Roaming Profile Errors: Events 1508, 1502, 1511

[hydruid]

When users log into a 2003 terminal server, occasionally they get this:

1508:
Windows was unable to load the registry. This is often caused by insufficient memory or insufficient security rights.

DETAIL - The system has attempted to load or restore a file into the registry, but the specified file is not in a registry file format. for C:\Documents and Settings\tmccraw\ntuser.dat

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

1502:
Windows cannot load the locally stored profile. Possible causes of this error include insufficient security rights or a corrupt local profile. If this problem persists, contact your network administrator.

DETAIL - The system has attempted to load or restore a file into the registry, but the specified file is not in a registry file format.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

1511:
Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

The users have the correct rights to the files, I am stumped.

Correctly asked questions will receive a better answer.

 

[TechyMcSe2k]

Are they pointing to a share for their profiles? Are the share permissions set to FULL and the NTFS permissions enough for them to make changes within that directory?

________________________________________
Achieving a perception of high intelligence level can only be limited by your manipulation skills of the Google algorithm!

 

[hydruid]

Their roaming profile, my documents, desktop, and start menus are all redirected to a share. They have full ntfs permissions to their files and can create/edit/delete them without a problem.

Example shares:
roaming profile: \\lax\ts_profiles$\sheila.LAX
my documents: \\lax\home$\sheila
desktop: \\lax\redirects$\desktop1
start menu: \\lax\redirects$\startmenu1

I currently manage several different sites each with their own servers and etc. and this problem is only happening at one of the sites.

Yesterday afternoon I installed the User Profile Hive Cleanup Service on the domain controller (where the profiles are stored) and the terminal servers where the users login. I haven't checked to see if it's helped yet or not though

Correctly asked questions will receive a better answer.

 

[hydruid]

The hive cleaner didn't help. It seems like the majority of the errors are caused by cookies, the recent folder (you know what documents they opened befor), and items in the application data folders say for flash and etc.

1. Cookie: \\lax\ts_profiles$\sheila.LAX\Cookies\sheila@tag.contextweb[3].txt

2. \\lax\ts_profiles$\bob.LAX\Application Data\Microsoft\Office\Recent\

3. \\lax\ts_profiles$\mary.LAX\Application Data\Microsoft\Word\STARTUP\

I can have a log off script delete their cookies and recent folders but thats just a patch, I need a fix.

Correctly asked questions will receive a better answer.

 

[hydruid]

I enabled the script to delete cookies on logoff. I also enabled verbose logging but will have to wait for it to happen again since it's so random.

I also installed threadmaster on the DC. I read on a lot of forums it could be caused by a heavy load. Seems like most of the time the problems happens first thing in the morning, maybe that will help.

Correctly asked questions will receive a better answer.

 

[TechyMcSe2k]

You may need to set your group policy for roaming profiles ti "wait for the network"?

________________________________________
Achieving a perception of high intelligence level can only be limited by your manipulation skills of the Google algorithm!

 

[hydruid]

Ok I just enabled this:

computer config-->Admin templates-->system-->logon-->Always wait for the network at computer startup and logon

That what you meant?


Correctly asked questions will receive a better answer.

 

[TechyMcSe2k]

correct

________________________________________
Achieving a perception of high intelligence level can only be limited by your manipulation skills of the Google algorithm!

 

[hydruid]

still having the same problems but they seem to be getting worse.

today out of no where when i logged in it said RPC couldn't be found. but then i tried again to login and it worked just fine, not sure if that helps

Correctly asked questions will receive a better answer.

 

[TechyMcSe2k]

http://technet.microsoft.com/en-us/library/cc738596.aspx

The troubleshooting part is at the bottom of the article.

create a detailed log file for user profiles
In the Run dialog box, type regedit, and then click OK.

Locate the following subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon.

Create a new entry named UserEnvDebugLevel of data type REG_DWORD, and set its value to 0x30002.

The log file is stored in this location: %windir%\Debug\Usermode\Userenv.log.


________________________________________
Achieving a perception of high intelligence level can only be limited by your manipulation skills of the Google algorithm!

 

[hydruid]

I have already enabled verbose logging, here are some of the errors I see in the log:

TestIfUserProfileLoaded: return with error 2
Failed to open profile profile guid key with error 2
AbleToBypassCSC: tried NPAddConnection3ForCSCAgent. Error 2109
IsCentralProfileReachable: Profile is not reachable, error = 2
ExtractProfileFromBackup: Failed to open key Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1856788550-343545246-804800104-1622 with error 2
ExtractProfileFromBackup: Couldn't open backup profile key. Error = 2
TouchLocalHive: Failed to query central profile with error 2

i will be researching these errors, but any ideas on them?

Correctly asked questions will receive a better answer.

 

[TechyMcSe2k]

Where are the profiles physically stored? Are they on the same server? Brian Madden speaks of SAN shares causing issues.

________________________________________
Achieving a perception of high intelligence level can only be limited by your manipulation skills of the Google algorithm!

 

[hydruid]

they are stored on the domain controller.

users log into 6 different terminal servers. those terminal servers are paired 2 at a time on top of 1 vmware esx box with two dual core xeon cpu's and 8 gigs of ram.

during my troubleshooting I even replaced the gig backbone switch between the server. tested the speed out with both switches and it's fast. the original was a cisco 2960g and the second switch is a adtran netvanta.

I also wanted to mention that I have several other setups running the same hardware/config and this is the only place with the problems...

Correctly asked questions will receive a better answer.

 

[hydruid]

Ok, small update. I noticed a few corrupted file errors on the console of the server so I ran a nice long chdsk and it fixed some corruption.

After everyone logged back in it seems the errors are happening a lot less often but are still happening.

any ideas?

Correctly asked questions will receive a better answer.