Roaming Profie Oddities

[mistersparky]

Hey there everyone!

Over last summer we completed a rollout of Windows 7 across our school, which went generally pretty well. As part of this rollout, we made quite a few changes to user accounts, which is one of the few things we are still struggling with.

A little bit about the current setup. We have separate DFS “User” shares for students and staff, with each user having their own directory. We use folder redirection to store Documents (inc Music, Pictures and Videos), Favourites, Desktop and Roaming AppData directories separately within these user shares, with user home folders also pointing to the Documents directory. Students and staff both have non-mandatory profiles.

In addition to folder redirection, we apply a number of Group Policy settings to configure and secure user accounts. Some of these are policies that we implemented from the start and some of these are policies that we have implemented since then. Some of the more notable polices:

• Exclude directories in Roaming Profile - Local Settings;Temporary Internet Files;History;Temp
• Do not log users on with temporary profiles (enable)
• Allow or Disallow use of the Offline Files feature (disable)
• The folder redirection polices are set to not grant users exclusive rights to directores, to not move contents to new location and to leave contents on policy removal.

Now, this set works a treat for staff. Roaming profile directories remain small, login times are fast, applications work across workstations without faults and folder redirection seems to stick with users. However, it’s far less reliable for students, who seem to experience the following issues:

• Folder redirection seems to drop and stay dropped for a small, but not insignificant number of students. The Documents/Downloads/Roaming AppData/Favourites/Desktop directors (or some combination thereof) on student accounts reset and point to the local profile. Upon logoff, these sync back to the Roaming Profile share.
• Local and LocalLow AppData directores seem to be syncing back to some student roaming profile directories, despite them being excluded from doing so in GP. In turn, this causes effected Roaming Profiles to grow considerably in size, with all sort of unwanted nonsense in the roaming profile syncing during login (temp internet files, OST files and so on). The affected users seem to have the entry “[General]ExclusionList=Local Settings;Temporary Internet Files;History;Temp” in their ntuser.ini files, with unaffected users having the entry “[General]ExclusionList=AppData\Local;AppData\LocalLow;$Recy cle.Bin;Local Settings;Temporary Internet Files;History;Temp”
• Profile resets seem to fix the issue - archiving effected users Roaming Profile and re-directed Roaming AppData directories and letting the profile recreate itself on next login. However the issue seems to resurface for a number of users. I am not sure if this users doing again whatever it was they did in the first place to cause the problem, or whether it’s because they are logging back onto PCs with “corrupt” Roaming Profiles, which copy back to the Roaming Profile share, and in turn follow users to the next PC they use.

OK, so moving forwards I have three questions:

• One of the few differences between students and staff use of IT is laptops. Students use them a lot, staff use them rarely. Our wireless network also isn’t the best, with generally pretty poor performance. After a quick look around, I found some information on Slow Link Detection GP settings. It seems that this is on by default, and that slow links could very well mean no Folder Redirection (Specifying Group Policy for Slow Link Detection: Group Policy). Could this be what is causing the reset Folder Redirection for our students? Is it the case that any such settings applied during logins over slow links can sync back to the Roaming Profile shares and follow users to other devices?
• Is it likely that profile resets to fix affected users are being undone by users logging into PCs they used before we reset their profile? If so, would it be best to look at implementing the “delete profiles older than specified number of days” GP temporarily to a low number to clear out troublesome cached profiles? Could the “Prevent Roaming Profile changes from propagating to the server” GP be a useful tool here for fixing the issue?
• Last of all, what could be causing the Local and LocalLow AppData directories to decide to copy back to the Roaming Profile share? How much of a clue are the different ntuser.ini files – could this be another cached profile problem, where fixed profiles are unfixed by users login onto devices with unwanted ntuser.ini settings?

It would be really great to get to the bottom of this, and have student accounts work as well as they do for staff. Many thanks in advance for any help and advice!

[witch]

Anyone got any answers to this? I could do with them too...

[psydii]

Patch patch patch. Then blow away all the exisiting roaming profiles on clients and the server. Everything will work much much better.

Links to patches/hotfixes in this post
W7 + Folder Redirection problems

[mistersparky]

OK, a few updates:

• We have deployed a GPO to disable slow link detection on all workstations across the domain
• We have added the Microsoft KB2775511 updates to our WSUS server to deploy to all workstation PCs - however, we cannot deploy these fixes to our user and roaming profile fileshares as they are currently running on 2008, not 2008 R2 servers. This update is now on 75% of our workstations and counting. However, I am pretty sure we are getting problems both on PCs it is and is not installed on
• We are still getting a slow but steady stream of students with folder redirection settings going missing. I don't think we have once had this for a member of staff, with the only major difference between these users being students heavy use of wireless networks. Could this be related to laptops sleeping/now shutting down, as opposed to general wireless logon attempts?
• We are using DFS-N for our roaming profile and are not using FQDNs for these shares when configuring the profiles. I would be more concerned about both if it were not for the fact that our staff users pretty much never exerience these issues

I've tracked a good number of logins for users who are having these issues, and there seem to be a good number of similarities:

• ntuser.ini file in the root of the users roaming profile resetting to not include the folders configured in GP to not be included in the users roaming profile
• Multiple missing keys under HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer in the users ntuser.dat registry file, including User Shell Folders and Shell Folders
• Event Viewer logs similar to the ones below (taking out direct references to our domain, usernames and directory paths):

09:06:31, ID 1014 (warning) - Name resolution for the name MyISAServer.MyDomain.Local timed out after none of the configured DNS servers responded.

09:06:33, ID 1054 (error) - The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctly.

09:06:33, ID 1129 (error) - The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.

09:07:08, ID 5 (error) - {Registry Hive Recovered} Registry hive (file): '\??\C:\Users\Username\ntuser.dat' was corrupted and it has been recovered. Some data might have been lost.

09:07.13, ID 1542 (error) - Windows cannot load classes registry file. DETAIL - The system cannot find the file specified.

09:07:17, ID 502 (error) - Failed to apply policy and redirect folder "Videos" to "\\Server\UserShare$\My Videos".
Redirection options=0x9000.
The following error occurred: "Failed to get folder redirection capabilities".
Error details: "The system cannot find the file specified.
".

09:07:17, ID 502 (error) - Failed to apply policy and redirect folder "Videos" to "\\Server\UserShare$\My Videos".
Redirection options=0x9000.
The following error occurred: "Failed to get folder redirection capabilities".
Error details: "The system cannot find the file specified.
".

<repeated for multiple redirected folders>

09:07:17, ID 1085 (warning) - Windows failed to apply the Folder Redirection settings. Folder Redirection settings might have its own log file. Please click on the "More information" link.

This has been going on for far too long now, creating extra work and hassle for our users. We would really like to get to the bottom of the issue and in turn would greatly appretiate any help in getting it fixed.

Patch patch patch. Then blow away all the exisiting roaming profiles on clients and the server. Everything will work much much better.

Links to patches/hotfixes in this post
W7 + Folder Redirection problems

Many thanks for the reply. As mentioned, we are deploying the updates across our network now. There are some really great suggestions in there about wireless. Some of them we already do (non-overlapping channels), some of them we don't but at some point I would like to (such as the seperate VLAN for wireless devices, they currently share our student PC vlan). However, although I am pretty confidant that the problem is being created by users logging in on wireless domain devices, shouldn't there be a difference between "now working very well/general slowness" and flat out "breaking things"?