Setting Pagefile to help with Userenv 1508
xrbbaker
80 GB drive
C: partition = 12.89
D: partition = 60.45 (according to Belarc)
Pagefile 2048-4096 on C:
This box serves solely as a terminal server. At most I have 3 people logged
on to it at the same time, typically just 1. We frequently have issues where
when logging in Windows the box says it can't load their profile. The event
viewer shows the 1508 suite of messages. If I reboot the machine the problem
goes away for a day or a few days, and then it is back and I have to reboot
again.
From the posts it seems this is typically caused by low resources. I'm
ruling out security rights since it does work most of the time. My C: drive
has only about 1.15GB free. I notice that prior to reboot I'll have 1.15
free, and after reboot I still have 1.15 free, but as I say, then things
start working again.
Is it possible that 1.15 GB is not enough free space on the C drive? Could
that be the lack of resources that is choking up Windows? It seems hard for
me to believe that we are stressing out this box with 1-2 people a few hours
a day running things like Word and Excel.
I read some posts about maybe the Pagefile being part of the problem. I've
just now changed the Pagefile setting to C: 1024-2048 and added a second
Pagefile to D: 2048-4096. This leaves 2+ GB free on my C: However, now I'm
reading on http://www.petri.co.il/pagefile_optimization.htm that I shouldn't
have allocated 2 Pagefiles on the same partition because the drive head will
swing around like crazy.
My D: drive has 50GB free. I'd like to have the Pagefile over there on the
D partition, but the above link also states that you should always leave some
allocation on the C drive!!
Can someone give me some advice for how I should configure Pagefile to
hopefully leave more resources available, which hopefully will mitigate the
1508 issues?
Thanks for any insight,
MattShell
would drop in more RAM and disable the PageFile altogether. I find Windows
does a pretty bad job of mangainge the page file myself, (although Windows
Sever 2003 does a better job than many before it). If you would like to
disable the page file, log on as and admin, right click on my computer, left
click on properties, go the the "Advanced" tab, click on "Settings" inside of
the Performance box, click on the "Advanced", now click the "Change" button
on the Virtual memory box. From here you get a window you can custimize
anyway you want. You might be able to change the paging file size to a
smaller size than the C: drive has and this might help as well, however I
think more RAM an no page file is a way to go. Note here, once you make any
changes, you will have to restart the server.
Matt
xrbbaker
I guess it can't hurt on the memory for sure. THe problem with no Pagefile
is that I read something about if there is ever a system dump the only way
that information gets written is if you have a Pagefile allocated. No file,
no dump - and apparently the dump is pretty important (or so I read.)
Man I just wish I could shove some of the D: partition available space over
to the C: partition. I guess there is just no way for that to be done?
thanks
TP
Please post the exact error messages in the order that they
appear in your log.
When this problem occurs, are *all* users unable to logon,
or just certain users? If one or more users log off, are the user
or users who had the problem able to logon (without restarting)?
Just to confirm, you are running the 64-bit edition of 2003?
In general, what numbers are you seeing for commit charge
total, paged, nonpaged memory?
Thanks.
-TP
Josh Rosenberg [MSFT]
would be to use junction points to redirect certain directories, so the
folder still appears to exist on the C: drive, but actually points to a
folder on the D: drive at the file system level.
Take a look at:
http://www.microsoft.com/technet/sysinternals/FileAndDisk/Junction.mspx
I believe a similar tool is provided with the Windows Resource Pack, but
they both use the same hidden functionality in NTFS. Unlike a shortcut,
they are treated as a directory by anything that tries to read them, which
removes a lot of the problems that exist when you use shortcuts for the same
purpose.
You'll need to be judicious in their use (don't use it for system
directories by and large, and you may have some permissions issues if the
permissions on the junction don't match the permissions on the target
directory), but they should work as a stopgap measure for a while.
--
Josh Rosenberg [MSFT]
SDE - Terminal Services
"xrbbaker" <xrbb...@discussions.microsoft.com> wrote in message
news:6C813E0F-57F9-4494...@microsoft.com...
xrbbaker
I can't reproduce the user message that pops up, because it hasn't happened
again since I changed the Pagefile. However here is what the log file shows.
