session.
Updates for version 10.2.0
Date published: 07/24/2018
- Incorporated updates for GDPR compliance.
- MicrosoftAccountusername@domain is now accepted as a valid username.
- Clipboard sharing has been rewritten to be faster and support more formats.
- Copy and pasting text, images or files between sessions now bypasses the local machine's clipboard.
- You can now connect via an RD Gateway server with an untrusted certificate (if you accept the warning prompts).
- Metal hardware acceleration is now used (where supported) to speed up rendering and optimize battery usage.
- When using Metal hardware acceleration we try to work some magic to make the session graphics appear sharper.
- Got rid of some instances where windows would hang around after being closed.
- Fixed bugs that were preventing the launch of RemoteApp programs in some scenarios.
- Fixed an RD Gateway channel synchronization error that was resulting in 0x204 errors.
- The mouse cursor shape now updates correctly when moving out of a session or RemoteApp window.
- Fixed a folder redirection bug that was causing data loss when copy and pasting folders.
- Fixed a folder redirection issue that caused incorrect reporting of folder sizes.
- Fixed a regression that was preventing logging into an AAD-joined machine using a local account.
- Fixed bugs that were causing the session window contents to be clipped.
- Added support for RD endpoint certificates that contain elliptic-curve asymmetric keys.
- Fixed a bug that was preventing the download of managed resources in some scenarios.
- Addressed a clipping issue with the pinned connection center.
- Fixed the checkboxes in the Display tab of the Add a Desktop window to work better together.
- Aspect ratio locking is now disabled when dynamic display change is in effect.
- Addressed compatibility issues with F5 infrastructure.
- Updated handling of blank passwords to ensure the correct messages are shown at connect-time.
- Fixed mouse scrolling compatibility issues with MapInfra Pro.
- Fixed some alignment issues in the Connection Center when running on Mojave.
Updates for version 10.1.8
Date published: 05/04/2018
- Added support for changing the remote resolution by resizing the session window!
- Fixed scenarios where remote resource feed download would take an excessively long time.
- Resolved the 0x207 error that could occur when connecting to servers not patched with the CredSSP encryption oracle remediation update (CVE-2018-0886).
Updates for version 10.1.7
Date published: 04/05/2018
- Made security fixes to incorporate CredSSP encryption oracle remediation updates as described in CVE-2018-0886.
- Improved RemoteApp icon and mouse cursor rendering to address reported mispaints.
- Addressed issues where RemoteApp windows appeared behind the Connection Center.
- Fixed a problem that occurred when you edit local resources after importing from Remote Desktop 8.
- You can now start a connection by pressing ENTER on a desktop tile.
- When you're in full screen view, CMD+M now correctly maps to WIN+M.
- The Connection Center, Preferences, and About windows now respond to CMD+M.
- You can now start discovering feeds by pressing ENTER on the **Adding Remote Resources*- page.
- Fixed an issue where a new remote resources feed showed up empty in the Connection Center until after you refreshed.
Updates for version 10.1.6
Date published: 03/26/2018
- Fixed an issue where RemoteApp windows would reorder themselves.
- Resolved a bug that caused some RemoteApp windows to get stuck behind their parent window.
- Addressed a mouse pointer offset issue that affected some RemoteApp programs.
- Fixed an issue where starting a new connection gave focus to an existing session, instead of opening a new session window.
- We fixed an error with an error message - you'll see the correct message now if we can't find your gateway.
- The Quit shortcut (⌘ + Q) is now consistently shown in the UI.
- Improved the image quality when stretching in 'fit to window' mode.
- Fixed a regression that caused multiple instances of the home folder to show up in the remote session.
- Updated the default icon for desktop tiles.
Applies to: Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2019, Windows Server 2016, Windows Server (Semi-annual Channel), Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2
This topic describes how to use Windows Server to deploy Roaming User Profiles to Windows client computers. Roaming User Profiles redirects user profiles to a file share so that users receive the same operating system and application settings on multiple computers.
For a list of recent changes to this topic, see the Change history section of this topic.
