Solved

Large Roaming User Profiles

Posted on 2010-11-16
19
1,310 Views
Last Modified: 2012-05-10
I am trying to move from a workgroup configuration to a domain configuration utilizing roaming user profiles so our employee's can log onto any machine and retrieve the profile they are accustomed to.

I'm running into a problem since many of our user profiles are large!  I've attempted to follow instructions to re-direct folders in Active Directory, but it doesn't seem to be working.  Login times are still VERY slow and it appears the workstation is still downloading the ENTIRE profile.

I've tried re-directing Application Data, My Documents, Favorites, & the Start Menu.  Any advice would be greatly appreciated!
0
Comment
Question by:mshaffner
  • 8
  • 7
  • 2
  • +1
19 Comments
 
LVL 8

Expert Comment

by:PenguinN
ID: 34149340
You need to check if policies are applied properly
You need your redirection to a share on a fileserver, be sure to set the permissions right. Als check that that internet cache is deleted on closing internet explorer if you redirect complete profiles.

User Configuration\Windows Settings\Folder Redirection\My Documents\
Setting: Basic (Redirect everyone's folder to the same location)
Path: \\Server\Users\%USERNAME%\My Documents
Grant user exclusive rights to My Documents                  Disabled
Move the contents of My Documents to the new location            Enabled
Policy Removal Behavior                              Leave contents

Also check http://www.edugeek.net/wiki/index.php/Roaming_Profiles
0
 
LVL 2

Expert Comment

by:profjohan11
ID: 34149350
Hi,

Maybe you should start looking at setting up profile limits. Politically speaking this might be a challenge.

http://technet.microsoft.com/en-us/library/cc781862%28WS.10%29.aspx

Other than that look here maybe.

http://technet.microsoft.com/en-us/library/cc738787%28WS.10%29.aspx

If you have done this, check the logs on the server/workstation for  a user you know is having a problem. Maybe there might be an indication of why your folder redirection is not working. Would help if you have errors/information to work from.

Johan


0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34151676
Is the redirection working? Also, are you sure that the exclusions of Local Settings\Temp and Temporary Internet Files are setup?
0
 

Author Comment

by:mshaffner
ID: 34154964
To all:

I will attempt your suggestions.  Please note I consider myself advanced at computer/networking skills; however, I am a novice at setting up a domain from scratch.  I do not believe the redirection I have set-up is currently working.

When I began creating the user profiles on the server, my first step was to Copy the profile from the existing user's Windows XP machine to a shared folder on the server called "Profiles".  This copied everything to that folder including App Data.  Can I re-direct to those specific folders or do they need to be stored in a separate directory?  Furthermore, do they HAVE to be stored on the Windows Server or can I use a Link Station Duo Network Drive?
0
 

Author Comment

by:mshaffner
ID: 34157621
Things are improving... I've gone from an 11 minute logon to a 5 minute logon.  However, I'd still like to get that down to UNDER a minute.  The exclusion of folders seem to be the key; however, even though I set it to exclude "My Documents", they are still being copied with the roaming profile.  The only thing I notice is that in the user's profile directory, the "My Documents" folder shows up as "username's documents".  Do you think that has anything to do with it? ...and if so; how would I go about excluding a folder with a variable name?
0
 
LVL 8

Expert Comment

by:PenguinN
ID: 34163508
What is happening when you redirect folders, the old my documents just stay's where it is?
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34163995
You would use the Exclusions based on the Folder Name, as it starts from %userprofile%...

So You wouldnt Exclude %userprofile%\My Documents, you would just put "My Documents;Nethood;Start Menu;Local Settings" etc...

