My Documents showing when pupils login / no desktop

[LansITGuy]

Morning everyone.

 

I’ve got a very odd issue on most of our curriculum PCs and I was wondering if anyone has seen this type of thing before.

 

Since updating to the latest version of Sophos I get the following chain of events.

 

1 – Computers start in the morning

2 – Pupil logs in

3 – The My Documents folder is shown on screen (no desktop)

4 – Pupil resets PC

5 – Pupil logs in again

6 – Normal desktop shows

 

This happened on Friday and has now happened on the same PCs again today.

 

Nothing is showing up in the Sophos console to say anything has been found. No other software has been added.

 

It must be Monday as I can’t even think why this would happen. Why would a power on be treated differently than a restart?

 

Any ideas would be gratefully received.

 

Cheers.

[Michael]

It sounds to me there's a problem with explorer.exe. Once you're logged in as a pupil (first time), right click the desktop and choose refresh. I'm speculating you're using Folder Redirection.

 

Alternatively if this doesn't work, open up Task Manager, stop the explorer.exe process then select File > New Task (Run) and type in explorer.exe, does this work?

[LansITGuy]

Hi Michael.

 

Thanks for the response. You're right with the folder redirection. The strange thing is that now I'm having major issues trying to replicate the issue. One of our classrooms started doing the same thing this afternoon after not showing the issue for a few hours. So far just about every PC I've tried will not show the error.

 

I'm hoping that the same error will start again in the morning. I'm going to try and get the most commonly effected PCs first thing in the morning.

 

For reference all the PCs are fully updated, but it does seem to mainly be the same models showing the problem.

[Michael]

When logging on as a pupil, from another PC (as an admin) try using MMC and you can view the event logs on remote machines. It may give a clue as to what's happening. If it's particular PCs it could also be a driver conflict. Use signed drivers wherever possible.

[LansITGuy]

Ok, we have had the same problem start again this morning. Once again, first login fails then subsequent logins are fine.

 

I have had a look in the event viewers and I seem to get event ID 1202 (SceCli) followed by event ID 1091 (Userenv) which seems to indicate that the group policy is not loading:

 

“The Group Policy client-side extension Security failed to log RSOP (Resultant Set of Policy) data. Please look for any errors reported earlier by that extension.”

 

I have checked this in the Group Policy Management tool’s Group Policy Results and the same list of errors appear. When a subsequent login happens the error is not there.

 

If the group policy was failing to load because of a network error or a corrupt policy surely it would always fail, not just the first attempt.

[Michael]

How many DCs do you have? And are they replicating OK?

[LansITGuy]

Thanks again Michael for your help.

 

I think you might be on to something here. There are 2 DCs. Our second DC is showing up event ID 13508 (NtFrs). This seems to have started in late October, but it is appearing every day.

[LansITGuy]

Right, I think I was looking at the wrong information.

 

It turns out it may be my other DC (our primary DC) which is causing the problem. I have a number of event ID 13568 messages which all make reference to JRNL_WRAP_ERROR.

 

After doing some reading around this I seem to need to perform a non-authoritative restore of the data in the Sysvol folder.

 

I have found a support article on the MS website which I think will help solve the issue.

 

Support article

 

Has anyone performed this before? Is there anything I need to be aware of? I’m just trying to be cautious as I don’t want to cause any further damage to the network.

 

Cheers.

[LansITGuy]

Sorry to bump this thread but I’m still seeing the same issue and its driving me mad.

 

Just as an update I have managed to clear the server replication errors and everything seems to be fine at that end.

 

All accounts are still seeing the no desktop / my documents window at first logon. All subsequent logons show the correct desktops and all group policies apply (no further event viewer entries and no errors when rsop.msc is checked).

 

What seems odd is that if the computer is started and logged in straight away, we don’t get the error. If a computer is booted in the morning (say before registration) when a user tries to login later (around 15 minutes) they get the error.

[Michael]

In DHCP Server, if you have just your primary DNS listed, does the problem go away?

[LansITGuy]

Hi Michael.

 

Thanks for the reply.

 

I have checked our primary server which is the only DNS server on the network. Its the only one listed in the DNS MMC and no errors are showing.

 

Cheers.