Userenv 1525

[Jeff Smyrski]

On a new XP Pro machine joined to a Windows 2000 domain with AD installed, I
am receiving the following error. I disabled the Offline Files option
located on the Offline Files tab for Folder Options, but the error still
comes up. It causes the machine to run very, very, very slow! But only
after user1 logs in, logs off and User2 logs in without rebooting in
between.

I have also enabled the FastUserSwitching HOTFIX in KB822786 to get rid of
this error as well.

Thanks
Jeff Smyrski

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1525
Date: 10/15/2003
Time: 2:41:55 PM
User: DOMAINNAME\Username
Computer: STATION_100
Description:
Windows has detected that Offline Caching is enabled on the Roaming Profile
share - to avoid potential profile corruption, Offline Caching must be
disabled on shares where roaming user profiles are stored.

 

[Ivan Sheng]

Hi Jeff,


SUMMARY
=======

Userenv event 1525 may appear in the application event log:


Event Type:
Warning
Event Source: Userenv
Event Category: None
Event ID:
1525
Date: 7/3/2002
Time: 3:42:11 PM
User:
<Name1>\<Name2>
Computer: <Computer>
Description:
Windows has
detected that Offline Caching is enabled on the Roaming Profile share
- to
avoid potential profile corruption, Offline Caching must be disabled
on shares
where roaming user profiles are stored.

For more information, see
Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This event may occur if the following conditions exist:

- A Windows XP-based computer is member of a Microsoft Windows NT
4.0-based domain or of a Microsoft Windows 2000-based domain.

- You put the roaming profile of a domain user on a Windows NT
4.0-based server.

- You log on as this user from a Windows XP-based computer.


MORE INFORMATION
================

The warning is recorded in the log to notify the administrator that it is
possible for the client to cache files from that share. Although you cannot
set caching on Windows NT 4.0-based shares, Client Side Caching (CSC)
interprets the lack of caching options as manual caching. Therefore, as far
as CSC is concerned, the Windows NT 4.0-based share is cacheable. This can
permit profiles to be cached. The warning notifies administrators of this
issue.

You can ignore this warning.

If you have performance issue, you can consider moving the roaming profile
or not using it.


Ivan Sheng
Microsoft Online Partner Support
MCSD,MCSE4,2000,MCDBA,CCNA,ASE
Get Secure! ¨C www.microsoft.com/security

This posting is provided ¡°as is¡± with no warranties and confers no rights.

 

[Jeff Smyrski]

Sorry, but this is not an acceptable answer. Because the roaming profile is
designed and used for a specific reason, it seems reasonable to say that
there is an issue with XP and roaming profiles, when a user logs off instead
of rebooting. I removed the values on the Profile tab for a user who is
experiencing this issue. I left the existing user profile that was created
on the XP machine in tact, since this already had local favorites and
settings etc etc. I then performed the following steps...

1) Rebooted the machine
2) Logged in as administrator, checked a few machine settings
3) Logged off
4) Logged on as User
5) Slow...1524 and 1525 events generated in Application log.
6) Logged off
7) CTRL-ALT-DEL ---> Shutdown ---> Reboot option selected
8) After reboot, logged in as same user with trouble, everything works fine.

It seems to me that XP is not releasing the previous user logged on the
machine
It also seems rediculous that the machine needs to be rebooted after each
user is done

1524 is generated during the logoff-see below

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 551
Date: 10/17/2003
Time: 9:46:01 AM
User: DOMAINNAME\User1
Computer: STATION_131
Description:
User initiated logoff:
User Name: user1
Domain: DOMAINNAME
Logon ID: (0x0,0x2af83b)

***** Logon as admin

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 528
Date: 10/17/2003
Time: 9:46:20 AM
User: DOMAINNAME\Administrator
Computer: STATION_131
Description:
Successful Logon:
User Name: Administrator
Domain: DOMAINNAME
Logon ID: (0x0,0x2DF2AD)
Logon Type: 11
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: STATION_131
Logon GUID: {00000000-0000-0000-0000-000000000000}

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 528
Date: 10/17/2003
Time: 9:49:20 AM
User: DOMAINNAME/User1
Computer: STATION_131
Description:
Successful Logon:
User Name: User1
Domain: DOMAINNAME
Logon ID: (0x0,0xBF7A)
Logon Type: 11
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: STATION_131
Logon GUID: {00000000-0000-0000-0000-000000000000}

*****Here are the two events once again...for the same times...

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 10/17/2003
Time: 9:46:05 AM
User: DOMAINNAME\User1
Computer: STATION_131
Description:
Windows cannot unload your classes registry file - it is still in use by
other applications or services. The file will be unloaded when it is no
longer in use.

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1525
Date: 10/17/2003
Time: 9:49:20 AM
User: DOMAINNAME\User1
Computer: STATION_131
Description:
Windows has detected that Offline Caching is enabled on the Roaming Profile
share - to avoid potential profile corruption, Offline Caching must be
disabled on shares where roaming user profiles are stored.

 

[Jeff Smyrski]

So apparently after 5 days, no one wants to assist with this issue?

 

[Steven Liu]

Hi Jeff,

Apologize for the long delay.

For the Security error in the event log, it may be caused by that you have
configured the audit policy to audit successful system events.

To remove the audit policy, let's follow these steps.

1. Click "Start", and then click "Control Panel".
2. Double-click "Administrative Tools", and then double-click "Local
Security Settings".
3. Expand "Local Policies", and then expand "Audit Policy".
4. In the right pane, double-click "Audit system events".
5. Click to clear the "Success" check box, and then click "OK".
6. Restart the computer.

Restart the computer and you should not get the Security event log again.

By default, the Caching option is enabled in the products that are listed
at the beginning of this article. To disable or enable the Caching option:

1. Double-click My Computer.

2. On the Tools menu, click Folder Options.

3. Click the Offline Files tab, and then click to select (or click to
clear) the Enable Offline Files check box. You can either enable (click to
select) or disable (click to clear) the check box for client-side caching.

The Caching option can also be enabled or disabled by using the Group
Policy snap-in: In the Computer Configuration/Administrative
Templates/Network/Offline Files folder use the Enable policy.

Note: if the Windows XP computer is joined a domain, the fast user
switching function will be disabled by default. If you want to switch user,
you have to log off the current user and logon with a new user.

If this does not work, please let me know and I will contunue to help you.

Thanks for using Microsoft News Group!

Sincerely,

Steven Liu [MSFT]

Microsoft Online Partner Support

MCSE 2000

Get Secure! - www.microsoft.com/security

This posting is provided "as is" with no warranties and confers no rights.

 

[Jimmy]

I have the same touble with NT4 domain, and the saving profil is in trouble.

Please help me!