Dont worry about how you are seeing the name of the folder differently. Thats normal, as the My Documetns folder is a "shell folder" and behaves differently, depending on where you see it (local/across the network), and whether you are seeing it via your OWN profile or not.....
0
 

Author Comment

by:mshaffner
ID: 34164210
Everything is staying in the "Profiles" directory and being copied down to the local machine.  I am trying something; however, and that is to log on to the SERVER with the user name before logging onto the client machine.  I'll let you all know how it goes; in the meanwhile keep the suggestions coming!  Thanks to all for your excellent advice so far!
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34170572
Does an RSOP.MSC show the exclusions set properly?
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 

Author Comment

by:mshaffner
ID: 34209251
I'm sorry to say unless I get some serious help here I'm going to have to abandon this project.  The roaming profiles work, partially.  They just take an enormous amount of time to load.  The user's documents and settings folder on the client machine is only 22.6 MB.

RSOP.MSC gives the following:  RSoP data is invalid.  Likely causes are, data is corrupt, data has been deleted or data has never been created.  Details:  Invalid namespace

HELP!
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34245240
22.6 mb is nothing for a profile size.....

Process Monitor can enable boot logging, so you can see whats happening in EXTREME DETAIL............

Troubleshooting with Process Monitor
http://blogs.technet.com/b/askperf/archive/2007/06/01/troubleshooting-with-process-monitor.aspx

Options>Select Enable Boot Logging, and reboot.... After reboot, launch Procmon to compile the logs.....

Then you can look at the times to see where your delays are......

If youre on a DOMAIN, I would look at the following......

How to enable user environment debug logging in retail builds of ...
http://support.microsoft.com/kb/221833

How do you use userenv.log to troubleshoot
http://www.pcreview.co.uk/forums/thread-1529306.php

Understanding How to Read a Userenv Log – Part 1 - Ask the ...
http://blogs.technet.com/b/askds/archive/2008/11/11/understanding-how-to-read-a-userenv-log-part-1.aspx

Interpreting Userenv log files: Group Policy
http://technet.microsoft.com/en-us/library/cc786775(WS.10).aspx

Attach the Userenv.log file if youd like and Id be happy to help.....
0
 

Author Comment

by:mshaffner
ID: 34286844
johnb6767:  I am going to attach the Userenv.log file for your review (thanks for offering!)  When I enable user environment debug logging, do I do this on the client or the server machine?  Also, which level of debug should I indicate in the registry (Normal, Verbose, Logfile, or Debugger)?  Thanks!
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34297913
Client..... 1002 should be fine.....
0
 

Author Comment

by:mshaffner
ID: 34305571
JOHNB6767:  I pasted the Userenv.log in the code snippet below.  Hope you can find out how to fix what's wrong with this thing.  I'm in new territory and need help bad!  Thanks for your efforts!
USERENV(3e4.3e8) 16:27:08:000 CUserProfile::CleanupUserProfile: Ref Count is not 0

USERENV(3e4.3e8) 16:27:08:109 CUserProfile::CleanupUserProfile: Ref Count is not 0

USERENV(3e4.3e8) 16:27:08:187 CUserProfile::CleanupUserProfile: Ref Count is not 0