The same series of messages occur for various users. This is 64 bit
version. :(
Keeping about 2.1GB free on C drive now
Commit charge
total 569,072
Limit 4,990,764
Peak 670,528
Physical Memory
Total 2,095,100
Available 1,394,644
System Cache 479,344
Commit Charge (bottom right Task Manager)
550M/4873M
userenv 1511
Windows cannot find the local profile and is logging you on with a temporary
profile. Changes you make to this profile will be lost when you log off.
userenv 1515
Windows has backed up this user's profile. Windows will automatically try to
use the backed up profile the next time this user logs on.
userenv 1502
Windows cannot load the locally stored profile. Possible causes of this
error include insufficient security rights or a corrupt local profile. If
this problem persists, contact your network administrator.
DETAIL - The process cannot access the file because it is being used by
another process.
Userenv 1508
Windows was unable to load the registry. This is often caused by
insufficient memory or insufficient security rights.
DETAIL - The process cannot access the file because it is being used by
another process. for C:\Documents and Settings\noel.posavec\ntuser.dat
THANKS TP!!
xrbbaker
Regards
TP
This is not a resource issue. The user's profile was in use
and therefore unable to be loaded. The most likely cause
of this is the profile did not unload properly the last time
the user logged off.
User Profile Hive Cleanup Service (UPHClean) will
normally help this situation, however, the most current
released version does not support x64. For x64 you can
try the UPHClean 2.0 Beta.
Send an email to uphclean *AT* microsoft.com, explaining
that you are having profile unload problems with 2003 x64
and you would like to help with testing the beta version.
Besides trying UPHClean, you may be able to reduce the
problem by changing/updating the software that you are
running. A good first step is to remove unnecessary things
running in the background, for example, programs that run
automatically for each user, Alternative User Input (ctfmon.exe),
etc.
What software are you using on this server? Some things I
would look at updating/changing are Antivirus/Security software,
printer drivers, backup agent software, etc.
Are you using the local drive redirection feature? If you are and
you don't use it, disable it and see if that helps.
Have you installed SP2 yet? If not it is worth a try.
Windows Server 2003 Service Pack 2 for x64 Editions
http://www.microsoft.com/downloads/details.aspx?FamilyID=08fec2f5-6e3b-4e0d-9314-646414d0a421
-TP
xrbbaker
1) Should I be nervous about the Beta on my prod box? The good news is it
is a pure term server so worst case if I screw something up is I can't remote
in for a while, but still... Beta makes me nervous.
2) I do NOT have SP2 loaded yet. Last I looked it too was in Beta. If it
is GA I'll definitely slap it on.
3) We are indeed running NOrton on that box. I don't know what I can do
about that, but I do also notice some funky printer driver messages everytime
somebody logs in. I'll see if I can put a stop to that.
Thanks,
Russ
TP
Sorry I didn't get back to you sooner.
Yes, you should be nervous about loading a Beta, especially given
the nature of what UPHClean does. It is a judgement call on
your part as to whether or not it is worth the risk. Others have
used it with success, but that does *not* mean that your server will
not crash or have issues while using it.
Based on your comment, it sounds like it would not be the end of
the world if you had problems with the beta. Use google to find
some comments from other users.
SP2 is released, so far I have not had anything but minor issues
with it--nothing that stops me from recommending it to you.
The link to downloading it is in my other reply to you.
It is possible that your Antivirus could be causing this. See if there
is an update and/or remove it temporarily to see if the problem
goes away. A TS that is properly configured and secured should
not have major virus concerns anyway. It is common for me to
build terminal servers without antivirus software running on them.
The printer errors you are seeing are most likely normal. They
indicate that you don't have a driver mapped for one or more
printers that exist on your clients. See this document for
instructions on creating a custom printer driver mapping file:
Windows 2000 Terminal Services server logs events
1111, 1105, and 1106
http://support.microsoft.com/kb/239088
I referenced print drivers before because there *may* be a
print driver running on your server that holds resources open
and thus prevents the user profile from unloading.
Thanks.
