NTuser.dat corruption on logon

[karlb]

Hi

 

I've got a problem with a laptop that is corrupting the ntuser.dat for a roaming profile user when logging on. It doesn't happen all the time, but still frequent enough to be a pain.

 

What seems to be happening, is when the user logs on, the ntuser.dat is not copied properly to the local machine and either creates a fresh one or uses the partially copied file. The ntuser.dat goes from about 2.5mb to 256KB.

 

The laptop is running win xp sp3.

 

As anyone else had this problem?

 

All the best

 

Karlb

[FN-GM]

Is it pulling it from the default profile?

[karlb]

Possibly, but I'm not sure. There is no indication in event viewer of what's causing the problem or if the users ntuser is being replaced by the default user one.

 

All the best

Karlb

[Reaper]

This probably won't help as it works on logoff but it is useful to have it on your image so that profiles don't become corrupt and then get stored on the server.

 

Download details: User Profile Hive Cleanup Service

[karlb]

Hi Reaper, thanks for the reply.

 

All our machine already have the User Profile Hive Cleanup Service installed as default, but still have the problem with this machine.

 

I think the problem may be caused by the Windows fast logon optimization setting, which is on by default. This setting will start the logging on process before the network is ready, which could mean that it's trying to load a deault profile, then realises that the network is available and then start loading the profile from the network, which then corrupts the ntuser.dat and copies it back to the network when logging off.

 

The solution is to enable the following setting in the local group policy.

 

Computer Configuration -> Administrative Template -> System -> Logon -> Always wait for the network at computer startup and logon. This setting needs setting to enabled, and it will take 2 logons for it to take effect.

 

I don't if this solves my problem yet, but so far it seems to be working.

 

All the best

KarlB

[reneb]

Is this old ntuser.dat issue solved for you by the mentioned solution?

We're having a huge amount of incidents on a complex W7 infrastructure with the same symptoms (corrupt ntuser.dat files from 256 Kb). Hundreds of INC a week since last summer, in a >15K users environment.

Thanks in advance!

[dudleyar]

Any news on this 6 Years Later and we are having this issue on a Windows 7 Network, a lot after the summer break,

 

Thanks

 

Andy

 

- - - Updated - - -

 

Did you ever resolve this issue?

[Arthur]

KB2918893 - User profile corruption after you lose network connectivity?

[dudleyar]

Thanks for the Reply, did you install the Hotfix on All your Windows 7 Machines? Or just your File Server?

[Arthur]

Thanks for the reply, did you install the hotfix on all your Windows 7 machines? Or just your File Server?

Our file servers are all running 2012 R2, so just the Windows 7 PCs. Which OS do you have on yours?

 

It's probably also worth installing the KB2775511, KB2728738 and KB2732673 hotfixes. @psydii might know of a few more that are worth trying too.

[dudleyar]

Our File Servers are running 2008R2 but our Clients are all Windows 7 x64 Enterprise, I will install it on our Clients, its a shame it can't be deployed via WSUS! Thanks for you help Arthur

[cogrady84]

Did this fix anyone's problems? I've deployed this to all of my laptops and still seem to be having the issue... does the server hosting the profiles require patching aswell?

[dudleyar]

This has not fixed it for us, I thought it had, but we have just had a profile go corrupt today , we went a whole week without an incident as well! So maybe it helped I am not sure

[Arthur]

does the server hosting the profiles require patching as well?

Yes. I'm pretty sure you do.

Edited October 7, 2015 by Arthur

[cogrady84]

I deployed the hotfix on the 25/09, expecting to see some results by now, but we're still seeing ~10 laptops per day with corrupt profiles. The problem has only become much more apparent in the last ~3 months, as if a recent update from WSUS has banjaxed something completely. I'm considering ensuring our entire profile redirection infrastructure is in place and moving to local profiles for all users, which is going to be a bit of a nightmare, but i'm sick of seeing this problem now...

 

Presumably Microsoft are reluctant to consider this problem seriously since Windows 10 is available and if we don't like it, that's the solution? Frustrated!!

[dudleyar]

Last Monday I patched the Servers as well, and since then until today, we did not have one Profile go corrupt!

[dudleyar]

I feel your pain my friend, I have felt the same since it started Plaguing us when we moved to Windows 7 4 Years ago, should have stayed on XP , I have even spoken with Microsoft on the Phone, managed to get a remote session! But they were about as useful as a Chocolate Teapot

[cogrady84]

The only other possible lead I have seen relating to this problem is devices with Atheros network cards, although I have rolled out the latest driver update to all of my laptops and included the latest driver in my most recent WDS build and the issue still persists.

 

I'll patch my file server and dc's with this hotfix, hopefully that will have the desired effect!

[cogrady84]

I've patched my 2008 R2 dc's now, but my 2012 r2 file server already has KB2919355 installed apparently. So unless this problem is linked to my DC's aswell, I don't see a resolution coming from fixing my servers alongside my clients... ARGHHHH