USERENV(3e4.5d4) 16:29:04:036 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.5d4) 16:30:24:890 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.5d4) 16:31:50:420 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.5d4) 16:33:11:275 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.5d4) 16:33:11:275 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.a60) 16:34:30:004 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.a60) 16:35:39:794 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.a60) 16:36:49:823 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.a60) 16:37:59:613 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.a60) 16:37:59:613 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 18:15:29:473 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 18:16:33:231 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 18:17:38:740 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 18:18:43:817 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 18:18:43:817 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 18:32:13:198 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 18:33:17:399 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 18:34:21:490 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 18:35:25:694 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 18:35:25:694 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 20:02:48:497 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 20:03:53:798 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 20:04:58:004 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 20:06:03:195 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 20:06:03:195 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 20:07:33:762 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 20:08:37:859 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 20:09:49:175 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 20:10:53:710 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 20:10:53:710 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 21:41:58:693 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 21:43:02:790 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 21:44:06:777 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 21:45:14:375 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 21:45:14:375 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 22:05:07:936 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 22:06:12:142 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 22:07:16:677 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 22:08:20:555 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 22:08:20:555 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 23:42:24:035 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 23:43:28:132 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 23:44:32:448 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 23:45:21:232 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 23:45:40:045 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 23:45:40:045 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 23:46:28:063 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 23:47:32:160 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 23:48:36:257 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 23:48:36:257 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 01:29:46:601 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 01:30:43:478 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 01:30:53:541 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 01:31:50:200 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 01:32:00:481 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 01:32:58:124 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 01:33:07:968 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 01:33:07:968 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 01:34:03:971 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 01:34:03:971 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 03:11:11:937 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 03:12:16:033 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 03:13:19:692 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 03:14:23:898 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 03:14:23:898 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 03:18:08:783 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 03:19:12:748 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 03:20:16:814 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 03:21:21:317 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 03:21:21:317 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 04:45:28:154 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 04:46:32:796 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 04:47:36:783 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 04:48:40:878 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 04:48:40:878 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 05:12:24:987 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 05:13:29:629 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 05:14:33:834 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 05:15:40:883 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 05:15:40:883 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 06:42:44:490 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 06:43:49:351 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 06:44:55:306 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 06:46:03:449 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 06:46:03:449 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 07:08:45:868 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 07:09:49:854 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 07:10:54:169 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 07:11:58:046 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 07:11:58:046 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 08:18:09:579 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 08:19:14:331 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 08:20:17:990 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 08:21:21:976 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 08:21:21:976 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 09:07:03:439 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 09:08:07:535 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 09:09:11:521 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 09:10:15:945 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 09:10:15:945 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 10:07:25:836 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 10:08:30:041 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 10:09:34:574 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 10:10:38:780 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 10:10:38:780 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 11:07:20:342 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 11:08:25:203 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 11:09:29:408 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 11:10:33:832 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 11:10:33:832 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 12:00:44:694 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 12:01:49:227 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 12:02:53:870 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 12:03:58:185 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 12:03:58:185 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 12:53:37:646 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 12:54:41:850 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 12:55:46:165 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 12:56:50:261 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 12:56:50:261 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 13:41:02:033 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 13:42:06:238 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 13:43:11:209 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 13:44:15:086 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 13:44:15:086 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 14:31:54:349 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 14:32:59:430 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 14:34:06:479 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 14:35:10:574 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 14:35:10:574 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.1d0) 15:18:20:041 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 15:19:24:246 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 15:20:28:561 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 15:21:33:094 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.1d0) 15:21:33:094 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.210) 16:35:14:720 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 16:36:18:925 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 16:37:23:349 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 16:38:27:883 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3e4.210) 16:38:27:883 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3e4.3e8) 16:58:20:235 ReconcileFile: Unable to open temporary file

USERENV(3d8.3dc) 16:57:22:093 CUserProfile::CleanupUserProfile: Ref Count is not 0

USERENV(3d8.3dc) 16:57:22:312 CUserProfile::CleanupUserProfile: Ref Count is not 0

USERENV(3d8.3dc) 16:57:22:375 CUserProfile::CleanupUserProfile: Ref Count is not 0

