Group Policy Client Service failed logon - Access is Denied - across network PCs

[swpmre]

Hi everyone,

 

About half way through the day today, multiple users called in because they were receiving the same error message on PCs across our sites. We are an Adult Education Service, with half a dozen sites across the city.

 

"Group Policy Client Service failed logon - Access is Denied".

 

The errors are not consistent. Some users cannot logon anywhere, some can log on some PCs and not others, some do not report any errors... yet.

 

If I delete the user's local profile the user can logon again. But (a) this is not a easy solution for lots of users, on hundreds of machines across the multiple sites, and (b) at least one user who we tested this with said their machine stopped working after a while.

 

All PCs are Windows 7, the network is Windows 2008 Standard Server 32 Bit. We have two domain controllers.

 

The users have Roaming Profiles. BUT, these are not personalised - everyone's profile points to the same folder on the network. They are not able to make changes to the profile locally and the system is set to not copy over the network Roaming folder. Though to test things I have created a new network profile and moved several users to the new profile. This makes no difference to behaviour.

 

So far as I know, there have not been any changes. In the relatively recent past we have had some issues with network speed between sites, but that has been fixed and was related to hardware issues.

 

The only support I can find online are for this error when it appears on a single machine, i.e. not a domain user.

 

Any thoughts anyone?

Edited November 19, 2014 by swpmre

[swpmre]

I suspect that the Roaming Profile on the network has become corrupted.

 

So, I've created a new roaming profile and pointed all the staff members AD accounts too it.

 

This however makes no difference, unless the local profiles on the PC are deleted.

 

If I manually do this (delete them) then the staff can logon ok.

 

However, I can't delete all the profiles, for 200+ machines across the whole city manually. So I am trying to get DELPROF2 to work as a startup script, but I just can't get it to function. Can anyone point me to an online resource which shows me how to setup DELPROF2 to run on startup?

[fairm010]

This is the script I use at startup here. Be aware that dependant on the local profile size this may take a long time.

 

\\server\apps\software\delprof\delprof2.exe /ed:fairm010 /ed:administrator /q

echo %ComputerName% Has deleted old user profiles. >> "\\server\apps\software\delprof\log.txt"

[swpmre]

Ok, I'll give that a try. Many thanks indeed.