-TP
xrbbaker
my firm and am knolwedgeable enough to be dangerous, but we're starting to
get over my head here. He's going to grab the UPHClean and give it a try and
make sure SP2 is on there. For whatever reason since I freed up a couple GB
on the C partition I haven't had a problem since. It probably just takes
longer to occur.
Regards,
Russ
xrbbaker
Hope you are still with me...
I requested, received and applied the UPHClean beta 2.0. Installed Sunday
as per instructions. Had great hopes. Today when I remoted in, I got the
usual series of errors: 1508, 1515, 1502, 1511 - starting with the 1508
stating:
Windows was unable to load the registry. This is often caused by
insufficient memory or insufficient security rights.
DETAIL - The process cannot access the file because it is being used by
another process. for C:\Documents and Settings\russell.baker\ntuser.dat
I sent my results to the UPHClean MS team. Do you have any ideas what else
I might try?
thanks
TP
Does UPHClean log any errors regarding being unable
to free the resources?
First lets make sure it is the system that is holding open
the user's registry hive file. Download and install Process
Explorer:
http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx
When the problem occurs, logon as an admin account
(different than a problem account), and then run Process
Explorer. On the Find menu, choose Find Handle and
then enter ntuser.dat and click search. After a few moments
you should see a list of all the user hive files currently
loaded. Find the "problem" one in the list and make sure
that the process for it is listed as System. Do *NOT* try
and force the handle closed because this will most likely
crash your server.
Secondly, when this happens, are you able to manually unload
the problem user's hive? This is accomplished by logging on
as an administrator account (must be different than the
problem user), navigating to the problem user's key in
the registry, selecting it, and then choosing Registry-->Unload
Hive.
In order to find the user's key you need to first look up the
user's SID. You can do this by navigating to the following key
in the registry and then using find to search on the user name:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
The user name will be part of the ProfileImagePath registry value.
The SID is the parent key name that the ProfileImagePath is
contained within. For example,
S-1-5-21-3829217777-1253468217-3731238512-1005
Now that you know the SID, locate it under HKEY_USERS,
click to select it, and then choose Registry-->Unload Hive.
Have you removed and/or updated your Antivirus software?
-TP
xrbbaker
I downloaded the procexp. Cool tool. I don't know what I'm looking at but
it looks neat. One thing I noticed when doing a dry run is that in my
ProfileList in the Registry I have lots more profiles then I have users.
There are old profiles listed here. Q1: Is it ok for me to delete them?
These old users don't even exist in the Active Directory any more.
My userid is russell.baker. I'm also one of the problem children that
occassionally get the can't load profile issue. I noticed in the profile
that there are 2 russell.baker entries. Q2: Is it ok for me to do the trick
where I look at HKEY_USERS to see which russell.baker is actually in use, and
then delete the other one?
Q3: I have not yet removed the Symantec AV. If it is the culprit would I
expect to see it somewhere, like attched to my ntuser.dat?
NEWS FLASH - the other person who gets the "can't load..." problem is
noel.posavec. I noticed that like me, there are 2 entries for noel.posavec.
Could this be the problem - some confusion about the correct profile to use?
Q4: Can I delete one of them?
This is gettin exciting!!
Thanks
TP
Okay I have heard of the multiple profilelist entries causing this
even though I have not experienced it myself.
Before you go deleting entries we need to do a bit more
investigating and take some precautions.
First, backup the keys as a precaution.
This is accomplished by navigating to the following keys (one at a
time) in the left-hand pane of regedit and choosing Registry-->Export
Registry File menu option. Save the files on your desktop.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileGuid
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
You are doing this so that you have a backup of the existing
settings in case you need to restore them later. If you do need
to restore them, simply double-click the file, click OK to confirm.
Second, the investigating. I want you make certain you know the
correct SIDs and GUIDs of the users you plan to modify. There are
several ways to do this but I think the easiest is to use the Additional
Account Info tab in Active Directory Users and Computers. This
tab is enabled by a dll included with the 2003 resource kit. Please
download and install it from here:
Windows Server 2003 Resource Kit Tools
http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd
After the installation is complete, copy the file named acctinfo.dll to
c:\windows\system32 of the machine that you will run Active
Directory Users and Computers from. On *that* machine, open up
a command prompt and then type the following:
regsvr32 c:\windows\system32\acctinfo.dll
Open up Active Directory Users and Computers on the above machine
and view the properties of each "problem" user. Write down the SID
and GUID that you see on each user's Additional Account Info tab.
