Its not very uncommon that we run into an issue where the user gets logged in with a temporary User profile instead of his or her regular profile on a PC or a Terminal server. Every now and then a User complains to the Admin
I can’t see any of my desktop icon
Or I saved something on my desktop yesterday which is no more (because. earlier the user was logged in with a temp profile which he didn’t realise and when he logged off end of the day, obviously Temp profile didn’t save any thing)
Or if you are lucky to have the smart bunch of users then they actually tell you they logged in with a Temporary Profile because they saw the following Ballon.
Baloon Message in notification area about Temp Profile
OK, now that we know the issue is that user or users aren’t getting their regular profile, so the next step is to fix it, before talking about the approach fix the issue, a few words about user profile.
What is User profile ?
User profile can be defined as bunch of settings for a users on a particular PC. Settings like wallpaper, icon arrangement, outlook settings, also the data inside your my documents or folders/files or shortcut on your desktop are part of User profile.
The whole user profile is stored in a folder (derived from user’s name) under c:\users\%username% (Provided C is your OS drive) from Windows 7 onwards and under c:\documents and settings\%username% for windows XP or Server 2003. So lets say that for a user named Shishir, the profile path will be c:\users\shishir in a windows 7 or onwards PC.
Now under this profile folder, again we have multiple folders like Documents (user’s My documents) , desktop (User’s Desktop) and many more. Apart from these documents there is a profile configuration file as well , which is called as NTUser.Dat, this configuration file stores all the settings of user’s profile.
Okay, Now that we are clear what user profile is, I will get back to the temporary profile issue at hand. As we know what the issue is or even if we don’t, the first logical step to troubleshooting is checking the events logs on the server or PC where the issue is, In my case (and usually) I found the following Event ID 1515. 1502, 1508, 1530 and 1511 in event viewer.
Event ID 1515 1502 1508 1530 demonstrating informing the profile is inuse by some other process
Also the following event clearly shows that my problem users NTuser.dat is locked by some process
Event ID 1508, specifying the profile being used by another process
So basically now we know that because the profile which this user is supposed to be using is locked hence, computer is trying to do that next best thing and logging the user with temporary profile.
The most logical solution at this time is ensure what ever process is holding back the profile, should release it. If possible reboot of problem PC/Server should be the first step, unfortunately middle of the day it is usually not an option to reboot a terminal server, especially is problem is with a single or very few users.
1) Went ahead and disabled an online back up solution (Carbonite) which was constantly backing up files, hoping to release my c:\user\shishir\ntuser.dat file but no success
2) Disabled AV from scanning the particular user folder with no success
3) You should look for any other service which you think might be holding the profile and disable it.
4) There is also a well-known solution to these problems involving the profile Guid in registry which is often successful and we followed it as below.
ProfileSid.bak registry causing Temporary user profile
All the user profiles on a PC/Server makes an entry in registry at the location
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
When all is well, you will see only one SID named key per user and on the right hand side under “ProfileImagePath” value you can see the profile folder path as well.
However if for any reason the profile isn’t accessible and user logs in with Temp profile then the original SID key is renamed with .bak extension and another duplicate Sid Key is created which points to Temp profile path under ProfileImagePath. Usually this Temp Sid Key get deleted when the user logs off the temp profile.
See the following two screenshots, explaining the same
Duplicate profile Guid created after renaming the orginal as .bak, Notice the temp ProfileImagePath on right
Original Profile GUID being backed by .bak extention, Notice the correct profile Image Path on Right
If all goes well, as soon as the issue with your profile is fixed and you login next time, you should get your original profile Key back, But at times it doesn’t happen and the solution is simple
Deleted any duplicate key which is pointing to Temp Profile under ProfileImagePath
Rename the original Key to removed .bak from its name
Log back in with the user
Unfortunately for us , none of the possible culprit resolved the issue the next step was to down load Process Explorer and try to find open handles on my NTuser.dat file.
How to check open handles on a file with Process Explorer ?
1) Download, extract and open process Explorer
2) Click Find ->Handle or DLL
3) Under Handle or DLL substring mention the file path (in my case c:\users\shishir\ntuser.dat) and click search
Process Explorer Showing open Handles on NTuser.Dat
As you can see that in my case it was actually system that was holding back the profile ( I am sure its some other process disguised under system account doing so), so it made most sense to reboot the server before spending more time on the issue and the reboot indeed resolved our issue.
Although, our issue got resolved with Good and Old, most tried and tested MS solution ie Reboot, but still I have demonstrated the approach to troubleshoot the issue here, hope it help you guys, Else feel free to reach our paid support here
Latest posts by Shishir Chandrawat (see all)
- Exchange 2010 Std: Mailbox server has reached the maximum database limit of 5 Error RcrExceedDbLimitException - December 12, 2016
- Exchange 2010: Unable to add Mailbox Database copies on DAG member servers, Error: An error occurred while processing a request on server - December 12, 2016
- Unable to Mount Microsoft Exchange DAG Database, Error: Failed to determine the mount status of the active database copy - December 12, 2016