Important
Due to the security changes made in MS16-072, we updated Step 4: Optionally create a GPO for Roaming User Profiles in this topic so that Windows can properly apply the Roaming User Profiles policy (and not revert to local policies on affected PCs).
Important
User customizations to Start is lost after an OS in-place upgrade in the following configuration:
- Users are configured for a roaming profile
- Users are allowed to make changes to Start
As a result, the Start menu is reset to the default of the new OS version after the OS in-place upgrade. For workarounds, see Appendix C: Working around reset Start menu layouts after upgrades.
Prerequisites
Hardware requirements
Roaming User Profiles requires an x64-based or x86-based computer; it isn't supported by Windows RT.
Software requirements
Roaming User Profiles has the following software requirements:
If you are deploying Roaming User Profiles with Folder Redirection in an environment with existing local user profiles, deploy Folder Redirection before Roaming User Profiles to minimize the size of roaming profiles. After the existing user folders have been successfully redirected, you can deploy Roaming User Profiles.
To administer Roaming User Profiles, you must be signed in as a member of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group.
Client computers must run Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008.
Client computers must be joined to the Active Directory Domain Services (AD DS) that you are managing.
A computer must be available with Group Policy Management and Active Directory Administration Center installed.
A file server must be available to host roaming user profiles.
- If the file share uses DFS Namespaces, the DFS folders (links) must have a single target to prevent users from making conflicting edits on different servers.
- If the file share uses DFS Replication to replicate the contents with another server, users must be able to access only the source server to prevent users from making conflicting edits on different servers.
- If the file share is clustered, disable continuous availability on the file share to avoid performance issues.
To use primary computer support in Roaming User Profiles, there are additional client computer and Active Directory schema requirements. For more information, see Deploy Primary Computers for Folder Redirection and Roaming User Profiles.
The layout of a user's Start menu won't roam on Windows 10, Windows Server 2019, or Windows Server 2016 if they're using more than one PC, Remote Desktop Session Host, or Virtualized Desktop Infrastructure (VDI) server. As a workaround, you can specify a Start layout as described in this topic. Or you can make use of user profile disks, which properly roam Start menu settings when used with Remote Desktop Session Host servers or VDI servers. For more info, see Easier User Data Management with User Profile Disks in Windows Server 2012.
Considerations when using Roaming User Profiles on multiple versions of Windows
If you decide to use Roaming User Profiles across multiple versions of Windows, we recommend taking the following actions:
- Configure Windows to maintain separate profile versions for each operating system version. This helps prevent undesirable and unpredictable issues such as profile corruption.
- Use Folder Redirection to store user files such as documents and pictures outside of user profiles. This enables the same files to be available to users across operating system versions. It also keeps profiles small and sign-ins quick.
- Allocate sufficient storage for Roaming User Profiles. If you support two operating system versions, profiles will double in number (and thus total space consumed) because a separate profile is maintained for each operating system version.
- Don't use Roaming User Profiles across computers running Windows Vista/Windows Server 2008 and Windows 7/Windows Server 2008 R2. Roaming between these operating system versions isn't supported due to incompatibilities in their profile versions.
- Inform your users that changes made on one operating system version won't roam to another operating system version.
- When moving your environment to a version of Windows that uses a different profile version (such as from Windows 10 to Windows 10, version 1607—see Appendix B: Profile version reference information for a list), users receive a new, empty roaming user profile. You can minimize the impact of getting a new profile by using Folder Redirection to redirect common folders. There isn't a supported method of migrating roaming user profiles from one profile version to another.
Step 1: Enable the use of separate profile versions
If you are deploying Roaming User Profiles on computers running Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012, we recommend making a couple of changes to your Windows environment prior to deploying. These changes help ensure that future operating system upgrades go smoothly, and facilitate the ability to simultaneously run multiple versions of Windows with Roaming User Profiles.
To make these changes, use the following procedure.
Download and install the appropriate software update on all computers on which you're going to use roaming, mandatory, super-mandatory, or domain default profiles:
- Windows 8.1, or Windows Server 2012 R2: install the software update described in article 2887595 in the Microsoft Knowledge Base (when released).
- Windows 8 or Windows Server 2012: install the software update described in article 2887239 in the Microsoft Knowledge Base.
On all computers running Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 on which you will use Roaming User Profiles, use Registry Editor or Group Policy to create the following registry key DWORD Value and set it to
1. For information about creating registry keys by using Group Policy, see Configure a Registry Item.Warning
Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
Restart the computers.
Step 2: Create a Roaming User Profiles security group
If your environment is not already set up with Roaming User Profiles, the first step is to create a security group that contains all users and/or computers to which you want to apply Roaming User Profiles policy settings.
- Administrators of general-purpose roaming user profiles deployments typically create a security group for users.
- Administrators of Remote Desktop Services or virtualized desktop deployments typically use a security group for users and the shared computers.
Here's how to create a security group for Roaming User Profiles:
Microsoft Remote Desktop Mac Folder Redirection Not Working Windows 7
Open Server Manager on a computer with Active Directory Administration Center installed.
On the Tools menu, select Active Directory Administration Center. Active Directory Administration Center appears.
Right-click the appropriate domain or OU, select New, and then select Group.
In the Create Group window, in the Group section, specify the following settings:
- In Group name, type the name of the security group, for example: Roaming User Profiles Users and Computers.
- In Group scope, select Security, and then select Global.
In the Members section, select Add. The Select Users, Contacts, Computers, Service Accounts or Groups dialog box appears.
If you want to include computer accounts in the security group, select Object Types, select the Computers check box and then select OK.
Type the names of the users, groups, and/or computers to which you want to deploy Roaming User Profiles, select OK, and then select OK again.
Step 3: Create a file share for roaming user profiles
If you do not already have a separate file share for roaming user profiles (independent from any shares for redirected folders to prevent inadvertent caching of the roaming profile folder), use the following procedure to create a file share on a server running Windows Server.
Note
Some functionality might differ or be unavailable depending on the version of Windows Server you're using.
Here's how to create a file share on Windows Server:
In the Server Manager navigation pane, select File and Storage Services, and then select Shares to display the Shares page.
In the Shares tile, select Tasks, and then select New Share. The New Share Wizard appears.
On the Select Profile page, select SMB Share – Quick. If you have File Server Resource Manager installed and are using folder management properties, instead select SMB Share - Advanced.
On the Share Location page, select the server and volume on which you want to create the share.
On the Share Name page, type a name for the share (for example, User Profiles$) in the Share name box.
Tip
When creating the share, hide the share by putting a
$after the share name. This hides the share from casual browsers.On the Other Settings page, clear the Enable continuous availability checkbox, if present, and optionally select the Enable access-based enumeration and Encrypt data access checkboxes.
On the Permissions page, select Customize permissions…. The Advanced Security Settings dialog box appears.
Select Disable inheritance, and then select Convert inherited permissions into explicit permission on this object.
Set the permissions as described in Required permissions for the file share hosting roaming user profiles and shown in the following screen shot, removing permissions for unlisted groups and accounts, and adding special permissions to the Roaming User Profiles Users and Computers group that you created in Step 1.
Figure 1 Setting the permissions for the roaming user profiles share
If you chose the SMB Share - Advanced profile, on the Management Properties page, select the User Files Folder Usage value.
If you chose the SMB Share - Advanced profile, on the Quota page, optionally select a quota to apply to users of the share.
On the Confirmation page, select Create.
Required permissions for the file share hosting roaming user profiles
| User Account | Access | Applies to |
|---|---|---|
| System | Full control | This folder, subfolders and files |
| Administrators | Full Control | This folder only |
| Creator/Owner | Full Control | Subfolders and files only |
| Security group of users needing to put data on share (Roaming User Profiles Users and Computers) | List folder / read data (Advanced permissions) Create folders / append data (Advanced permissions) | This folder only |
| Other groups and accounts | None (remove) |
Step 4: Optionally create a GPO for Roaming User Profiles
If you do not already have a GPO created for Roaming User Profiles settings, use the following procedure to create an empty GPO for use with Roaming User Profiles. This GPO allows you to configure Roaming User Profiles settings (such as primary computer support, which is discussed separately), and can also be used to enable Roaming User Profiles on computers, as is typically done when deploying in virtualized desktop environments or with Remote Desktop Services.