Note: Make the registry edits listed below while logged on to the TS
as an admin account *different* than the one you are editing.
You will use the information gathered above to help verify things
when deleting the keys from your TS. Under normal circumstances
you should have the guid listed under profileguid with a sidstring value
pointing to the SID, and under ProfileList you should have only one
SID entry that points to your profile path.
If you find another SID entry that points to the same profile path first try
and determine what account has that SID (maybe it was an old account
that has been deleted) and then second delete the entry. Likewise if
you find a guid that points to the same SID you should investigate that
as well.
Please keep detailed notes of what you discover as well as the changes
you make and reply back. It will help me help you and also will help
others in the future.
Thanks!
-TP
xrbbaker
administrator, but I play one on TV…
In following your instructions it raised several questions. To make sense I
first have to paint a little more of my system picture for you. Geeze I wish
I could paste screen shots…
I have the terminal server described here and one other server and a NAS.
The other server runs Win2000 and is the Domain Controller. It is on the
2000DC box that I run active directory to add/remove people. Now everything
I’ve described up until now I’ve been talking about the 2003 term server. It
hangs. It has duplicate entries in the ProfileList. It is on this box that
I loaded UPHClean.exe. … just in case this is important.
Now when I run dsa.msc on the term server (which I've never done before) and
look at the users I don’t see any of the problem children, or anybody else
for that matter listed in the user folder – (even though I find them all in
the Profilelist on this machine.) Curious, since I didn’t find them there, I
hopped over to the 2000DC box to see what it looked like. On the 2000DC box
when I open up AD I see some, but not all of the users that I found on the
2003 Profilelist. To complete the investigation I open up the Profilelist on
the 2000DC box and sure enough, it too looks different from everything else.
Before I go any further I thought it prudent for me to describe this to you.
Additionally I’m pasting here the actual values found in the Profilelists,
and ADs on each box. Does this look normal to you? To me it looks
completely random. Maybe it is supposed to be with some here, some there,
some in both places. I’ll hold off doing anything until I hear from you,
but my next step could be to delete a few old users via the AD to at least
(hopefully) clean up some of this. Let me know what you think I should do
next. Again, thanks for your great help!
(big X means account is disabled)
Russ
2000DC ProfileList
725345543-1002-IWAM_DBFFJX11
725345543-1124-russell.baker
725345543-1143-sysadm
725345543-1153-jason
725345543-1163-russell.baker.CORP
725345543-1171-wintech
725345543-1194-susan.baker
725345543-1197-kristina.amateau
725345543-1212-russell.baker.CORP.000
725345543-1213-russell.baker.CORP.001
725345543-1217-russell.baker.CORP.002
725345543-500-Administrator
2000DC AD users
Brian Barrett
dataprise
Franklin Berry
Jasmine Hollingsworth X
Lisa Fantauzzo
N Posavec
Noel Posavec
Russell Baker
Sandi Patel
Susan K. Baker
testy theuser
2003 Term server ProfileList
725345543-1110-mark.timmick
725345543-1163-russell.baker
725345543-1165-Gail.Timmick
725345543-1178-brian.barrett
725345543-1192-alex.abraham
725345543-1193-sandi.patel
725345543-1194-susan.baker
725345543-1197-kristina.amateau
725345543-1191-remote.user
725345543-1202-test.profile
725345543-1203-test.profile.CORP
725345543-1204-brian.barrett.CORP
725345543-1213-russell.baker.CORP
725345543-1214-noel.posavec
725345543-1215-noel.posavec.CORP
725345543-1217-russell.baker
725345543-1218-lisa.fantauzzo
725345543-1220-noel.posavec
725345543-1221-nposavec
725345543-1223-testy
725345543-1224-cweber
725345543-1226-testy.CORP
725345543-500-Admnistrator.CORP
1043297533-1006-QBDataServiceUser
1043297533-500-Administrator
2003 Term server AD Users
Administrator
Charlene Weber
Guest X
IUSR-DBFFJX11
IWAM_DBFFJX11
Krbtgt X
Remote access X
Small Business Administrator X
Small Business Power User X
Small Business User
SQLDebugger
Sysadm
Template User X
IsInternetUser
Wintech X
TP
When in Active Directory Users and Computers, were you
connected to your Domain Controller? To do this you right-click
on Active Directory Users and Computers and choose Connect
to Domain Controller.
