Roaming Profiles going screwy

[azrael78]

I would love to know what causes this - we have a similar issue here to a much less of an extent yet I've never managed to find a single method to reliably reproduce the problem.

 

The quickest 'fix' is to simply wipe the profile and let it rebuild - but every single time it gets corrupted it's so hard to find out what happened.

 

I'm sorry if it seems like I'm asking too many questions solitaire89 but I'm aware of how frustrating these 'undocumented features' can be and have been working for some time to isolate the cause and find a solution.

 

What size school are you? Primary/Secondary - I was going to suggest you turn off 'delete cached copies of roaming profiles' so that you can have an idea of what stage the problem occurs - but in a secondary environment where many people roam - it would be less than a good idea, particularly if all of your users have roaming profiles.

 

I'm going to kick things up a gear here and see if I can grab a corrupt profile before my colleagues fix it and try to wrangle the info out of the user... hurrah!

 

I will keep you posted though on anything I find out, even if it's pointless to us - it may well help you or someone else with a similar issue later

 

Az

[round2it]

http://www.microsoft.com/downloads/details.aspx?FamilyId=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en

 

have you tried the user profile cleanup tool

 

BTW are you using xp sp3 now as i have had problems with profiles not unloading when the user logs off

ever since i installed sp3

 

The User hive cleanup tool along with delprof fixed the issue for us

Overview

The User Profile Hive Cleanup service helps to ensure user sessions are completely terminated when a user logs off. System processes and applications occasionally maintain connections to registry keys in the user profile after a user logs off. In those cases the user session is prevented from completely ending. This can result in problems when using Roaming User Profiles in a server environment or when using locked profiles as implemented through the Shared Computer Toolkit for Windows XP.

 

On Windows 2000 you can benefit from this service if the application event log shows event id 1000 where the message text indicates that the profile is not unloading and that the error is "Access is denied". On Windows XP and Windows Server 2003 either event ids 1517 and 1524 indicate the same profile unload problem.

 

To accomplish this the service monitors for logged off users that still have registry hives loaded. When that happens the service determines which application have handles opened to the hives and releases them. It logs the application name and what registry keys were left open. After this the system finishes unloading the profile.

Edited February 25, 2010 by round2it

[DMcCoy]

It's not after they change password is it? As the roaming profile will not load after the user changes their password in with XP SP3 unless you have applied a hotfix or rebooted the machine.

[solitaire89]

This is the old "Symantec" problem isn't it?

 

Eh?!

 

Anyway, that is simply corrupted ntuser.dat files. Do you have a backed up copy of a known good ntuser hive that you can restore to a "faulty" user to test this theory?

 

Not as such - but am I still going to be in the situation where it fixes the immediate problem, but not the root cause?

 

ARGH - KILL ALL ROAMING PROFILES!

[solitaire89]

I would love to know what causes this - we have a similar issue here to a much less of an extent yet I've never managed to find a single method to reliably reproduce the problem.

 

The quickest 'fix' is to simply wipe the profile and let it rebuild - but every single time it gets corrupted it's so hard to find out what happened.

 

I'm sorry if it seems like I'm asking too many questions solitaire89 but I'm aware of how frustrating these 'undocumented features' can be and have been working for some time to isolate the cause and find a solution.

 

What size school are you? Primary/Secondary - I was going to suggest you turn off 'delete cached copies of roaming profiles' so that you can have an idea of what stage the problem occurs - but in a secondary environment where many people roam - it would be less than a good idea, particularly if all of your users have roaming profiles.

 

I'm going to kick things up a gear here and see if I can grab a corrupt profile before my colleagues fix it and try to wrangle the info out of the user... hurrah!

 

I will keep you posted though on anything I find out, even if it's pointless to us - it may well help you or someone else with a similar issue later

 

Az

 

I can't reproduce it either... As I said - utterly and entirely random. And we employ the same "fix", but still have to re-do the e-mail and re-direction.

 

We're a "whole way through" school - babes in arms to VIth form... And yes, lots of roaming!

 

If you could keep me posted, that would be great - Thanks

[solitaire89]

It's not after they change password is it? As the roaming profile will not load after the user changes their password in with XP SP3 unless you have applied a hotfix or rebooted the machine.

 

Nope, there's nothing that anyone does to trigger it that I can tell... I've had mine go twice over the last few weeks, and I can't see any pattern yet.