Here's how to create a GPO for Roaming User Profiles:
Open Server Manager on a computer with Group Policy Management installed.
From the Tools menu select Group Policy Management. Group Policy Management appears.
Right-click the domain or OU in which you want to setup Roaming User Profiles, then select Create a GPO in this domain, and Link it here.
In the New GPO dialog box, type a name for the GPO (for example, Roaming User Profile Settings), and then select OK.
Right-click the newly created GPO and then clear the Link Enabled checkbox. This prevents the GPO from being applied until you finish configuring it.
Select the GPO. In the Security Filtering section of the Scope tab, select Authenticated Users, and then select Remove to prevent the GPO from being applied to everyone.
In the Security Filtering section, select Add.
In the Select User, Computer, or Group dialog box, type the name of the security group you created in Step 1 (for example, Roaming User Profiles Users and Computers), and then select OK.
Select the Delegation tab, select Add, type Authenticated Users, select OK, and then select OK again to accept the default Read permissions.
This step is necessary due to security changes made in MS16-072.
Important
Due to the security changes made in MS16-072A, you now must give the Authenticated Users group delegated Read permissions to the GPO - otherwise the GPO won't get applied to users, or if it's already applied, the GPO is removed, redirecting user profiles back to the local PC. For more info, see Deploying Group Policy Security Update MS16-072.
Step 5: Optionally set up Roaming User Profiles on user accounts
If you are deploying Roaming User Profiles to user accounts, use the following procedure to specify roaming user profiles for user accounts in Active Directory Domain Services. If you are deploying Roaming User Profiles to computers, as is typically done for Remote Desktop Services or virtualized desktop deployments, instead use the procedure documented in Step 6: Optionally set up Roaming User Profiles on computers.
Note
If you set up Roaming User Profiles on user accounts by using Active Directory and on computers by using Group Policy, the computer-based policy setting takes precedence.
Here's how to set up Roaming User Profiles on user accounts:
In Active Directory Administration Center, navigate to the Users container (or OU) in the appropriate domain.
Select all users to which you want to assign a roaming user profile, right-click the users and then select Properties.
In the Profile section, select the Profile path: checkbox and then enter the path to the file share where you want to store the user's roaming user profile, followed by
%username%(which is automatically replaced with the user name the first time the user signs in). For example:fs1.corp.contoso.comUser Profiles$%username%To specify a mandatory roaming user profile, specify the path to the NTuser.man file that you created previously, for example,
fs1.corp.contoso.comUser Profiles$default. For more information, see Create mandatory user profiles.Select OK.
Note
By default, deployment of all Windows® Runtime-based (Windows Store) apps is allowed when using Roaming User Profiles. However, when using a special profile, apps are not deployed by default. Special profiles are user profiles where changes are discarded after the user signs out:
To remove restrictions on app deployment for special profiles, enable the Allow deployment operations in special profiles policy setting (located in Computer ConfigurationPoliciesAdministrative TemplatesWindows ComponentsApp Package Deployment). However, deployed apps in this scenario will leave some data stored on the computer, which could accumulate, for example, if there are hundreds of users of a single computer. To clean up apps, locate or develop a tool that uses the CleanupPackageForUserAsync API to clean up app packages for users who no longer have a profile on the computer.
For additional background information about Windows Store apps, see Manage Client Access to the Windows Store.
Step 6: Optionally set up Roaming User Profiles on computers
If you are deploying Roaming User Profiles to computers, as is typically done for Remote Desktop Services or virtualized desktop deployments, use the following procedure. If you are deploying Roaming User Profiles to user accounts, instead use the procedure described in Step 5: Optionally set up Roaming User Profiles on user accounts.
You can use Group Policy to apply Roaming User Profiles to computers running Windows 8.1, Windows 8, Windows 7, Windows Vista, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008.
Note
If you set up Roaming User Profiles on computers by using Group Policy and on user accounts by using Active Directory, the computer-based policy setting takes precedence.