Let me explain a bit about profiles so that it will help you troubleshoot.
When a user account first logs on interactively to a machine a new
entry will be created under profilelist with the user's SID. If an
account has never logged on interactively [on a particular machine],
then no entry will exist for that user on that machine.
In the case of your Domain Controller, most users should *not* be
logging on to it interactively so that explains why they do not have
a profilelist entry. In fact, if they were to attempt to log on to your
DC they should receive an error.
Look closer at the SIDs that have logged on to your TS. You will
notice that most of them have the number 725345543 in common,
whereas a few have a different common number (1043297533).
The entries with 725345543 are for your domain accounts, hence they
have the similar unique portion which matches your domain. The few
that are 1043297533 are *local* accounts on the TS.
Check AD for the SID that is currently being used for your account
and then match that to a profilelist entry on your TS. If you find another
entry that points to the same ProfileImagePath, then delete it. After
that get rid of all of the similar entries, for example:
Assuming that russell.baker with SID ending in 725345543-1124 is
the *current* entry in AD--THIS MAY NOT BE A CORRECT
ASSUMPTION, SO VERIFY, you could then get rid of all of the similar
entries for russell.baker, not only in the profilelist but under
c:\documents and settings.
NOTE: Make sure that before you delete ANYTHING, you have a
backup of the files and registry keys. There may be a file you need in
one or more of the duplicate local profile folders under
c:\documents and settings.
This is not normally necessary; you are only doing this to troubleshoot
a specific problem. The normal way to delete a profile is described
here:
How to delete a user profile in Windows Server 2003
http://support.microsoft.com/kb/814584
Have you deleted and then recreated the same user accounts multiple
times? It is a bit unusual to see so many SID entries for the same user
name.
I am not convinced yet this is the cause of your problem. Your antivirus
or something else may be the root issue.
If you are not comfortable with all this then I would recommend you
have your rent-a-tech make the changes. Have them also verify that your
DC's and TS's DNS settings are correct and that there are no general
problems with your network setup.
-TP
> Russ
xrbbaker
AD was connected to the DC - results the same on that. I'll try and do some
clean up tonight. and yes, I have created the two problem children IDs many
times. That was a result from my initial exploration into this problem and
many posts suggesting a corrupt profile and to delete and recreate.
Maybe another clue?... Last night I logged on to the term serv as me and
launched QuickBooks. It said I couldn't open the file because it was in use
or I didn't have rights to it. That was impossible. I then logged on as
Admin and got the same results. I was in a terrible rush but on a hunch I
rebooted the term serv, logged back in w same ID and it worked fine. This
has happened before. It feels very similar to the ntuser.dat being in use -
but certainly may be a conincidence. I didn't have the time then to launch
procexp to see what had a hold of the file. When I finally did have time I
opened quickbooks, then launched procexp to do a dry run. Next time it
happens, or anything like that, I'm in position to react quickly and see if
I can find what has it locked up.
xrbbaker
workstation (used to be my personal one) and got the can’t load profile
messages. Looked at log on that box and it showed ntuser.dat as already in
use. Hmmm. Logged in a second session into the term server as Admin and
started proc exp. It showed 2 russell.baker ntuser.dats in use by system.
Logged off of wks (dropping back to term serv as Russell.baker). Flipped
over to Admin session and looked at proc exp and it showed only 1
russell.baker ntuser.dat in play. Checked registry on term serv and can tell
that “good” Russell.baker profile is 1217. It was the only one loaded in HK
Users when I was logged on to term serv as Russell.baker. Maybe my old
workstation was trying to load the other one, 1163?
Tried your instructions regarding the resource kit and the Additional Acct
Info tab. Can’t get it to work. Looked at the link you sent me and sure
enough it states it doesn’t work for x64 machines. Couldn’t find one for
x64. Do you have a link?
