G
Guest
Basic issue from a user point of view:
User logs in & gets an error message that their profile is in use and
they'll be logged in with a temporary profile. They click OK, and they're
logged into a nearly blank desktop (all their personal shortcuts are gone; my
computer/etc. is still there). The user's profile has gone from docs &
sets\username to docs & sets\username.000. Internet shortcuts are gone and
all user-unique data is gone (in another profile; techs can easily copy it
from one profile to another, so no actual user data is lost, just time.)
Technical issue:
XP SP2. Latest critical updates installed. This happens on a random subset
of users in a domain environment with LOCAL PROFILES, NOT ROAMING. UPHCLEAN
was installed per a MS KB article to try to point to the problematic service,
without much luck (it points to several things keeping the registry open at
logoff). The issue occurs most frequently with laptops (since they log on and
off more frequently) and seems to happen mostly in the morning when people
come into the office (in other words, shortly after PC bootup and login, this
happens for, say, 1% of users). It might happen to a tiny percentage of
machines in the environment that log on for a given day. Errors include (in
the application log) 1508, 1502, 1515, 1511. The specifics are shown at the
end of the post.
I cannot reproduce this issue at will. It's completely random, except that
of thousands of machines, perhaps 5 have been identified as repeatedly
getting this problem. All 5 have the 'base' build - no additional software.
By 'repeatedly', I mean it might happen once a week or once every two weeks
for a few users.
We have SMS in our environment, and these machines aren't getting any
additional SMS software or packages that others machines aren't also getting.
We have Dameware, a remote control tool, running as a service. We have
"Survey", a software surveying and usage analysis tool, running as a service.
We use WMI quite a bit in the environment, so we have Dell WMI additions. We
have McAfee v7 in the environment; at the advice of Microsoft we're removing
that for testing.
This started happening perhaps 13 months ago, and we've been unable to
determine what was 'new' or added to the environment at that time. Trendmicro
officescan has been used for a couple years
Can anyone think of anything else to try? Userenv.log files don't show
anything (that I find) that's terribly conclusive even with enhanced logging
turned on, but I'm not certain what to look for. Can anyone make any
suggestions?
Please bear in mind that this is impossible to replicate; if I could
reproduce it I could easily just remove things until the issue stopped
happening.
____
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1515
Date: 11/21/2005
Time: 6:22:02 AM
User: P\H
Computer: U
Description:
Windows has backed up this user's profile. Windows will automatically try to
use the backed up profile the next time this user logs on.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
and
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1511
Date: 11/21/2005
Time: 6:22:34 AM
User: NT AUTHORITY\SYSTEM
Computer: U
Description:
Windows cannot find the local profile and is logging you on with a temporary
profile. Changes you make to this profile will be lost when you log off.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1508
Date: 11/21/2005
Time: 6:21:31 AM
User: NT AUTHORITY\SYSTEM
Computer: U
Description:
Windows was unable to load the registry. This is often caused by
insufficient memory or insufficient security rights.
DETAIL - The process cannot access the file because it is being used by
another process. for D:\Documents and Settings\h.001\ntuser.dat
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
and
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1502
Date: 11/21/2005
Time: 6:22:02 AM
User: NT AUTHORITY\SYSTEM
Computer: U
Description:
Windows cannot load the locally stored profile. Possible causes of this
error include insufficient security rights or a corrupt local profile. If
this problem persists, contact your network administrator.
DETAIL - The process cannot access the file because it is being used by
another process.
User logs in & gets an error message that their profile is in use and
they'll be logged in with a temporary profile. They click OK, and they're
logged into a nearly blank desktop (all their personal shortcuts are gone; my
computer/etc. is still there). The user's profile has gone from docs &
sets\username to docs & sets\username.000. Internet shortcuts are gone and
all user-unique data is gone (in another profile; techs can easily copy it
from one profile to another, so no actual user data is lost, just time.)
Technical issue:
XP SP2. Latest critical updates installed. This happens on a random subset
of users in a domain environment with LOCAL PROFILES, NOT ROAMING. UPHCLEAN
was installed per a MS KB article to try to point to the problematic service,
without much luck (it points to several things keeping the registry open at
logoff). The issue occurs most frequently with laptops (since they log on and
off more frequently) and seems to happen mostly in the morning when people
come into the office (in other words, shortly after PC bootup and login, this
happens for, say, 1% of users). It might happen to a tiny percentage of
machines in the environment that log on for a given day. Errors include (in
the application log) 1508, 1502, 1515, 1511. The specifics are shown at the
end of the post.
I cannot reproduce this issue at will. It's completely random, except that
of thousands of machines, perhaps 5 have been identified as repeatedly
getting this problem. All 5 have the 'base' build - no additional software.
By 'repeatedly', I mean it might happen once a week or once every two weeks
for a few users.
We have SMS in our environment, and these machines aren't getting any
additional SMS software or packages that others machines aren't also getting.
We have Dameware, a remote control tool, running as a service. We have
"Survey", a software surveying and usage analysis tool, running as a service.
We use WMI quite a bit in the environment, so we have Dell WMI additions. We
have McAfee v7 in the environment; at the advice of Microsoft we're removing
that for testing.
This started happening perhaps 13 months ago, and we've been unable to
determine what was 'new' or added to the environment at that time. Trendmicro
officescan has been used for a couple years
Can anyone think of anything else to try? Userenv.log files don't show
anything (that I find) that's terribly conclusive even with enhanced logging
turned on, but I'm not certain what to look for. Can anyone make any
suggestions?
Please bear in mind that this is impossible to replicate; if I could
reproduce it I could easily just remove things until the issue stopped
happening.
____
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1515
Date: 11/21/2005
Time: 6:22:02 AM
User: P\H
Computer: U
Description:
Windows has backed up this user's profile. Windows will automatically try to
use the backed up profile the next time this user logs on.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
and
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1511
Date: 11/21/2005
Time: 6:22:34 AM
User: NT AUTHORITY\SYSTEM
Computer: U
Description:
Windows cannot find the local profile and is logging you on with a temporary
profile. Changes you make to this profile will be lost when you log off.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1508
Date: 11/21/2005
Time: 6:21:31 AM
User: NT AUTHORITY\SYSTEM
Computer: U
Description:
Windows was unable to load the registry. This is often caused by
insufficient memory or insufficient security rights.
DETAIL - The process cannot access the file because it is being used by
another process. for D:\Documents and Settings\h.001\ntuser.dat
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
and
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1502
Date: 11/21/2005
Time: 6:22:02 AM
User: NT AUTHORITY\SYSTEM
Computer: U
Description:
Windows cannot load the locally stored profile. Possible causes of this
error include insufficient security rights or a corrupt local profile. If
this problem persists, contact your network administrator.
DETAIL - The process cannot access the file because it is being used by
another process.