Mandatory User Profile

The file NTUSER.MAN is a Windows user-profile registry hive used with mandatory profiles. It contains pre-defined configuration settings that are loaded into the registry (HKEY_CURRENT_USER) when the user authenticates. Organizations typically use the mandatory profiles in Kiosks and shared workstations. However, threat actors could abuse Mandatory User Profiles to establish persistence on Windows…