2

I recently had to rebuild a Small Business Server 2003 Standard after a crash. I then rejoined the workstations to the domain. Subsequently, many of the Windows XP Pro workstation domain members are experiencing intermittent locked profiles when a user attempts to login, usually after several hours of having no account logged in. A reboot resolves the issue.

We are not using roaming profiles or Terminal Services, and UPHClean in its native configuration is not shedding any light. I have removed and reinstalled the Trend Micro AV client, and disabled many (but not all - some are mission-critical) of the third-party startup services/applications. On three of the workstations, I have renamed the profile and started with a clean profile and copied user files over (but not the Application Data or Local Settings folder, let alone the NTUSER.DAT file).

Any ideas? I'm stumped...

8
  • When you rejoined the workstations to the domain, did you disjoin them completely first and reboot? When you say rejoin are you using the SBS wizard for that or doing it manually? May 19, 2009 at 21:02
  • Yes, we unjoined the domain, then manually rejoined the domain. I expected that SIDs would be different, requiring a new trust relationship.
    – Raintree
    May 19, 2009 at 21:17
  • What do you mean by a profile being "locked"? I am very familiar with user profiles, but I am not familiar with the term "locked" in this context. What symptom are you actually seeing? When you reinstalled SBS 2003 Std, did you then restore your Active Directory database from backup, or did you create a new domain with the same name? Also, what are you rebooting to solve the problem--the server or the client? May 20, 2009 at 3:30
  • Locked, as in Event IDs 1508, 1502, 1515, and 1511 (Source UserEnv). The first description: Windows was unable to load the registry. This is often caused by insufficient memory or insufficient security rights. DETAIL - The process cannot access the file because it is being used by another process. for C:\Documents and Settings\DebbieS\ntuser.dat The Active Directory was restored from tape while in "Domain Controller Restoration mode" after an otherwise full restore. Rebooting the client solves the problem.
    – Raintree
    May 27, 2009 at 5:08
  • I am currently pursuing Trend Micro WFBS 5.1 Advanced as the possible culprit. A second client (different site, completely unrelated) just reported the same scenario this morning.
    – Raintree
    May 27, 2009 at 5:08

4 Answers 4

1

Have you try to enable user environment debug logging?

Maybe it can help you to identify the cause.

0

At that point I would disjoin from the domain, reboot, delete all user profiles except local administrator. Delete all computer accounts in question from AD users and computers. Then I would rejoin but with computer names that have never been used before on the domain.

BTW, what do you mean when you say the profile is locked.

Also, I have found that when working with SBS it is always best just to use the built-in wizards rather than do anything manually. I'd use the SBS method of rejoining.

1
  • Thank you. The client finds my replacing their profiles as very disrupting, and I am currently working remotely. If the Trend Micro vector mentioned above and a potential Microsoft call do not pan out, I will start over as you suggest. Please see the above comments regarding the Event IDs for Microsoft's description of the locked (in use) profile. I, too, frequently recommend folks use the wizards. I have also gotten used to cleaning up the left-overs from the wizards misfiring (stranded _SBS_USER accounts, for example). :)
    – Raintree
    May 27, 2009 at 5:15
0

Are you sure your network isn't affected by any malware? I ask because Conficker can lock out user accounts. The reboot fixing the problem could be a red-herring, as many domains will automatically reset the lockout after a period of inactivity.

1
  • Thank you. A scan by Trend Micro WFBS 5.1 and MalwareByte's AntiMalware (both with current defs) currently come up clean. I checked previously with Trend to verify that Conficker variants were indeed on their definitions list...
    – Raintree
    May 27, 2009 at 5:12
0

I would log all users off from workstations and then reset everybody's password and then ask them to login using new passwords.

All of these assuming restored backup also restored same user accounts with same SID.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .