0

I've built a Windows 2012 R2 Standard x64 terminal server (session-based). Early in the setup process, I was able to log in with my Active Directory credentials, but when I turned it over for wider testing, only accounts that already had local profiles could log in. When the user profile service is copying the default profile to give the user a new profile, a seemingly-random set of files in AppData fail to copy with "The process cannot access the file because it is being used by another process." Windows falls back to a temporary profile, but the same thing happens, blocking login. This happens regardless of whether someone is trying to log in over RDP or at the console.

When a user without an existing local profile tries to log in, Winlogon emits event 6004:

The winlogon notification subscriber failed a critical notification event.

and the user profile service emits several of 1509:

Windows cannot copy file \C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Control Panel.lnk to location \?\C:\Users[userid]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Control Panel.lnk. This error may be caused by network problems or insufficient security rights.

DETAIL - The process cannot access the file because it is being used by another process.

The file names vary (subsequent login attempts report errors with different files), but they're always in AppData\Roaming or AppData\Local. After several event ID 1509s, the user profile service gives up and emits event ID 1511

"Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off."

It then emits several event 1509s trying to copy a temporary profile:

Windows cannot copy file \?\C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini to location \?\C:\Users\TEMP\AppData\Roaming\MIcrosoft\Windows\Start Menu\Programs\System Tools\Desktop.ini. This error may be caused by network problems or insufficient security rights.

DETAIL - The process cannot access the file because it is being used by another process.

Finally, the User Profile Service emits event ID 1500:

Windows cannot log you on because your profile cannot be loaded. Check that you are connected to the network, and that your network is functioning correctly.

DETAIL - Only part of a ReadProcessMemory or WriteProcessMemory request was completed.

Winlogon emits two event 6001s:

The winlogon notification subscriber failed a notification event.

The winlogon notification subscriber failed a notification event.

and login fails.

There's no trash in C:\Users or HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. Process Explorer does not show anything as having files in C:\Users\Default open.

If I watch the login process with Process Monitor, I see it creating a key under ProfileList and copying files to C:\Users\[username]. At the end of each attempt (with and without a temporary profile), it deletes the new key under ProfileList and the partially-populated directory. I'm not finding anything I can correlate with the actual failure: for example, there are CreateFile operations on directories that return SHARING VIOLATION, but they happen on directories for which I get no errors in the event log.

I speculated that ESET File Security, the antivirus, might be holding files open, so I removed it to no effect.

I tried turning on user profile disks to see if it hand an effect. With this on, I got the same errors (plus the NTFS errors associated with profile disks), but this time something got left behind in C:\Users. I was able to pick through two partial profiles and confirm that they were missing different files.

If I delete everything in C:\Users\Default\AppData\*, users without an existing profile are able to log in. Replacing the default profile with one taken from a fresh Server 2012 R2 installation does not change the symptoms. I couldn't find any differences between the permissions on the problem server and the fresh installation.

There aren't any policies set which should be able to interfere. The only policies I see that are even halfway related to login are GP loopback processing mode (enabled), "Always wait for the network at computer startup and logon" (enabled) and a policy to set HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt to 0.

sfc /scannow reports no faults.

Edit: the server's been rebooted during troubleshooting.

I found a reference to a similar problem with no solution. All the other cases I found that had similar symptoms seem to be different problems: I have plenty of disk space, there's nothing getting left in ProfileList, we're not using roaming profiles, this applies to users who have never logged in to the machine before, removing the antivirus has no effect, and the error happens for different files every time.

Notable software installed:

  • ESET File Security 4.5.12015
  • Remote Desktop Services role (session-based, quick setup, with connection broker, session host & web access on the same server)
  • IIS (for RDS web access)
  • App-V Client for RDS 5.0 SP2
  • KB2919355
  • Office 2013 Professional Plus

3 Answers 3

2

I know this is an old post, but I've come across the same issue and think I may have found a solution

I've installed the Hotfix KB2963211 and I do not have this error anymore. It is a Hotfix for AppV 5.0 SP2.

1

I used to see this happen when we had a ton of new users logging into a terminal server in a short period of time. Are you using user profile redirection? I would highly recommend that in a terminal service environment.

Occasionally i would just need to reboot as well. I hate that answer but it just happens with terminal servers (at least back in 2003).

Finally, i would also make it a habit of cleaning up stale user profiles (delprof.exe). With the correct parameter it only delete local cached profiles not the terminal server profile (roaming profile)

http://technet.microsoft.com/en-us/library/cc783578(v=ws.10).aspx

Local Computer Policy/Computer Configuration/Administrative Templates/Windows Components/Terminal Services

Important

To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.

Double-click the Set path for TS Roaming Profiles setting, and then click Enabled.

In the Profile path box, type the path for Terminal Services roaming profiles, and then click OK.

3
  • This server will be used in an environment that currently lacks a fileserver joined to AD (and is actually a temporary measure as part of a migration project), so all profiles are local, not roaming. If I understand you correctly about user profile redirection, no, we're not doing that.The server's been rebooted a few times during troubleshooting, but without success, unfortunately.
    – urist
    Apr 23, 2014 at 15:58
  • might sound a little extreme, but try deleting all the profiles on the TS. Do this after a clean reboot, and make sure you use delprof to do it or go into the advanced settings in the computer. Meaning, don't just delete the folder. Apr 23, 2014 at 19:06
  • The effect of deleting all the domain profiles (via System Properties -> User Profiles, as delprof.exe isn't supported on 2008 and 2012) is that now I can't log in to the machine with any AD accounts. The same symptoms occur. At this point I'm inclined to throw it away and rebuild it with Server 2008 R2.
    – urist
    Apr 25, 2014 at 20:12
-1

We also see this problem. You should try to uninstall KB2919355.

1
  • What brought you to the conclusion that this update was the issue?
    – Nixphoe
    May 6, 2014 at 15:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .