Mandatory Profiles not loading some of the time

[cookie_monster]

We have recently moved our domain to Server 2008. Everything seems to be working fine, software will roll out via GPO, GPO settings all apply, DNS checks out and Netdiag/DCDiag both run and everything looks ok. The main difference to last year is that two of our DC's are now virtual (and server 2008) with the 3rd DC being a physical 2008 box.

 

The only real issue that I’m having is that profiles are failing to load at random, we use a Default Profile hosted in the server netlogon share which worked flawlessly until this year now at random some people aren't getting it. They still get a start menu and desktop as they're configured using folder redirection but applications don't have any settings. To try to solve this problem I’ve temporally set a mandatory profile in the users tab but this is having the same issue.

 

I was thinking it might be due to load but when I watch the servers during logon the servers are hardly under any load and I can see that logons are being distributed between the three DC's.

 

I'm going to have a scour through group policy to see if there's a setting to force XP to wait for the remote profile can anyone suggest other things to check?

 

Thanks.

[azrael78]

Try this on a client:

 

1) Clear event log entirely.

2) Login - note whether it fails or succeeds.

3) Note the time at which it did the above.

4) Keep trying to login until it does the opposite of #2.

5) Examine the event log to see if anything odd appears, also check userenv.log.

 

What clients do you have? XP SP2?

 

Az

[cookie_monster]

When a user logs on there are four messages confirming that the folder redirections applied e.g.

 

Successfully redirected folder Start Menu. The folder was redirected from  to <\\SERVER1\netlogon\Desktops\students\Start Menu>.

 

but I don't see any errors in the application or system log.

 

I've sat and logged on and off loads of times and i'm not seeing the issue. I looked into a suite earlier and there's 20 students logged on without a profile so I popped in and logged on as a student but still received a mandatory profile.

I'm keeping an eye on the userenv.log so i'll post if I see anything in there.

 

Cheers.

 

EDIT

 

The only line that I can see that seems related it this but there isn't an ntuser.ini file in the profile on the server:

 

GetExclusionList: Failed to get file size of 

 

The profile is located at \\%logonserver%\NETLOGON\Profiles\students

 

Oh and to answer your other question, we have XP SP2 and SP3 clients.

Edited September 9, 2009 by cookie_monster

[john]

I am having the exact same problem Grant. I cannot replicate it at all, all test accounts work fine but yet Y9s come in logon on and all get a semi-mandatory profile?! Its very weird yet all the other year groups are fine from waht I can see, I think the system has taken a dimm view of Y9 or something?!

[DMcCoy]

I'm going to have a scour through group policy to see if there's a setting to force XP to wait for the remote profile can anyone suggest other things to check?

 

The users hadn't just changed their password had they? (via change password at next logon)

[cookie_monster]

The users hadn't just changed their password had they? (via change password at next logon)

 

Possibly why?

[DMcCoy]

Because unless you apply the hotfix any mandatory/roaming/network profile will no load after the user changes password

 

Same issue in this thread, along with the link to the hotfix

 

http://www.edugeek.net/forums/windows/40926-very-weird-logon-problem-mandatory-profiles.html

[cookie_monster]

I'll have a read thanks, seems odd that it's just started happening. We upgraded our AD from 2003 R2 to 2008 over the summer but all of the clients are at the same patch level.

[azrael78]

Because unless you apply the hotfix any mandatory/roaming/network profile will no load after the user changes password

 

Same issue in this thread, along with the link to the hotfix

 

http://www.edugeek.net/forums/windows/40926-very-weird-logon-problem-mandatory-profiles.html

 

That's exactly what I was thinking.

 

If the clients are SP2, this may not be an issue but we recently got hit with this on our SP3 suites.

 

We installed the hotfix and it seems *touch wood* to have gone away.

 

Hope it's the same for you

 

Az

[cookie_monster]

If the clients are SP2, this may not be an issue but we recently got hit with this on our SP3 suites.