[solitaire89]

 

have you tried the user profile cleanup tool

 

BTW are you using xp sp3 now as i have had problems with profiles not unloading when the user logs off

ever since i installed sp3

 

The User hive cleanup tool along with delprof fixed the issue for us

 

Yes, we are using sp3, but the first time we had the issue, I believe we were at sp2 (don't quote me though )

I haven't tried that tool - will give it a go! Many thanks

[DMcCoy]

In general there is only a finite set of things that can break profiles:

 

Busy or unreliable file server (there can be many thousands of files in each profile)

 

Busy or unreliable network

 

Process holding the user.dat file open when logging out. AV, remote managment etc are usual suspects for this.

 

XP SP3 password change bug

 

Slow link detection enabled

 

Wait for network at boot *disabled*

 

It is possible to enable debug logging on machines to narrow down any errors when it goes wrong

[azrael78]

I can't reproduce it either... As I said - utterly and entirely random. And we employ the same "fix", but still have to re-do the e-mail and re-direction.

 

We're a "whole way through" school - babes in arms to VIth form... And yes, lots of roaming!

 

If you could keep me posted, that would be great - Thanks

 

What's the e-mail and re-direction you have to keep putting in?

Is that your Outlook PST settings etc?

If so I've got a script that our LA used to use for Outlook that would do all this for you - we don't use it here as most of our Outlook users use archiving and the script has trouble handling that.

 

If by re-direction you mean folder - this could be done via Group Policy, if it's anything else (but simple registry tweaks) I could always whip you up a quick Group Policy template to do this for you in Group Policy - so you have less to do when it goes wrong

 

We have Year 7 until Year 13 here - but still lots of roaming, except our kiddies share a single mandatory profile - if only our staff did

 

I'm going to look at pushing out UPH Clean (the tool that round2it posted a link to) as we used to have this on every XP box but since our numerous XP image updates, it may have fallen through the cracks and may well solve the problem or at least eliminate a possible avenue of enquiry.

 

As for the Symantec issue - it seems that there was an issue that regularly caused profile corruption with Symantec AV where it would perform virus-scanning at logon - we don't run Symantec here so it's a non-starter for us.

 

HTH,

 

Az

[steveo2000]

We have a similar issue and i've narrowed it down to wireless, pulling the profiles through on wireless can sometime corrupt them hence the need to remove and rebuild. I simply disabled roaming profiles on laptops through GPO and it hardly happens now! Very odd but seems to have worked!

[Number6]

This is the old "Symantec" problem isn't it?

 

.

 

Eh?!

 

 

This goes back a couple of years, maybe three, when Symantec AV seemed to "reset" random ntuser.dat files to 256Kb, see here for example:

 

Roaming Profiles and Ntuser.dat corruption

[solitaire89]

It is possible to enable debug logging on machines to narrow down any errors when it goes wrong

 

Sounds like a plan, but as it looks like the error could occure at previous log off rather than log on, does that mean we're going to have to enable it on all machines?? Isn't that going to cause problems?

[solitaire89]

What's the e-mail and re-direction you have to keep putting in?

Is that your Outlook PST settings etc?

If so I've got a script that our LA used to use for Outlook that would do all this for you - we don't use it here as most of our Outlook users use archiving and the script has trouble handling that.

 

If by re-direction you mean folder - this could be done via Group Policy, if it's anything else (but simple registry tweaks) I could always whip you up a quick Group Policy template to do this for you in Group Policy - so you have less to do when it goes wrong

 

It's basically setting up the e-mail account again, and pointing it in the direction of the pst which is not in the profile, but the user's home folder.

My docs is setting the target folder location... Can that be done by GP? I think I'm really going to have to push for this training...

As for Symantec - nope, we're on AVG.

[solitaire89]

We have a similar issue and i've narrowed it down to wireless, pulling the profiles through on wireless can sometime corrupt them hence the need to remove and rebuild. I simply disabled roaming profiles on laptops through GPO and it hardly happens now! Very odd but seems to have worked!

 

sadly it doesn't appear to have any correlation to users using a wireless connection.... Good thought though, thanks

[azrael78]

It's basically setting up the e-mail account again, and pointing it in the direction of the pst which is not in the profile, but the user's home folder.

My docs is setting the target folder location... Can that be done by GP? I think I'm really going to have to push for this training...

 

I can probably dig that script out for you if you are having issues still.

In regards to GP, yes you can redirect my documents via GP and I'd definately push for training.

 

To redirect my documents:

 

Open the desired GP object (as if you were going to edit it)

Go to User Configuration -> Windows Settings -> Folder Redirection

You should see 'My Documents' - if you right click this and go to Properties, it will allow you to configure it to your liking.

 

It's worth noting that 'Grant the User Exclusive access to my documents' and 'Move My Documents to the new location' are better off disabled as they can cause no end of hassles.

 

What kind of training are you thinking of?

 

HTH,

 

Az