userenv errors 1006 and 1030

Posted on 2009-04-07
Last Modified: 2013-12-01

I am having big problems. Our setup is sbs2003 prem netweork, with XP pro clients, and 2nd server (Server 2003) as remote term serv.

Users came to work this morning and can't log in to the domain from their workstations. We are getting UserEnv errors 1006 and 1030,  which also apperas to be casuing MSExchangeAL error 8231 and MSExchangeSA 9153. When running gpupdate /force I get User env 1058 and 1030 errors.

Have attached netdiag and netshare results in txt doc.

help me Experts ... you're my only hope ...

Question by:betterlifedirections

Expert Comment

ID: 24093222
What kind of antivirus product are you using on the server?

Author Comment

ID: 24093240
I probably should give some further background to this ...

I have been getting NtFrs error 13568 for some time, and attempted to recify it LAST NIGHT using the suggestions below (hence the problems affecting users today):

###The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.
 Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 Replica root path is   : "c:\windows\sysvol\domain"
 Replica root volume is : "\\.\C:"
 A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.

Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
To change this registry parameter, run regedit.
Click on Start, Run and type regedit.
Click down the key path:
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.

**** What I did was create the new DWORD value, and then set it to 1, ran "net stop ntfrs" then "net start ntfrs".

The NtFrs error was fixed ... but it created a situation that now is preventing users from logging in.

At my wits end, as I have not been able to find a definitive answer to fix the problem and I am due to leave this office VERY soon to head back to HQ. I was hoping to not have to make the 3 hr drive back here again tomorrow to recify this problem.


Author Comment

ID: 24093243
AV is trend micro "worry Free"
Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  


Author Comment

ID: 24093404
UPDATE - still requiring help please

I ran CIECW - users can log in to domain, and can open outlook and send/receive emails and access calendars.

PROBLEM UPDATE - SBS2003 reporting MSExchangeAL 8231 error, and users can't access any mapped drives, or browse to SBS box via network places.


Author Comment

ID: 24093413
and STILL getting userenv 1030 and 1006 errors :(


Assisted Solution

2629326 earned 250 total points
ID: 24093564
This may occur on DC with two NICs, where one NIC has port filtering enabled and is blocking port 389. This can occur even if the port blocking NIC is lower in the binding order than a non port blocking NIC. May have to try reconfiguring your NIC's and re-register DNS. Check firewall and ports. Even check GC replication while at it.
Good luck.

Author Comment

ID: 24093614
yes .. saw that post elsewhere.

I don't have tcp/ip filtering enabled on any NIC.

LVL 38

Assisted Solution

by:Philip Elder
Philip Elder earned 250 total points
ID: 24093656

Author Comment

ID: 24093776
Thanks Philip,

I followed the links and ran the non-authoritative restore at

the outcome has resulted in netlogon error 5706:

The Netlogon service could not create server share C:\WINDOWS\SYSVOL\sysvol\Aggregatecorporation.local\SCRIPTS.  The following error occurred:
The system cannot find the file specified.

For more information, see Help and Support Center at

The 8231 errors have stopped, but now I am getting the paired userenv arrors 1058 and 1030

can you please recommend a next step?

thanks in anticipation of your help


Author Comment

ID: 24093894
Since restarting I get the following errors:
#System Errors:
Service Control Manager 7041, 7000, 7001, 7024
Netlogon 5706

#Application Errors:
Userenv 1058
and on startup - Microsoft Firewall 14001, 14060 plus MS ISA Server Web Proxy 14127.

The server no longer has connection to the internet.

I can supply the actual error message if this will help


Author Comment

ID: 24093897
will a restore from backup help?

LVL 38

Expert Comment

by:Philip Elder
ID: 24094070
Check your IP setup on the NIC(s) to make sure they are correct. If 2 NICs, then check the NIC service order under Advanced to verify that LAN is before WAN.


Author Comment

ID: 24094130
As far as I can see the IP setup on the NICs have not changed. I use 2. In connection manager>LAN or High-Speed Internet heading INTERNAL is listed b4 EXTERNAL. Is that what you are asking?

Not sure which Advanced setting you are referring to here? Can you please clarify?


Accepted Solution

betterlifedirections earned 0 total points
ID: 24094432
Problem soved for the moment ... restored back to Tuesday night's backup .. and that has got me out of the hole I dug last night. Issue now is to address the collection of new error messages:

Perflib 1008
ISA Server COntrol 21252

Service Control Manager 7001, 7031, 7034 and 7024

#Directory Service
NTDS Service 1229 and 1126

#DNS Server
DNS 4007 and 4001

And a warning on NtFrs 13566 re SYSVOL sharing.

So it appears that my backup did not entirely eliminate my problems. Where to start with this mess is my next question ?!


Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

It is a common problem that often server suffers from the lack of space on system volume. Old servers or new ones from vendors come with preformatted small volume - 5-6GB in total and after installing updates or applications the free space on system…
You may have discovered the 'Compatibility View Settings' workaround for making your SBS 2008 Remote Web Workplace 'connect to a computer' section stops 'working around' after a Windows 10 client upgrade.  That can be fixed so it 'works around' agai…
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question