roaming profiles

[msnlincs]

I have something of a weird issue that I hope you can help me with because the MS Newsgroups have proven to be nothing but worthless.

We have a Windows 2003 domain w/ Windows XP SP2 clients. Roughly half of our user base can no longer update thier roaming profiles at log off. Userenv events 1504 & 1509 are logged in the app logs and nothing is logged in the System logs to indicate a network issue to correct. I have 19 items of troubleshooting documented that I have done so far, all of which has not corrected the users' ability to update thier profile.

Userenv logging has been enabled and I find the following errors in it:

USERENV(26c.414) 09:16:57:598 GetUserNameAndDomain Failed to impersonate user
USERENV(26c.414) 09:16:57:614 ImpersonateUser: Failed to impersonate user with 5.
USERENV(26c.414) 09:16:57:614 GetUserDNSDomainName: Failed to impersonate user
USERENV(a24.488) 09:19:01:276 LibMain: Process Name: C:\WINDOWS\system32\mobsync.exe
USERENV(22c.230) 09:19:04:698 UnloadUserProfile: Entering, hProfile = <0x7b4>
USERENV(22c.230) 09:19:04:714 UnloadUserProfile: In console winlogon process
USERENV(22c.230) 09:19:04:729 UnloadUserProfileP: Entering, hProfile = <0x7b4>
USERENV(22c.230) 09:19:04:729 AbleToBypassCSC: Try to bypass CSC
USERENV(22c.230) 09:19:04:760 AbleToBypassCSC: tried NPAddConnection3ForCSCAgent. Error 85
USERENV(22c.230) 09:19:04:807 AbleToBypassCSC: tried NPAddConnection3ForCSCAgent. Error 85
USERENV(22c.230) 09:19:04:839 AbleToBypassCSC: tried NPAddConnection3ForCSCAgent. Error 2109
USERENV(22c.230) 09:19:04:839 AbleToBypassCSC: Share \\servername\user profiles mapped to drive G. Returned Path G:\username

AND FURTHER DOWN...

USERENV(22c.230) 09:19:06:432 CopyProfileDirectoryEx: Found hive file NTUSER.DAT
USERENV(22c.230) 09:19:06:901 ReconcileFile: Unable to open temporary file
USERENV(22c.230) 09:19:06:917 ReconcileFile: Failed to delete file <G:\BillH\NTUSER.DAT> with error = 3
USERENV(22c.230) 09:19:06:932 CopyProfileDirectoryEx: ReconcileFile failed with error = 3
USERENV(22c.230) 09:19:06:932 ReportError: Impersonating user.
USERENV(22c.230) 09:19:06:948 GetShareName: WNetGetConnection initially returned error 2250

I can provide everything I've done so far if it will help, let me know. Is there anyone who has had to troubleshoot this before? Thanks in advance.

Lincoln

 

[linney]

Try your luck with these.

http://www.eventid.net/display.asp?eventid=1504&eventno=2494&source=Userenv&phase=1

http://www.eventid.net/display.asp?eventid=1509&eventno=2343&source=Userenv&phase=1

Userenv Errors 1504 and 1509 in the Windows XP Application Event Log After You Apply a Redirector Hotfix

http://support.microsoft.com/kb/826379

You cannot load or unload a roaming user profile if it contains EFS files on a Windows XP-based or a Windows Server 2003-based client

http://support.microsoft.com/kb/911805

Also try the Server Forum.

http://www.tek-tips.com/threadminder.cfm?pid=931

 

[msnlincs]

Thanks linney for the feedback. I finally figured it out though. A particular service that monitors files, folders, and devices on a particular PC would not allow the connection of the temporary drive that is created by the roaming profile synchronization process. When I disabled the service, everything was happy and the profiles updated.

I have to say that everytime I've seen these two errors, it has ALWAYS been a network related issue. I tried 21 different trouble shooting tasks. I can't believe it resided with the local PC this time!! I did a little dance and jig when I found it.

 

[linney]

Glad you finally fixed it, I well know the warm feeling such achievements produce, probably not so much nowadays in my case, unfortunately.

Just for completion, can you tell us the name of the program/service that was causing the actual problem, and was this installed on all the problem machines, but not on any of the working machines?

 

[msnlincs]

Device Sheild is the name of the service and application. It was installed on all problematic machines, and not on any that were working. Its purpose is to prevent people from attaching devices to steal information. During the logoff process, the system maps a temporary drive (drive g: in my original post). Device Sheild must have seen this as an unauthorized device and prevented the system from updating the profile. It also does file monitoring.