Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently had to rebuild a Small Business Server 2003 Standard after a crash. I then rejoined the workstations to the domain. Subsequently, many of the Windows XP Pro workstation domain members are experiencing intermittent locked profiles when a user attempts to login, usually after several hours of having no account logged in. A reboot resolves the issue.

We are not using roaming profiles or Terminal Services, and UPHClean in its native configuration is not shedding any light. I have removed and reinstalled the Trend Micro AV client, and disabled many (but not all - some are mission-critical) of the third-party startup services/applications. On three of the workstations, I have renamed the profile and started with a clean profile and copied user files over (but not the Application Data or Local Settings folder, let alone the NTUSER.DAT file).

Any ideas? I'm stumped...

share|improve this question
    
When you rejoined the workstations to the domain, did you disjoin them completely first and reboot? When you say rejoin are you using the SBS wizard for that or doing it manually? –  Daniel Lucas May 19 '09 at 21:02
    
Yes, we unjoined the domain, then manually rejoined the domain. I expected that SIDs would be different, requiring a new trust relationship. –  Raintree May 19 '09 at 21:17
    
What do you mean by a profile being "locked"? I am very familiar with user profiles, but I am not familiar with the term "locked" in this context. What symptom are you actually seeing? When you reinstalled SBS 2003 Std, did you then restore your Active Directory database from backup, or did you create a new domain with the same name? Also, what are you rebooting to solve the problem--the server or the client? –  Jay Michaud May 20 '09 at 3:30
    
Locked, as in Event IDs 1508, 1502, 1515, and 1511 (Source UserEnv). The first description: Windows was unable to load the registry. This is often caused by insufficient memory or insufficient security rights. DETAIL - The process cannot access the file because it is being used by another process. for C:\Documents and Settings\DebbieS\ntuser.dat The Active Directory was restored from tape while in "Domain Controller Restoration mode" after an otherwise full restore. Rebooting the client solves the problem. –  Raintree May 27 '09 at 5:08
    
I am currently pursuing Trend Micro WFBS 5.1 Advanced as the possible culprit. A second client (different site, completely unrelated) just reported the same scenario this morning. –  Raintree May 27 '09 at 5:08
show 3 more comments

4 Answers

Have you try to enable user environment debug logging?

Maybe it can help you to identify the cause.

share|improve this answer
add comment

At that point I would disjoin from the domain, reboot, delete all user profiles except local administrator. Delete all computer accounts in question from AD users and computers. Then I would rejoin but with computer names that have never been used before on the domain.

BTW, what do you mean when you say the profile is locked.

Also, I have found that when working with SBS it is always best just to use the built-in wizards rather than do anything manually. I'd use the SBS method of rejoining.

share|improve this answer
    
Thank you. The client finds my replacing their profiles as very disrupting, and I am currently working remotely. If the Trend Micro vector mentioned above and a potential Microsoft call do not pan out, I will start over as you suggest. Please see the above comments regarding the Event IDs for Microsoft's description of the locked (in use) profile. I, too, frequently recommend folks use the wizards. I have also gotten used to cleaning up the left-overs from the wizards misfiring (stranded _SBS_USER accounts, for example). :) –  Raintree May 27 '09 at 5:15
add comment

Are you sure your network isn't affected by any malware? I ask because Conficker can lock out user accounts. The reboot fixing the problem could be a red-herring, as many domains will automatically reset the lockout after a period of inactivity.

share|improve this answer
    
Thank you. A scan by Trend Micro WFBS 5.1 and MalwareByte's AntiMalware (both with current defs) currently come up clean. I checked previously with Trend to verify that Conficker variants were indeed on their definitions list... –  Raintree May 27 '09 at 5:12
add comment

I would log all users off from workstations and then reset everybody's password and then ask them to login using new passwords.

All of these assuming restored backup also restored same user accounts with same SID.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.