ntuser.dat in use by system process every morning

EllysP
EllysP used Ask the Experts™
on
I have a user on Windows XP - all updates installed. Every morning the user gets the message that their profile (local account) cannot be loaded and a temporary one will be used. Looking at the logs, I see that the ntuser.dat file is in use by another process. I installed unlocker and verified that the file was locked by the system process. A restart releases it and all is well - annoying but OK. The really odd part is that she can log on and off throughout the day with no problem - so it's not that the profile is not unloading completely. But sometime during the night - something happens that locks it. The only thing I've seen in the logs that I thought might be pertinent is that virus defs were being updated overnight - I changed it so they would be updated during the day - but that had no effect. I have created other accounts on the machine that are not affected by this and have also deleted her profile and created a new one for her - frustratingly, her new account suffers from the same symptoms. I've been through every forum I can find to help solve this, but have come up empty. Here are some more facts: The user account is a local account. This is not an Active Directory environment. Open Directory is set up but the PCs  are not bound to it. The user is a member of the Users group - but not administrators. Symantec Endpoint 11 is installed. No other account has this problem. I've looked at all of the services and none are running as this user. I'm stumped so any ideas you have would be welcome. Thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
When you deleted the profile did you copy her files back into the new profile?  If you login to the PC and setup your profile does your account suffer the same symptoms?  Have you tried using the hive cleanup tool in the affected users profile?

Author

Commented:
I copied her "My Documents" back into the profile - but nothing else. No other account - old or new suffers these symptoms and I haven't used the hive cleanup - I guess I've been a little hard headed about it since she can log on and off during the day it seems to me that the profile is unloading correctly.
I should have been more specific about the file copy.  I have had occasions where I copied the users "My Documents" folder / contents back and something in there was causing the problem.  My solution was to create a new blank / empty profile on a freshly formatted / imaged PC and then copy the users documents / or otherwise required files to a folder on their desktop rather than dropping them into the "My Documents" location.  After I confirmed that I had isolated the issue I copied files back to "My Documents" but only the absolutely required documents.....  
How to Generate Services Revenue the Easiest Way

This Tuesday! Learn key insights about modern cyber protection services & gain practical strategies to skyrocket business:

- What it takes to build a cloud service portfolio
- How to determine which services will help your unique business grow
- Various use-cases and examples

PS I work in a large corporate operation with over 8,000 pc's and notebooks we have the hive cleanup tool on each and every PC.  It saves more than it costs....  :-)

Author

Commented:
I will be out of the office next week, but as soon as I get back, I will run the hive cleanup tool and if it doesn't take care of it, I'll create the new profile and move the files back as you've suggested - I'll hold off on the newly imaged PC as unfortunately I support this user remotely so a clean install will require me to be onsite..thanks for the suggestions, I'll let you know how it goes.

Author

Commented:
Just an update: I installed the hive cleanup service tool but the problem persists. The user is loathe to have me wipe out her profile again with no guarantee that it will solve the problem, so I've offered to set up a test account with her customizations - but no documents - that she has agreed to test each day before she logs into her normal account. We'll do that for a week and if the test account shows no signs of the problem, I will wipe her account and start fresh. I'll keep you posted.
EllysP Good Luck, I really think this is a profile issie and a new profile that is clean should solve it.   Copying in the files is where you might run into issues if there is a system file overwriten or copied in that is corrupting the NTUSER.dat...  Again Good Luck!

GZ

Author

Commented:
Thanks GaDZooKs2004,

The test account has had no problems so have convinced this user to let me wipe her profile. I'll close this question and assume that something in her profile is the cause of the pain.

Elly

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial