Login problem 2

[MattK]

Hi everyone,

We have setup a new server (W2K with Domain) here in our office, and I am creating a new workstation 'image' to go roll out alongside it. However, I have run into a problem with my roaming users. What happens is that when I log any of my roaming users onto the new workstation, it performs half the logon (authentication, connects network drives, etc), then just stops dead before it reaches the desktop. I can still hit CTRL-ALT-DEL and use task manager (can even launch programs from it - but it won't let me launch explorer.exe or iexplore.exe), or logoff, etc.

I have already tried:
- removing my users from their OU (so there is no group policy to apply)
- deleting all profiles and re-creating
- copying the administrator local profile (local profiles logon fine) into Default User on the workstation
- completing removing any Default User profile
- re-installing SP3

None of this has helped.

As per a suggestion on another forum, I used the USERENV (can't remember exactly what is it) registry setting to log the Windows logon process into /winnt/debug/usermode/userenv.log. If I set it to warnings and errors only, the log file isn't even created (as in, there are no warnings or errors). If I set it to Verbose mode, I get this log file: (

http://www.powerchipgroup.com/matt/log.txt).

Nothing in there seems amazingly wrong, but the few lines I do wonder about are:

(near to start)
USERENV(b8.a0) 17:44:10:185 LoadUserProfile: NULL server name
(near the end)
USERENV(4c8.424) 17:45:01:889 GetHkeyCU: RegOpenKey failed with error 2

So, anyone have any idea what's wrong with the logon process? Or, anyone want to take a look at the log (link above) and see if they can figure it out?

Thanks in advance to anyone who can shed some light on the situation

Matt

 

[NickFerrar]

Hmm you seem to have done most of the obvious trouble-shooting steps - one thing I would try is giving the user account local admin privileges and seeing if that makes a difference, that way you can check if permissions are interfering somewhere.

 

[MattK]

Ok, I tried giving the account local Admin privelidges, and that lets it log-in fine... So, obviously it's a local permissions problem, but the only local permissions I can remember changing was to add the domain group 'Domain Users' to the local group 'Power Users' (so users could install their own apps), and giving 'Power Users' permission to modify HKEY_CLASSES_ROOT (so users can control extensions), and I have tried reversing both of those (doesn't help).

Can you think of any about local permissions which might cause this sort of behavior if incorrectly set?

I also tried setting up an account on the domain which *doesn't* have a roaming profile, and it has the same problem, so I don't think the problem is to with profiles.

Thanks very much for your response,
Matt

 

[GiaBetiu]

Indeed the log is in very detail. But as I can see it is crashing when userinit.exe start running.
GPOs are OK, and the errors that you are mantioning are not errors. Is just that Windows is trying to apply an algorithm.
What could happen? Userinit.exe is the one that:
set up the user's environment (reading user profile, setting some environment variables), running logon scripts, then executes the user shell program (Shell key value under the Winlogon registry key).
So, the debug should start from here. (I will try to continue investigation.. but now, I'm in the office..)

Success.



PS:
Also, this behaviour has a Windows 2K server if you want to save/restore an image where W2k server was installed. And, I must say that is just not working. Why, I didn't have time to go deeper, but for server is impossible. The difference is that in that case as impossible to log on.

Gia Betiu
m.betiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k

 

[MattK]

Thanks for the response Gia.

I was thinking the same thing as you regarding it being a problem with userinit.exe, but seeing as I can log the accounts on fine when they are Administrators (locally), doesn't that suggest it's some sort of permissions problem?

I find it sort of strange userinit.exe doesn't even drop an error message As I said above, when it hangs, it won't let me load explorer.exe manually (through task manager) - it just closes straight away. Thought that might help in the diagnosis of what point it is getting up too.

Anyway, if you do have any luck diagnosing it further, please do let me know.

Cheers,
Matt

 

[NickFerrar]

Does SYSTEM have full control on the local 'Documents and Settings' folder? If not it should, if it does then try giving the domain user you are testing with full control at that level (but remove him from the local admin group) and see if that makes any difference.

Only similar problem I've seen is the local profile folders permissions were screwed so it couldn't create the local cached profile during login but you would normally expect an error message.

 

[MattK]

Unsure on the SYSTEM permissions Nick, I'm at home at the moment (we're in Australia), but I will check next time I'm in the office.

One thought I had was - does anyone know of a program (maybe an MS util?) which resets all the permissions (folders, files, registry, etc) on a workstation to default? Because that may fix my problem.

Thanks for the suggestions too Nick,
Matt

 

[GiaBetiu]

Yes, you can set the default security settings.

systemroot\inf\Defltwk.inf

That is the default security template used when you install a new Win2k Wkst.
Just as a plus, the security template are not applied if you are installing W2k via an upgrade. Then must be used Basicwk.inf that is doing similar things like default one but with the exception of restricted groups and user rights. Gia Betiu
m.betiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k

 

[dmull]

Do you have a logon script connecting the user's drives when they log on. I ran into a similar problem with Windows 98 computers until I changed the directory back to C:Windows at the end of the batch file.

 

[MattK]

Haven't been in the office today so I haven't been able to try anything new. Anyway:

Gia: Thanks for that - I assume I just Right-Click -> Install the .inf file? I'll try that and see if it fixes the problem.

dmull: No, no logon scripts, but thanks for the suggestions.

Cheers,
Matt

 

[GiaBetiu]

No,... is not right clisk install!!!

It's a security template.
You have to launch Security Configuration and Analyses.
(that is a plugin for MMC).
Then there you have to create a database (just click Open, and put a name for the database).
It will ask you for an inf file.
Go to \winnt\inf and select the file that you want.
Then you can make a comparison between that template and what settings you have in your pc (Clicking analyze computer now). Try this first. At leats to know what is changed.
Also you can click Configure computer now. Aend then the tempplate will be applied.

Success! Gia Betiu
m.betiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k

 

[MattK]

Well, the problem is finally fixed! I used Security Configuration & Analyses, Analysed my current setup vs the default one, and couldn't find anything out of the ordinary - so I just applied the default settings, re-applied my own custom security settings, and it's all fine.

Thanks to everyone who gave me a hand in this thread!!

Cheers,
Matt