Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am getting these errors on several different users and computers. Any ideas?

{Event Type: Error Event Source: Userenv Event Category: None Event ID: 1515 Date: 2/28/2011 Time: 8:30:21 AM User: XXX Computer: XXX Description: Windows has backed up this user's profile. Windows will automatically try to use the backed up profile the next time this user logs on.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Error Event Source: Userenv Event Category: None Event ID: 1502 Date: 2/28/2011 Time: 8:30:21 AM User: NT AUTHORITY\SYSTEM Computer: XXX Description: Windows cannot load the locally stored profile. Possible causes of this error include insufficient security rights or a corrupt local profile. If this problem persists, contact your network administrator.

DETAIL - The process cannot access the file because it is being used by another process.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Windows was unable to load the registry. This is often caused by insufficient memory or insufficient security rights.

DETAIL - The process cannot access the file because it is being used by another process. for C:\Documents and Settings\XXXX\ntuser.dat


Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.}

share|improve this question
    
Which version and edition of Windows? –  joeqwerty Mar 3 '11 at 20:42
    
Windows XP Pro. Connected to a local Server 2003 DC. –  tech.pro Mar 3 '11 at 22:39

3 Answers 3

I've seen this many times

2 things to look at

1) Run a chkdsk to see if there are errors with the drive, make sure you select check for bad sectors 2) Was the DC replaced recently, when people replace a domain controller and instead of moving users profiles correctly after adding the PC to the domain, they play with the registry entries, but don't fix permissions.

share|improve this answer
    
I did this and still got the error. –  tech.pro Mar 8 '11 at 19:09
    
Sorry, you did what? Ran the chkdsk. If so, good, I'm glad there are no bad sectors. So, did you try to move the users profile correctly. You didn't answer the underlieing question, is this on a domain –  Tom Mar 9 '11 at 4:41

Are you using roaming-profiles? If so, check whether your user has access to his profile on your share. The user needs full permissions to his profile.

Edit: If the users profile is only local, check the permissions as well or if it's even there (C:\Documents and Settings\USERNAME).

share|improve this answer
    
While this is sometimes the issue, the error message does not indicate access denied. –  Falcon Momot Jun 23 '13 at 3:53
    
The message "Possible causes of this error include insufficient security rights" in his second event could indicate that access is denied. While there could also be registry issues like you've written, it's also possible that he's suffering from two issues. Anyway, I tried to round Toms answer up ;) –  wullxz Jun 24 '13 at 15:15
    
The generic part of the message is badly worded; the specific part which gives the actual error number is telling. There could certainly be more problems, but the one identified is a locking issue. The generic part says basically that the error number could be 5. –  Falcon Momot Jun 24 '13 at 17:58

The error message basically says Windows can't load the user's registry hive to HKEY_CURRENT_USERS because it's already been locked for writing. I draw your attention to C:\Documents and Settings\XXXX\ntuser.dat.

Typical causes of this include (ordered by the frequency with which I have seen them):

  • Antivirus software doing an offline scan of the user's registry
  • A script which mounts that registry and makes changes to it running while the user is logging in
  • A virus using the user's registry hive for some purpose of its own
  • Backup software locking the user's registry and running while they are trying to log in
  • The user's registry being mounted already while they are trying to log in
  • Filesystem corruption or kernel confusion making a lock appear where a lock is not
  • Actual registry corruption

Take a look at things like this. The last few causes are hypothetical (they would cause it, but I've never found evidence that they did), but the first is ubiquitous.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.