Went in to AD on DC and deleted the easy extraneous users. Left problem
children alone. Went into the Registry on term server and deleted the
profile and associated guid for easy entries that weren’t in the AD:
Mark
Gail
Alex
Kristina
Remote.user
Test.profile
Test.profile.corp
nposavec
Remoted over to the wks again, but this time as Admin. Clicked Computer,
Users, Advanced. Under Profiles stored on this computer there was:
Acct unknown 67.9 mb status/local
Acct unknown 67.9 mb status/local
Corp\russell.baker 67.9 mb status/backup
Thanks for your overview on ADs, but one thing I still don’t understand.
(Only one? ;) ) If I’m on the term serve and type in dsa.msc to run the AD,
and I make sure it is hooked to the DC, then shouldn’t I see exactly the same
user list as when I’m actually on the DC running the AD? It clearly does not
show the same users and I want to make sure that is right.
Thanks. We are making progress. I think. If you find me an x64 resource
kit then I'll try the last step by removing the hopefully old and problem
causing profiles and guids.
Thanks!
xrbbaker
I had the hang again today. Ran procexp. russell.baker ntuser.dat handle
was held by System. Went into Reg and found hanging profile #1163 (remember
I have two.) Unloaded hive for that profile. Reconnected and got in fine.
Shouldn't that be the confirmation I need to know that Profile 1163 is the
good one, and go ahead and delete the other one (1217)? - What do you think?
I can't use the acctinfo.dll since it doesn't work for x64 so thought this
could be what we were looking for...
Lastly, some of the Profile/Guids that I deleted (nposavec, Kristina and
Testy) are back again. I re-deleted them again.
TP
You can copy the acctinfo.dll to your 2000 DC and register
it there. That way when you run ADUC on your DC box
you will see the SIDs. Your suspicion that 1163 is the one
in use is probably correct. I wanted you to use the acctinfo
so that you would have different points to cross reference
and help you understand things better.
Use Process Explorer to try and find the process that has
an open handle to the profile. Use the Find-->Find Handle
menu option for your search. For example, let's say the
profile below is hanging:
First we research and find out the SID. We do this by using
a combination of looking in regedit under HKU and seeing
which hives are currently loaded, and cross-referencing with
what we see in ADUC Addl Account Info. Now we know
that the SID of the profile that is unloading is:
S-1-5-21-3829217777-1253468217-725345543-1163
Second we use Process Explorer to find which process has
an open handle. Click Find-->Find Handle, and then we enter
the following search string:
HKU\S-1-5-21-3829217777-1253468217-725345543-1163
Click the Search button.
In our example we only see one entry in the list:
Process: Rtvscan.exe
PID: 1620
Handle: HKU\S-1-5-21-3829217777-1253468217-725345543-1163\Software\LANDesk\VirusProtect6\...
From looking at the above we learn that the Symantec Antivirus
service (Rtvscan.exe) is preventing the profile from unloading.
This service performs real-time antivirus scanning on the server.
Using this knowledge we could decide to contact Symantec
support for an update, or perhaps forward the information on
to the uphclean team at Microsoft, or maybe stop using Symantec
Antivirus until a fix is released.
The above example is fictitious, however, I created it in part
using a *real* UPHClean log entry from a 2000 server I worked
on an hour ago. It is common for antivirus software to cause
profile unload problems, which is why I wanted you to factor that
into your troubleshooting steps.
-TP
xrbbaker
Thanks so much. I have a hanging profile "waiting for me" right now. I'm
leaving it that way until I can get home tongitht and pursue. I'm at a
client site or I would do it now. I'll let you know what I find.
Russ
xrbbaker
As noted before…
Attempt to log on to term serv w Russell.baker yields hanging profile,
ntuser.dat. Used procexp and confirm that Russell.baker ntuser.dat is being
held by System. Look at hkeyusers and see that SID…1163 (Russell.baker) is
listed, even though Russell.baker is not logged on.
