The User Profile Service failed the logon. User profile cannot be loaded.

[Henley_IT]

We are having an intermittent problem with the user profile service on Windows 7 machines. The message "The User Profile Service failed the logon. User profile cannot be loaded." is appearing on seemingly random machines (around 10% of all machines daily, and not the same ones). The problem started a few days ago, after 4 months of successful Windows 7 use. The only note worthy change to the network was turning on scavenging on some of our DNS zones (the action was subsequently rolled back).

 

When investigating the event log of the machine the only notable error in the logs was a Distributed Com Error (EventID 10016) with the following text:

 

The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID

{24FF4FDC-1D9F-4195-8C79-0DA39248FF48}

and APPID

{B292921D-AF50-400C-9B75-0C57A7F29BA1}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

 

This appears to be referring to the NAP service, but I haven't been able to identify any correlation between the two.

 

We have found that repeated re-boots will eventually allow the machines to login. We have also found some of the machines do not have matching forward and reverse lookup DNS entries, and when these are edited to match and the machine reboot it will start working, but neither is a permanent fix, as some of the machines we have done this to are repeating the problem later.

 

Oh, before the question comes up, we are working with Roaming profiles with folder redirection.

 

Can anyone suggest anything? Our staff and students are losing patience, and we are running out of ideas.

[Rozzer]

Hey I to am having this issue did you ever get round to sorting it?

 

Ross

[Ric_]

I did have a similar sounding problem... see Ric's Blog: Windows 7 Profile Woes for what I tried

[mjs_mjs]

we get that too, but sometimes we just reset the profile and it works other times we tell them to restart and it works. we're CC4 Sr2 win 7 enterprise on 2003 (r1) domain.

[Henley_IT]

Sorry Ross2k5, we didn't get a solid solution for this yet. I was amazed that no-one on any forum we posted wanted to touch it! The problem has slowly petered out by using the method of manually changing the pointer records and re-booting. We have gone from 40 - 50 a day to 2 - 5 a day, but it is still completely random. I can't manually re-create the problem on a PC by replicating the DNS scenario, so I can only assume the fault it isn't entirely there... but I have no idea how else to approach it. We have now cleared the DCom error from the start-up (the NAP service was not starting properly due to a missing permission. We have now propogated the service settings from group policy, and it seems to work), but with it being half term here we don't know whether this had any effect on the problem with the clients yet.

 

One thing that is still bugging me is the fact that our clients/dhcp are not creating valid pointer records in the DNS. We have tried adding permissions to the dnsproxyauto, and have confirmed that the dns settings in the DHCP are set to create and update both the forward and reverse lookups, but still no joy. If anyone could help with that, it might be helpful?

[Jamo]

I have come across this when Vista first came out. Was to do with a corrupted section of the registry in the profile section. I used to follow method 1 on the following microsoft tec

 

Error message when you log on to a Windows Vista-based or Windows 7-based computer by using a temporary profile: "The User Profile Service failed the logon. User profile cannot be loaded"

 

Hope that helps

[Henley_IT]

Thanks for the idea Jamo, but we were aware of this issue prior to these problems and tried the fix with no success. It does work when a user roaming profile gets corrupted and a copy retained on the PC though, so anyone else reading this post with these symptoms should give it a try.

 

For now the problem seems to have subsided here. We haven't seen it in a few days, leading me to believe that either the DNS scavenging that we set up and subsequently removed was some how responsible, or we inadvertently fixed the problem but PCs logging on for the first time after it was fixed still needed a helping hand to logon to the network, but once on the problem didn't re-occur.

 

Either way, it is a pain to not be able to put a finger on the problem, and we will always run the risk of it happening again if we don't know how to avoid it. Any further suggestions would still be appreciated.

[DEvans]

I had the exact same issue on one of my school's networks. The whole network failed on the logon and only the local admin was able to login.

 

The cause of mine was Internet Explorer 9. Deployed it via group policy using the IEAK to build the MSI. As soon as it installed on the machine, no user was able to log in.

 

Didn't have anything to do with corrupt profiles etc, just an epic fail on the machine itself. Uninstalling IE9 also did not solve the issue, needed to be rebuilt.

 

Sticking to WSUS deployment now as another technician I know found that it works far better than MSI deployment.

 

That was the cause of mine anyway.

[TheMinister]

Try:

 

Deleting all profiles except locals under c:\Users and removing their reference out of the registry.