Solved

NTUser.dat is locked Temp Profile created

Posted on 2010-09-08
18
1,483 Views
Last Modified: 2012-06-21
I am experiencing an issue where the NTUser.dat file is locked when some of my users log in and a tempory profile is created.  If they reboot, they are able to log in normally.  This occurs randomly.  We are runing windows XP SP3 in an AD environment.  I read where some other people are also experiencing the issue but have not seen any resolution (http://social.answers.microsoft.com/Forums/en-US/xpsecurity/thread/412736cb-1f74-4ebc-baa3-8728bff84e9d).  
0
Comment
Question by:brianm71
  • 9
  • 5
  • 3
  • +1
18 Comments
 
LVL 2

Expert Comment

by:joel_glass
Comment Utility
Are you using roaming profiles in the AD invironment.  There my be issues of accessing the NTUser.dat file if there are network issues or if the files are being backed up at the time of login.
0
 
LVL 11

Expert Comment

by:kaskhedikar_tushar
Comment Utility
0
 
LVL 3

Author Comment

by:brianm71
Comment Utility
joel,
these are local profiles not roaming profiles.
0
 
LVL 2

Expert Comment

by:joel_glass
Comment Utility
What is the timing of the issue... As user "a" logs in and works for a while and logs off... then user "b" logs in and works a while and logs off and user "a" logs back in and the profile is locked...  if that is the situation, I have seen that a million time and the only way to unlock the .dat file is a reboot as explorer has locked that particular file until reboot.
0
 
LVL 3

Author Comment

by:brianm71
Comment Utility
Kras - thanks for article I have tried those.  Issue still occurs.  Like author I feel that is not the solution.

Joel - Timing on machines is normally when user reboots for evening and goes home.  When they come in in morning and log in they get the error message.
0
 
LVL 2

Expert Comment

by:joel_glass
Comment Utility
Do you know if there is an antivirus scan running at the time.  Also, have you checked the event log to see if there were any failed logon attempts trying to access the .dat file.
0
 
LVL 3

Author Comment

by:brianm71
Comment Utility
no failed logon attempts except for the current one.   Appears NTUSer.data file is locked by system.  We already removed AV to see if this was an issue.
0
 
LVL 18

Expert Comment

by:awawada
Comment Utility
I had the same issue. Most of the causes were 3rd party services and tasks.

1) Disable all 3rd party services and tasks on the client using msconfig
(Attention: In Services enable the option "Hide all Microsoft services" and disable; do not disable Microsoft services!)

2) After the restart might not show up the error. If you want to know which program is the cause, you must activate each service and task one by one again. It is important that you perform a restart every time.
0
 
LVL 3

Author Comment

by:brianm71
Comment Utility
Awawada - This will not work as it is not reproducible everytime and never immediately reproducable after a reboot.
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 18

Expert Comment

by:awawada
Comment Utility
In my case it was also not reproducible everytime.
Update every software you can...
0
 
LVL 3

Author Comment

by:brianm71
Comment Utility
tried disabling all non-microsoft services and reenablinng one by one but could not reporduce the issue
0
 
LVL 18

Expert Comment

by:awawada
Comment Utility
Did you disable & enable services and tasks? Or just services?
0
 
LVL 3

Author Comment

by:brianm71
Comment Utility
both, still cannot reliably reproduce

0
 
LVL 18

Expert Comment

by:awawada
Comment Utility
OK give me a list of all third party software.
0
 
LVL 3

Author Comment

by:brianm71
Comment Utility
the only common one on all workstations is landesk.  I found an article in landesk forums but it was for a previous version.  In working ith landesk support, they don't think it is the cause.  
0
 
LVL 18

Expert Comment

by:awawada
Comment Utility
can you give me a list of all third party software?
0
 
LVL 3

Accepted Solution

by:
brianm71 earned 0 total points
Comment Utility
deleting the following registry keys created by LANDesk seems to have resolved the problem
HKEY_LOCAL_MACHINE\SOFTWARE\LANDesk\Inventory\LogonHistory\Logons
0
 
LVL 3

Author Closing Comment

by:brianm71
Comment Utility
worked with landesk on issue.  Issue has not reoccurred since this was done.
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

If you build your web application in Visual Studio you'll get at least a few binaries, or .DLL, files in your bin folder. However, there is more compiling to be done. Normally this would happen when an ASP.NET resource within the web site is request…
There are 2 things you must have in order to connect to the internet behind a router, The "Gateway IP" of the router, which is usually something like 192.168.xxx.1, I've seen routers with default values of: 192.168.0.1, 192.168.1.1, 192.168.11.1, …
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now