Here's how to set up Roaming User Profiles on computers:
Open Server Manager on a computer with Group Policy Management installed.
From the Tools menu, select Group Policy Management. Group Policy Management will appear.
In Group Policy Management, right-click the GPO you created in Step 3 (for example, Roaming User Profiles Settings), and then select Edit.
In the Group Policy Management Editor window, navigate to Computer Configuration, then Policies, then Administrative Templates, then System, and then User Profiles.
Right-click Set roaming profile path for all users logging onto this computer and then select Edit.
Tip
A user's home folder, if configured, is the default folder used by some programs such as Windows PowerShell. You can configure an alternative local or network location on a per-user basis by using the Home folder section of the user account properties in AD DS. To configure the home folder location for all users of a computer running Windows 8.1, Windows 8, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, or Windows Server 2012 in a virtual desktop environment, enable the Set user home folder policy setting, and then specify the file share and drive letter to map (or specify a local folder). Do not use environment variables or ellipses. The user's alias is appended to the end of the path specified during user sign on.
In the Properties dialog box, select Enabled
In the Users logging onto this computer should use this roaming profile path box, enter the path to the file share where you want to store the user's roaming user profile, followed by
%username%(which is automatically replaced with the user name the first time the user signs in). For example:fs1.corp.contoso.comUser Profiles$%username%To specify a mandatory roaming user profile, which is a preconfigured profile to which users cannot make permanent changes (changes are reset when the user signs out), specify the path to the NTuser.man file that you created previously, for example,
fs1.corp.contoso.comUser Profiles$default. For more information, see Creating a Mandatory User Profile.Select OK.
Step 7: Optionally specify a Start layout for Windows 10 PCs
You can use Group Policy to apply a specific Start menu layout so that users see the same Start layout on all PCs. If users sign in to more than one PC and you want them to have a consistent Start layout across PCs, make sure that the GPO applies to all of their PCs.
To specify a Start layout, do the following:
- Update your Windows 10 PCs to Windows 10 version 1607 (also known as the Anniversary Update) or newer, and install the March 14th, 2017 cumulative update (KB4013429) or newer.
- Create a full or partial Start menu layout XML file. To do so, see Customize and export Start layout.
- If you specify a full Start layout, a user can't customize any part of the Start menu. If you specify a partial Start layout, users can customize everything but the locked groups of tiles you specify. However, with a partial Start layout, user customizations to the Start menu won't roam to other PCs.
- Use Group Policy to apply the customized Start layout to the GPO you created for Roaming User Profiles. To do so, see Use Group Policy to apply a customized Start layout in a domain.
- Use Group Policy to set the following registry value on your Windows 10 PCs. To do so, see Configure a Registry Item.
| Action | Update |
|---|---|
| Hive | HKEY_LOCAL_MACHINE |
| Key path | SoftwareMicrosoftWindowsCurrentVersionExplorer |
| Value name | SpecialRoamingOverrideAllowed |
| Value type | REG_DWORD |
| Value data | 1 (or 0 to disable) |
| Base | Decimal |
- (Optional) Enable first-time logon optimizations to make signing in faster for users. To do so, see Apply policies to improve sign-in time.
- (Optional) Further decrease sign-in times by removing unnecessary apps from the Windows 10 base image you use to deploy client PCs. Windows Server 2019 and Windows Server 2016 don't have any pre-provisioned apps, so you can skip this step on server images.
To remove apps, use the Remove-AppxProvisionedPackage cmdlet in Windows PowerShell to uninstall the following applications. If your PCs are already deployed you can script the removal of these apps using the Remove-AppxPackage.
- Microsoft.windowscommunicationsapps_8wekyb3d8bbwe
- Microsoft.BingWeather_8wekyb3d8bbwe
- Microsoft.DesktopAppInstaller_8wekyb3d8bbwe
- Microsoft.Getstarted_8wekyb3d8bbwe
- Microsoft.Windows.Photos_8wekyb3d8bbwe
- Microsoft.WindowsCamera_8wekyb3d8bbwe
- Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe
- Microsoft.WindowsStore_8wekyb3d8bbwe
- Microsoft.XboxApp_8wekyb3d8bbwe
- Microsoft.XboxIdentityProvider_8wekyb3d8bbwe
- Microsoft.ZuneMusic_8wekyb3d8bbwe
Note
Uninstalling these apps decreases sign-in times, but you can leave them installed if your deployment needs any of them.