Tonight…
On term serv, in procexp do a search on SID…1163. I found the culprit. It
is regedit.exe!!! Aha!!! Huh? Following TP suggestion and copy
acctinfo.ddl to DS. Run AD and look up Russell.baker. It shows his SID as
S-1-5-21-1614895754-2146826605-725345543-1217. Huh? Open regedit on AD and
on Profilelist see:
SID…1124 russell.baker
SID…1163 russell.baker.CORP
SID…1212 russell.baker.CORP.000
SID…1213 russell.baker.CORP.001
SID…1217 russell.baker.CORP.002
Eeeh gads!! No wonder there is so much profile consternation.
Fell back to term server and brought up Profilelist:
SID…1163 russell.baker
SID…1213 russell.baker.CORP
SID…1217.bak russell.baker
What should I do TP? I’m thinking I
a) back up registry
b) delete all Russell.baker profiles and guids on term serv
c) delete all profiles and guids on AD except the one that the Additional
Info list as SID…1217
What do you think? Is it normal for regedit.exe to snag ntuser.dat?
Thanks. We are getting closer!
TP
Regedit.exe is not normally running unless you opened it for
some reason. Perhaps you had it open looking at which hives
were loaded under HKU?
You can broaden your search criteria in process explorer by
searching for just hku\. That way you will see a list of all the
handles open for the user hives in case you want to gather
more information.
I think at this point you should do some cleaning. Make a
backup of the *entire* machine using your backup software,
then make a copy of the local profiles under c:\docs and settings
as well as the profilelist and profileguid registry keys.
1. Using a different admin account, delete the profile folders
out of c:\docs and settings for all profiles *except*:
- The different admin account you are actually logged on as at
that moment
- System profiles, for example: Default User, All Users, LocalService,
NetworkService, etc.
2. Repeat the above delete procedure, only this time you are deleting
the relevant profilelist and profileguid entries. Remember to leave
system related profile entries alone.
3. Logon and off several times using your russell.baker account. There
should be *only* one profile folder created under c:\docs and settings
for this account. I say created because remember you deleted *all*
of the different russell.baker folder combinations. Check the profilelist
entries to make sure they are correct.
NOTE: Just to stress the point more. You are basically getting rid of
all of the different profile folders and registry entries for your non-system
user accounts on your TS. You are *not* trying to figure out exactly
which ones to save versus delete--let the system automatically recreate
what it needs. You made a copy of the profile folders so that you can
retrieve any documents or other files you may need later.
Cleaning all of this up may fix things...or not. We still have not identified
the root cause here.
You have not said if you are using roaming profiles or not. If you are,
have you specified a different TS profile for each user? You should
not share profiles between your workstations and the server. If you
are not using roaming profiles then disregard.
-TP
xrbbaker
tomorrow. As to roaming - I don't know what that means so I guess we don't
have it.
Also, to be clear, I should only do the deletes on the TS, not the AD server
correct? I guess after we clean up the TS, there is still the multiple
russell.bakers on the AD server to work on, but that can be tackled later.
thanks again
TP
there a path specified? Please skim the first few paragraphs
of the document below to see what I mean:
Configuring Roaming User Profiles
Also check whether a profile path has been specified on
the Terminal Services Profile tab.
If you are not currently using roaming profiles, then do not
start using them now--it will only complicate things.
Please perform the deletes on the TS only at this time.
Thanks.
-TP
xrbbaker
Instructions followed. Old profiles, GUIDS and ProfileIDs gone. Logged on
as each user and kicked off some apps. Everything worked fine. Logged on
off as me several times. No hanging yet. Registry looks nice and clean.
Checked on Roaming profiles. We don't use that.
TP I hope this does it. I'll check back in in 2 weeks, unless it hangs
sooner. I don't think I've ever gone 2 weeks before. I'll leave the Domain
Controller server alone for now, but for sure it could use some clean up too.
You are a phenominal help. Thanks so much.
Russ
TP
You are welcome. I would very much appreciate you posting
a followup in 2 weeks--hopefully you will be problem free!
-TP
xrbbaker
myself, but since my last post my problem has not happened again by either
myself, or any of my problem users. Usually over this period it would have
happened 2-4 times. Hence, a good chance it is truly solved.
Thanks so much for your excellent support!!
Regards
TP
Glad to hear it is working for you!
I really appreciate you taking the time to report back with
your results. This helps me and it helps others in the future
who may experience the same issue as you.
Thanks!
-TP