We have a client with HQ and a satellite office connected by VPN with Sonicwall NSA 240s. User Mary can logon just fine at HQ, open email, open shares. When she logs in at the satellite office it takes 5+ minutes to complete login and email will not complete it's setup. It errors out "Cannot connect to Exchange server for the first time, etc." If I log in the exact same PC as "Joe Test" everything works fine, logs in fast, email sets up fine. If I log into another PC in the satellite office as Mary, same difficulties, 5+ minutes to login, Sysvol scripts don't run, email fails. If I take her satellite PC, drive to HQ and jack into HQ network, her account works just fine. Again, all users in satellite office work fine except for her login. Here is why I use the word haunted: As part of my troubleshooting I deleted all meta data of her previous account (a different login name even - MaryC) using ntdsutil, created the new Mary account, and the problem follows her. I worked with Tech Support with Sonicwall they said it wasn't their system, besides all other users in the same office have no issues at all, just Mary. Any ideas?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
1. Mary's previous account MaryC had the exact same issues.
2. Other users in the same satellite office don't have the problem.
3. I've deleted and recreated Mary's profile numerous times.
4. She is not a roaming profile.
5. Her account will not work on any PC in the satellite office but works fine in the HQ building. Single DC, Same AD.
As I stated in my original post I have already done that. Totally got rid of her previous account, created a new account, and problem follows to the new account. There is minimal GPO on the domain, mostly password, account lockout related items, audit policy. Running a Resultant Set of Policy verifies there is nothing affecting her specific account.
CAn you post a userenv.log (c:\windows\debug\usermode
Set the following reg key to ensure verbose mode
HKEY_LOCAL_MACHINE\Softwar
Entry: UserEnvDebugLevel
Type: REG_DWORD
Value data: 30002 (Hexadecimal)
How many groups is she in, any universal groups?
firstly can you put a basic c:\autoexec.bat in place to stop that appearing
This doesn't look like a verbose log so can you set the key, ldelete file, reboot and logon as her from the branch
also gp seems to be set for sychronous (which is a bit slower)
try removing this user from the scope of any gpo's as a test
Are there any virus scan seetings specific for this user
So I got Outlook to finally connect with the Exchange server by enabling NTLM authentication. Existing issues still include slow login and when I run a gpresult it returns a ERROR: Generic Failure. When I run a Group Policy Results report on her login on the DC there is nothing different than any other user that logs in from the satellite office. Any other ideas from anyone?
Can you take a look at http://support.microsoft.c
Can you take a look in AD Domains and Trusts please
I'm also interested in this part of the article:
A cross-forest GPO application fails if Internet Control Message Protocol (ICMP) is not enabled.
Now your log shows ICMP ping failures - have any ICMP policies been applied at routers?
Windows is using a 2048 byte ICMP packet size
Can the virus scanner interfere with these
Can you confirm how your AD sites are set up in relation to the Branch office and where DNS is held. Can you print out an IPconfig.
Are there any event log entries for userenv
Can you enable verbose status messages
http://support.microsoft.c
This will allow us to help interpret the logs - Also I'd like to grab a userenv.log with just that users traffic (delete the file, reboot and logon as her)
Are there any terminal servers involved?
I can't see anything definite in the logs - strangely no GPO's are applying and that may contribute, but it's odd if no other users are affected.
The user is loading her profile relatively quickly but I then see a lot of
GetUserDNSDomainName: Failed to impersonate user and similar errors which I suspect i causing timeouts - why again on just her account - could you run the GPresult for her computer and user account from the main domain controller (but run it in superverbose mode please)
I saw that article about ICMP there and a couple other posts. On her PC I have turned off slow link detection to see if that changed anything - it didn't. Keep in mind that any other user can log on to any PC that she has a problem with and it works fine. There are no firewall rules between VPN sites. Virus scanner is not AD aware and cannot target a specific Windows user account.
One branch office, one HQ, one DC running SBS2003.
No event log entries for userenv
We'll have to wait for a bit for new logs.
Also, I excluded her account from applying GPOs yesterday, rebooted - no difference.
Business Accounts
Answer for Membership
by: augwestPosted on 2009-09-10 at 14:24:04ID: 25304577
How is AD setup? Depending on where Marys account is it could be whats holding up it could also be something in her profile on the computer