Customize the default user profile by using CopyProfile
Windows uses the default user profile as a template to assign a profile to each new user. By customizing the default user profile, you can configure settings for all user accounts that are created on the computer.
You can use the
CopyProfile setting to customize a user profile and then copy that profile to the default user profile. By using
CopyProfile, you can customize installed applications, drivers, desktop backgrounds, Internet Explorer settings, and other configurations. Be aware that some settings are not preserved by using
CopyProfile to customize the Start menu isn't supported. Instead, you can use the following methods to manage custom Start layouts
- Windows 11:
- Windows 10:
- OEMs can use
layoutmodification.xml. For more information, see Customize the Start layout.
- IT pros can use the following resources learn about how to manage the Windows 10 Start menu:
- OEMs can use
Some user profile settings, including Default Apps, are encrypted by using a hash that is specific to the user. If you copy these settings to another user profile, Windows treats them as invalid and resets them the first time that the user signs in. Windows does not support using
CopyProfile to copy these settings.
Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.
After you run
CopyProfile, you must delete some registry entries from the default user to prevent reset issues. Here’s how to procced:
Locate and select this subtree:
On the File menu, select Load Hive.
The default user hive isn’t present by default. It must be loaded, edited, and then unloaded manually.
Type C:\Users\Default\NTUSER.DAT in the File name box and select Open.
In the Load Hive dialog box, type a temporary name <DefaultUser> in the Key Name box and press Enter.
Delete these registry entries:
These registry entries are present only after running
On the File menu, select UnLoad Hive.
Close Registry Editor.
Now Windows will load the usual Default Applications settings from the oemdefaultassociations.xml file when a user signs in to Windows for the first time.
Create an answer file that includes the CopyProfile setting
In Windows SIM, create an answer file that has amd64_Microsoft-Windows-Shell-Setup_neutral\ added to Pass 4 - Specialize, and set
True. Save this answer file as
copyprofile.xml. You'll use this answer file when you run Sysprep.
Configure the default user profile settings
Configure user settings in audit mode, and then generalize the Windows installation by using an answer file that has
CopyProfile set to
True. If you install Windows by using another answer file, make sure that answer file doesn't have
CopyProfile or any settings that create additional user accounts.
Install Windows on a reference computer and start the computer in audit mode. For more information, see Boot Windows to Audit Mode or OOBE.
Don't use a domain account to start the computer. This is because the
CopyProfilesetting runs after the computer is removed from the domain when you run Sysprep. Therefore, you'll lose any settings that you configured in a domain. If you change the default user profile and then join the computer to a domain, the customizations that you made to the default user profile appear on new domain accounts.
Customize the built-in administrator account by installing applications, desktop shortcuts, and other settings.
The number of provisioned Windows runtime-based apps that you can install is limited. However, you can create scripts to install additional non-provisioned apps. For more information, see Sideload Apps with DISM.
After you complete the customizations, insert the media that contains the
CopyProfileanswer file in the reference computer. For example, you can copy the answer file to a USB drive.
On the reference computer, open an elevated command prompt, and then type this command:
C:\Windows\System32\Sysprep\Sysprep /generalize /oobe /shutdown /unattend:F:\CopyProfile.xml
In this command, F is the letter of the USB flash drive or other removable media. The Sysprep tool removes computer-specific information from the image, while it preserves the user profile settings that you configured. For more information, see Sysprep (Generalize) a Windows installation.
After you generalize the image and the computer shuts down, capture the image. To do this, start the computer in the Windows PE environment. Use DISM to capture and then deploy the Windows installation. For more information, see Create bootable WinPE media and Capture and apply a Windows image using a single .WIM file.
Test the user profile customizations
After you deploy the customized image to a destination computer, you can use that computer to test the user profile customizations. You can go through Out-Of-Box Experience (OOBE) to test the user experience, or you can test the user customizations in audit mode.
Apps that are based on the Windows runtime won't start in audit mode because audit mode uses the built-in administrator account. To run Windows runtime-based apps in audit mode, you must modify a registry entry.
To test the user profile customizations after OOBE
Install Windows to a test computer.
After Windows installs, go through OOBE and specify the computer name, user account name, and other items. After you complete OOBE, the Windows start screen appears.
Sign in to the computer by using the user account that was specified during OOBE, and verify that your apps and customizations appear.
To test the user profile customizations in audit mode
Start the computer in audit mode by using an answer file or by pressing Ctrl+Shift+F3 when OOBE starts. For more information, see Boot Windows to Audit Mode or OOBE.
Verify that your customizations work as intended. To test Windows Runtime-based apps, modify the registry as follows:
From an elevated command prompt, run Regedit.exe.
Browse to the following registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken
Select FilterAdministrationToken, and then type 1 as the value data.
Sign off from the computer.
Sign back on to the computer, and start the Windows runtime-based apps to verify that your customizations work as intended.
After you validate your Windows runtime-based apps, reset the FilterAdministrationToken registry entry to 0.
If the user profile settings aren't successfully copied, follow these steps:
Make sure that you set the
CopyProfilesetting only one time during the deployment process.
When you customize user settings, use only the built-in administrator account on the computer to avoid accidentally copying settings from the wrong profile.
Verify that you didn't use a domain account.
Verify that there are no additional user accounts other than the built-in administrator account that you configured. To do this, follow these steps:
Select Start, and then type Control Panel.
Select Control Panel > Add or remove user accounts.
Select any additional user account other than the built-in administrator account that you configured, and then delete that account.
Delete all other user accounts on the computer before you customize the built-in administrator account.
To preserve the tile layout on the Start screen for non-provisioned Windows runtime-based apps that register after the user signs in, make sure that the apps install within two hours of the user signing in.
Some settings can be configured only by using the
CopyProfileunattend setting, and other settings can be configured by using Group Policy. To do this, use either of the following methods:
Use Group Policy to configure settings that are reset by the new user signin process. You can also create scripts to define these user settings.
CopyProfileunattend setting. For more information, see Unattended Windows Setup Reference.