Right now every user has a profile folder and a document folder. The profiles are the big problem. When users login, everything in their profile is sent to their PC. The profiles have all kinds of crap in them; all programs that they use keep settings in their profiles. A few classroom teachers installed Hotbars on their classroom PCs, Hotbar can dump several MB of junk into students’ profiles, Sun (Java?) is another bad one and can also dump in several MB of unnecessary data. Internet Explorer keeps its cookies and favorites in the profiles, I don’t mind this because its never that big, but if a student resets their desktop background in IE, it gets stored in their IE profile folder as a dang bitmap, I’ve seen them push 4 MB. Students can’t reset their desktop backgrounds by right clicking on the desktop; they get a message that they don’t have permission to change properties, but they can in IE. Desktops are also stored in their profiles. I have a rule that they can only have shortcuts on their desktops, but if they have a folder or file its hard for me to tell. Temp and auto recover files are also stored in their profiles. The profiles become a problem when I have a class (24 to 30 students) log in at once, the server sends them all of their profiles. It can send about one MB a second (or better); so it can take a few minutes to get everyone logged in. Many of my classes are only 30 minutes, so several minutes is pretty unacceptable (especially for BS unnecessary data). Other users in the school who have an open file (like a MS Word doc) will experience a freeze while a class logs in. I’d like to get the login data per student well under 1 MB each.
Have you thought about mandatory profiles?
A mandatory means the user can't change it. You can set up a single mandatory profile for all the users, it doesn't write the temp data etc back up to the server, meaning each user gets exactly the same profile each time they log in, and any changes they make are lost.
Saves a lot of hassle in my experience.
It also stops people saving stuff to the desktop. If they do, it's simply lost. (Teach them to save data in their network folder)
I would like all of the BS non-essential data to be stored on the student’s PC in a temporary user folder, not on the server.
Mandatory profiles will acomplish this. You won't get down to 1mb per student with roaming profiles, though, the most basic profile is still over 3mb. But I've seen this system working in a school with 200+ computers, and it doesn't result in long delays. However, that's on a 100 Mb network, and it sounds like yours is 10 Mb. If so, that's the first thing you should upgrade.
Also look at getting a second server (even if it's just another pc acting as a server). A second domain controller will spread the load at logon, even if it isn't storing users home folders.
It doesn't even really need any redundancy in the second server. If it's just a domain controller, you don't lose much if it dies.
All 400+ student account folders are stored in on “student” folder; I’d like to have them in sub folders by grade level, possibly with different permissions and limits per grade.
That means either writing a script to modify them, or doing them by hand. Scripting is the way to go in a school, because you have a lot of new accouts to create every year.
Some accounts are screwed up and all files are stored in their profiles.
A mandatory profile will cure this, but you are going to have to sort out where the data is and move it, or the student/teacher will lose things.
But when you've got a mandatory profile in place, you no longer need to worry about stuff like this. Any changes the user makes to the desktop or settings will dissapear when they log off.
Others have permission issues and are inconsistent with the bulk of the students; I can’t access these folders or even tell how big they are without taking ownership and screwing things up.
If you can't access them as administrator, you have 2 options, take ownership of them, give yourself access, then let the students take ownership back, or log on as the student, grant admin access, then stop the student changing permissions again (students shouldn't have full control permissions over their own folders/shares)
You don't have to worry too much about setting up new profiles, because it's something you can do on a per user basis. Set up a new account to test the profile, apply it to a few users to test when you think it's ready, roll it out to everyone when you're sure it's ready.
As to training, in my experience it's usually too general, and gives you an overview of everything, whereas you need more in depth knowledge of profiles and active directory scripting. The profiles shouldln't be too hard, scripting can be.