Step 8: Enable the Roaming User Profiles GPO
If you set up Roaming User Profiles on computers by using Group Policy, or if you customized other Roaming User Profiles settings by using Group Policy, the next step is to enable the GPO, permitting it to be applied to affected users.
Tip
If you plan to implement primary computer support, do so now, before you enable the GPO. This prevents user data from being copied to non-primary computers before primary computer support is enabled. For the specific policy settings, see Deploy Primary Computers for Folder Redirection and Roaming User Profiles.
Here's how to enable the Roaming User Profile GPO:
- Open Group Policy Management.
- Right-click the GPO that you created and then select Link Enabled. A checkbox appears next to the menu item.
Step 9: Test Roaming User Profiles
To test Roaming User Profiles, sign in to a computer with a user account configured for Roaming User Profiles, or sign in to a computer configured for Roaming User Profiles. Then confirm that the profile is redirected.
Here's how to test Roaming User Profiles:
Sign in to a primary computer (if you enabled primary computer support) with a user account for which you have enabled Roaming User Profiles enabled. If you enabled Roaming User Profiles on specific computers, sign in to one of these computers.
If the user has previously signed in to the computer, open an elevated command prompt, and then type the following command to ensure that the latest Group Policy settings are applied to the client computer:
To confirm that the user profile is roaming, open Control Panel, select System and Security, select System, select Advanced System Settings, select Settings in the User Profiles section and then look for Roaming in the Type column.
Appendix A: Checklist for deploying Roaming User Profiles
| Status | Action |
|---|---|
| ☐ ☐ ☐ ☐ ☐ | 1. Prepare domain - Join computers to domain - Enable the use of separate profile versions - Create user accounts - (Optional) Deploy Folder Redirection |
| ☐ | 2. Create security group for Roaming User Profiles - Group name: - Members: |
| ☐ | 3. Create a file share for Roaming User Profiles - File share name: |
| ☐ | 4. Create a GPO for Roaming User Profiles - GPO name: |
| ☐ | 5. Configure Roaming User Profiles policy settings |
| ☐ ☐ ☐ | 6. Enable Roaming User Profiles - Enabled in AD DS on user accounts? - Enabled in Group Policy on computer accounts? |
| ☐ | 7. (Optional) Specify a mandatory Start layout for Windows 10 PCs |
| ☐ ☐ ☐ ☐ | 8. (Optional) Enable primary computer support - Designate primary computers for users - Location of user and primary computer mappings: - (Optional) Enable primary computer support for Folder Redirection - Computer-based or User-based? - (Optional) Enable primary computer support for Roaming User Profiles |
| ☐ | 9. Enable the Roaming User Profiles GPO |
| ☐ | 10. Test Roaming User Profiles |
Appendix B: Profile version reference information
Mac Folder Question Mark
Each profile has a profile version that corresponds roughly to the version of Windows on which the profile is used. For example, Windows 10, version 1703 and version 1607 both use the .V6 profile version. Microsoft creates a new profile version only when necessary to maintain compatibility, which is why not every version of Windows includes a new profile version.
The following table lists the location of Roaming User Profiles on various versions of Windows.
