€“ required non-default profile? (Thincomputing.net)

Helge "UserProfie" Klein reveals why mandatory profiles are not secure. So now he tells us:

Mandatory profiles are generally considered to be fast and secure because they usually are of small size and cannot be changed by the user. While it is true - mandatory profiles will remain pristine indefinitely - there are more, security, read-only access.

Mandatory profiles (PM) is a variant of roaming profiles: a copy on a file server is copied to the host of the RDS session during logon. Copy local resulting is secured with filesystem ACL to grant full access to the user, but nobody else does (more administrators and SYSTEM). Everything is safe - except in the case of mandatory profiles.
A user profile includes not only data file system, but a registry hive (stored in the file NTUSER.MAN) that is mounted HKU\ and accessible since a session through the well-known name HKCU. Unlike file system, registry permissions are not changed for logon because it don't need - at least with roaming profiles where the copy of each hive already has the appropriate permissions.
Not the case with mandatory profiles. Conformément à l'article how customize default user profiles Windows 7 (and more old CRT) creating a mandatory profile involves changing registry permissions on the copy full access to "Everyone". That many users are simultaneously connected to a host of the RDS session, each server registry is composed of many user hives are read and writeable by anyone, not just the owner should be individual user profile.
Thus on a RDS host session where mandatory profiles are used, a user can simply open Regedit, navigate to HKU\ and read/write at will.

Source: http://www.sepago.de/d/helge/2010/12/13/mandatory-profiles-ae-insecure-by-default