"The Group Policy Client service failed the logon. Access is denied"

[mdking]

Hi all,

 

I do not normally post on here, however I seem to having an annoying problem.

 

Currently some teachers when they loin in the morning are getting this error:

 

 

This started last Tuesday. Its happening on random staff members. Some staff members have this problem once and then it doesn't come back. Staff use raoming profiles. No GPO's have been sent out to the Pc's before the problem started.

 

From our testing we noticed the the NTUSER file is reverting back to 256KB when they receive the error above. To fix this, we are either resetting the profile or replacing the NTUSER file with a backup copy.

 

Does anyone else have a cure for this?

 

Thanks

Matt

[CyberDrac]

My googling on the subject suggested that it was worth checking the list of profiles showing on the system, and comparing that to the "ProfileList" entries in the registry, in some cases there was a discrepancy.

[SYNACK]

We always kill the locally cached profile through the UI to fix this, it is a busted reg that goo can't apply to I think. Delprof2 in a logon script usually takes care of it, just don't apply to laptops with cached profiles.

[gazlee]

Hi, we are having this exact same issue as in the original post on this thread, even down to the profiles reverting to 256k on the server side and us having to restore from backup etc. Can anyone confirm that using the Delprof2 solution worked for them?

 

- - - Updated - - -

 

Hi, we are having this exact same issue as in the original post on this thread, even down to the profiles reverting to 256k on the server side and us having to restore from backup etc. Can anyone confirm that using the Delprof2 solution worked for them?

[Badzeye]

We have been seeing this error here recently only in the last couple of weeks. Deleting the local profile and then having the user log back fixes the issue. I have no idea whats caused this to start happening though.

 

- - - Updated - - -

 

We have been seeing this error here recently only in the last couple of weeks. Deleting the local profile and then having the user log back fixes the issue. I have no idea whats caused this to start happening though.

[mdking]

We have been seeing this error here recently only in the last couple of weeks. Deleting the local profile and then having the user log back fixes the issue. I have no idea whats caused this to start happening though.

 

- - - Updated - - -

 

We have been seeing this error here recently only in the last couple of weeks. Deleting the local profile and then having the user log back fixes the issue. I have no idea whats caused this to start happening though.

 

We are still having this issue. Could @SYNACK please expand on how you got around this problem?

 

Thanks

[Norphy]

I had one with a similar but not the same error, ours was "Windows could not connect to the group policy service client service". I found this on the internet somewhere which fixed that error. It may be worth trying for yours too?

 

There are two places to look in the registry:

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services this path should contain gpsvc key (a folder), which is responsible for service parameters and configuration. I found that the key was intact, so, you do not touch anything here - just check that the key exists.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SVCHOST This is the most important path you should look into, as it must contain the keys and values referred in the key #1. Below are descriptions what must be present there.

There must be Multi-String value called GPSvcGroup. My laptop was missing it. So, you should create multi-string value named GPSvcGroup and assign it value GPSvc.

Next, you must create a key (a folder) and name it GPSvcGroup - this key normally should be there, but, again, it was missin on my laptop.

Then open newly-created GPSvcGroup folder and create 2 DWORD values:

First called AuthenticationCapabilities and you must give it a value of 0x00003020 (or 12320 in decimal)

Second is called CoInitializeSecurityParam and it must have value of 1.

Once you complete all steps above, reboot the computer and the problem will be fixed.

[SYNACK]

We are still having this issue. Could @SYNACK please expand on how you got around this problem?

 

Thanks

 

I just removed the local profiles and if it reoccoured I killed the server copy and just had it rebuild. We got around a lot of it by running delprof2.exe in a machine startup script to clear out the local copies of profiles on each startup which largely cured the problem.

[Michael]

Can't say I've ever seen this error - where's the link between profiles and the Group Policy client error message?

 

I'm speculating you have one more than one DC, hence why some users see the problem and others do not. It could well be one of your DCs isn't replicating data correctly.

[murthybruit]

I just removed the local profiles and if it reoccoured I killed the server copy and just had it rebuild. We got around a lot of it by running delprof2.exe in a machine startup script to clear out the local copies of profiles on each startup which largely cured the problem.

 

I'd be interested to know how you scripted this, it's not really my forte, have had a play with VBS and am now looking at Powershell. I understand DelProf2 has to be run as a local admin, I don't really wish to place the admin password in a VB script, nor do I wish having to enable Powershell across the network clients, so my next option was to look at running a PS script remotely against the machines.

 

I was hoping for this to run as a group policy shutdown script originally.

[SYNACK]

I'd be interested to know how you scripted this, it's not really my forte, have had a play with VBS and am now looking at Powershell. I understand DelProf2 has to be run as a local admin, I don't really wish to place the admin password in a VB script, nor do I wish having to enable Powershell across the network clients, so my next option was to look at running a PS script remotely against the machines.

 

I was hoping for this to run as a group policy shutdown script originally.

 

Just a batch file put in group policy as a startup script that way it runs as system level so needs no extra privilages. I run it at startup because otherwise some of the profiles would not be deleted as they would still be locked in the file system.

[murthybruit]

Just a batch file put in group policy as a startup script that way it runs as system level so needs no extra privilages. I run it at startup because otherwise some of the profiles would not be deleted as they would still be locked in the file system.

 

Thanks for the Response, are you calling the exe from a network share or is it being executed local?

 

Thanks