| Operating system version | Roaming User Profile location |
|---|---|
| Windows XP and Windows Server 2003 | <servername><fileshare><username> |
| Windows Vista and Windows Server 2008 | <servername><fileshare><username>.V2 |
| Windows 7 and Windows Server 2008 R2 | <servername><fileshare><username>.V2 |
| Windows 8 and Windows Server 2012 | <servername><fileshare><username>.V3 (after the software update and registry key are applied)<servername><fileshare><username>.V2 (before the software update and registry key are applied) |
| Windows 8.1 and Windows Server 2012 R2 | <servername><fileshare><username>.V4 (after the software update and registry key are applied)<servername><fileshare><username>.V2 (before the software update and registry key are applied) |
| Windows 10 | <servername><fileshare><username>.V5 |
| Windows 10, version 1703 and version 1607 | <servername><fileshare><username>.V6 |
Setup Folder Redirection
Appendix C: Working around reset Start menu layouts after upgrades
Here are some ways to work around Start menu layouts getting reset after an in-place upgrade:
Mac Microsoft Remote Desktop Folder Redirection
If only one user ever uses the device and the IT Admin uses a managed OS deployment strategy such as Configuration Manager they can do the following:
Export the Start menu layout with Export-Startlayout before the upgrade
Import the Start menu layout with Import-StartLayout after OOBE but before the user signs in
Note
Importing a StartLayout modifies the Default User profile. All user profiles created after the import has occurred will get the imported Start-Layout.
IT Admins can opt to manage Start's Layout with Group Policy. Using Group Policy provides a centralized management solution to apply a standardized Start Layout to users. There are 2 modes to modes to using Group Policy for Start management. Full Lockdown and Partial Lockdown. The full lockdown scenario prevents the user from making any changes to Start's layout. The partial lockdown scenario allows user to make changes to a specific area of Start. For more info, see Customize and export Start layout.
Note
User made changes in the partial lockdown scenario will still be lost during upgrade.
Let the Start layout reset occur and allow end users to reconfigure Start. A notification email or other notification can be sent to end users to expect their Start layouts to be reset after the OS upgrade to minimized impact.
Microsoft Remote Desktop For Mac Folder Redirection
Change history
Gpo Folder Redirection Not Working
The following table summarizes some of the most important changes to this topic.
| Date | Description | Reason |
|---|---|---|
| May 1st, 2019 | Added updates for Windows Server 2019 | |
| April 10th, 2018 | Added discussion of when user customizations to Start are lost after an OS in-place upgrade | Callout known issue. |
| March 13th, 2018 | Updated for Windows Server 2016 | Moved out of Previous Versions library and updated for current version of Windows Server. |
| April 13th, 2017 | Added profile information for Windows 10, version 1703, and clarified how roaming profile versions work when upgrading operating systems—see Considerations when using Roaming User Profiles on multiple versions of Windows. | Customer feedback. |
| March 14th, 2017 | Added optional step for specifying a mandatory Start layout for Windows 10 PCs in Appendix A: Checklist for deploying Roaming User Profiles. | Feature changes in latest Windows update. |
| January 23rd, 2017 | Added a step to Step 4: Optionally create a GPO for Roaming User Profiles to delegate Read permissions to Authenticated Users, which is now required because of a Group Policy security update. | Security changes to Group Policy processing. |
| December 29th, 2016 | Added a link in Step 8: Enable the Roaming User Profiles GPO to make it easier to get info on how to set Group Policy for primary computers. Also fixed a couple references to steps 5 and 6 that had the numbers wrong. | Customer feedback. |
| December 5th, 2016 | Added info explaining a Start menu settings roaming issue. | Customer feedback. |
| July 6th, 2016 | Added Windows 10 profile version suffixes in Appendix B: Profile version reference information. Also removed Windows XP and Windows Server 2003 from the list of supported operating systems. | Updates for the new versions of Windows, and removed info about versions of Windows that are no longer supported. |
| July 7th, 2015 | Added requirement and step to disable continuous availability when using a clustered file server. | Clustered file shares have better performance for small writes (which are typical with roaming user profiles) when continuous availability is disabled. |
| March 19th, 2014 | Capitalized profile version suffixes (.V2, .V3, .V4) in Appendix B: Profile version reference information. | Although Windows is case insensitive, if you use NFS with the file share, it's important to have the correct (uppercase) capitalization for the profile suffix. |
| October 9th, 2013 | Revised for Windows Server 2012 R2 and Windows 8.1, clarified a few things, and added the Considerations when using Roaming User Profiles on multiple versions of Windows and Appendix B: Profile version reference information sections. | Updates for new version; customer feedback. |