 

Ahh ok it's a bit intermittent on SP2 boxes but nearly all the time on SP3 boxes and as it's the start of term it stands to reason everyone is changing their passwords. I'll let you know.

[cookie_monster]

Nice one guys it's looking promising I searched the forums for all sorts of profile issues yesterday but that thread didn't come up.

 

Any idea if this will be appearing on WSUS or am I going to have to add this to our images?

Edited September 10, 2009 by cookie_monster

[cookie_monster]

Any of you have a way to automate the rollout of this patch?

[azrael78]

Any of you have a way to automate the rollout of this patch?

 

Unfortunately no - we only got hit in 3 suites and it was quicker for us to run around and patch them remotely.

 

I guess you could hook into the login script with a few parameters - try running the patch with a '/?' on the end.

 

Aside from that, unless you have SMS or something - you may have to do it manually.

 

As for your images - I'd update them too

 

Az

[cookie_monster]

I've patched the image now and the problem is starting to go away now that they've all changed their passwords. This has probably been an issue for a while but only became obvious after the 6 week hols as our passwords expire every 45 days so they all needed changing this week which made the problem worse. We also imaged two more rooms to SP3 over the summer.

I was a bit worried it was to do with our move from 2003 to 2008 DC’s but I can relax now I know that's ok

[cookie_monster]

Hmm I applied the patch to a flat WDS install using the "servicepackfilename /integrate:drive:\XPfolder" command and the files appeared in the i386 folder but when I build a PC I still need to apply the patch. I've used this method before and it's worked, in fact I can see the previous patch files alongside the new on in the folder.

 

Any ideas why this is not installing?

 

Cheers.

[rh91uk]

Thanks for this! Solves the same problem we were having!

 

We deployed this using a script and it seemed to work.

[RalphG]

Just wanted to say thanks as we were having same issue at our school as well, will try hotfix on friday.

[azrael78]

Hmm I applied the patch to a flat WDS install using the "servicepackfilename /integrate:drive:\XPfolder" command and the files appeared in the i386 folder but when I build a PC I still need to apply the patch. I've used this method before and it's worked, in fact I can see the previous patch files alongside the new on in the folder.

 

Any ideas why this is not installing?

 

Cheers.

 

No idea mate - from what I gather the patch is just a single file that gets updated.

Can't recall the file... lsa.dll? Something like that.

 

Can you not just inject the file straight into the image?

 

Az

[cookie_monster]

It is just that file and it appeared in the i386 directory I assume overwriting the other file but it didn't solve the issue on a new install. I've only tried one so far so I'll give it another try tomorrow.

[john]

Thanks I'll give that a try tomorrow and fingers crossed it will work for us as that would fit as its fine for all other years bar year 9 IE the new starters I assume its all fine the 2nd time of logon (not seen any new users logon for a 2nd time as im jst in lessons this time as its 1st IT lesson in new school etc)

[cookie_monster]

Yes it's fine on the second logon. The problem that I was having was that pretty much everyones password had expired so it was happening to everyone. We've done so much work over the hols that I was having trouble getting to the bottom of the issue expecially as I couldn't replicate the issue as my test users password didn't need changing

 

If I can just get it to slipstream I'll be a happy Monster

[cookie_monster]

All sorted now I slipstreamed it onto the correct image this time and it works, hehehe

 

 

Thats a classic MS blooper, fancy missing that during testing a new SP.

[cookie_monster]

Is this working 100% of the time for you all? I've applied the patch to a room of XP SP3 clients but I'm still observing the issue occasionally, as most of the students have now changed their password it's difficult to tell if the patch actually did anything.

[jimmy_2k]

Phew, during the summer holidays I had the site updated to the current WSUS updates as no one had deployed these before I started at my new school. Of course this week I have been stung by this issue and we got a call yesterday to say OFSTED are turning up on Tuesday, so I hope this works as I have only Monday to fix it!!!

[cookie_monster]

It should, if it doesn't then use a robocopy script to copy a good profile over the local 'default profile' as that's what it defaults to when it fails to load the roaming profile.