USERENV(3d8.600) 16:59:15:189 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.600) 17:00:36:221 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.600) 17:01:56:839 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.600) 17:03:17:320 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.600) 17:03:17:320 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 18:35:20:510 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 18:36:24:390 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 18:37:28:489 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 18:38:32:151 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 18:38:32:151 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 20:37:35:942 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 20:38:39:928 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 20:39:43:696 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 20:40:47:573 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 20:40:47:573 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 22:36:52:458 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 22:37:56:555 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 22:39:00:433 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 22:40:04:639 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 22:40:04:639 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 00:39:08:518 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 00:40:12:285 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 00:41:16:270 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 00:42:20:255 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 00:42:20:255 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 02:34:24:116 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 02:35:27:994 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 02:36:31:980 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 02:37:35:639 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 02:37:35:639 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 04:34:39:207 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 04:35:43:085 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 04:36:47:181 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 04:37:51:277 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 04:37:51:277 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 06:12:54:875 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 06:13:58:862 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 06:15:05:692 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 06:16:12:414 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 06:16:12:414 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 07:51:16:040 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 07:52:20:246 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 07:53:24:232 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 07:54:28:657 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 07:54:28:657 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 09:46:36:450 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 09:47:44:810 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 09:48:51:858 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 09:50:00:437 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 09:50:00:437 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 11:22:04:485 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 11:23:09:237 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 11:24:13:114 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 11:25:16:772 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 11:25:16:772 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 13:14:20:936 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 13:15:29:188 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 13:16:36:237 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 13:17:44:380 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 13:17:44:380 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d30) 14:58:48:978 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 14:59:52:746 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 15:00:59:795 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 15:02:06:844 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d30) 15:02:06:844 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.d64) 15:59:38:720 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d64) 16:00:46:206 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d64) 16:01:53:583 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d64) 16:03:00:414 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.d64) 16:03:00:414 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(778.fa4) 16:08:48:050 LibMain: Process Name:  C:\WINDOWS\system32\mobsync.exe

USERENV(3d8.3dc) 16:08:59:988 ReconcileFile: Unable to open temporary file

USERENV(3d8.3f0) 16:09:04:316 DropClientContext: Got client token 000001C4, sid = S-1-5-18

USERENV(3d8.3f0) 16:09:04:316 MIDL_user_allocate enter

USERENV(3d8.69c) 16:09:04:316 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.c98) 16:09:04:316 UnloadUserProfileP: Reverted back to user <00000000>

USERENV(3d8.c98) 16:09:04:316 CSyncManager::LeaveLock <S-1-5-19>

USERENV(3d8.c98) 16:09:04:332 CSyncManager::LeaveLock: Lock released

USERENV(3d8.c98) 16:09:04:332 CHashTable::HashDelete: S-1-5-19 deleted

USERENV(3d8.c98) 16:09:04:332 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.c98) 16:09:04:332 UnloadUserProfileP: Leave critical section.

USERENV(3d8.c98) 16:09:04:332 UnloadUserProfileP: Leaving with a return value of 1

USERENV(3d8.c98) 16:09:04:332 UnloadUserProfileI: returning 0

USERENV(3d8.69c) 16:09:04:347 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.69c) 16:09:04:347 ReleaseClientContext: Releasing context

USERENV(3d8.69c) 16:09:04:347 ReleaseClientContext_s: Releasing context

USERENV(3d8.69c) 16:09:04:347 MIDL_user_free enter

USERENV(93c.f08) 16:09:06:425 LibMain: Process Name:  C:\WINDOWS\system32\wuauclt.exe

USERENV(3d8.3dc) 16:07:49:281 InitializePolicyProcessing: Initialised Machine Mutex/Events

USERENV(3d8.3dc) 16:07:49:625 InitializePolicyProcessing: Initialised User Mutex/Events

USERENV(3d8.3dc) 16:07:49:734 LibMain: Process Name:  \??\C:\WINDOWS\system32\winlogon.exe

USERENV(3d8.3dc) 16:07:50:562 Entering CUserProfile::Initialize ...

USERENV(3d8.3dc) 16:07:50:734 CUserProfile::Initialize called by winlogon

USERENV(3d8.3dc) 16:07:50:812 CUserProfile::Initialize: critical section initialized

USERENV(3d8.3dc) 16:07:50:890 CSyncManager::Initialize: critical section initialized

USERENV(3d8.3dc) 16:07:50:968 CUserProfile::Initialize: registry key Software\Microsoft\Windows NT\CurrentVersion\ProfileList opened

USERENV(3d8.3dc) 16:07:51:062 CUserProfile::Initialize: Proccessing S-1-5-21-515967899-329068152-1177238915-500

USERENV(3d8.3dc) 16:07:51:156 CSyncManager::EnterLock <S-1-5-21-515967899-329068152-1177238915-500>

USERENV(3d8.3dc) 16:07:51:234 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.3dc) 16:07:51:296 CSyncManager::EnterLock: New entry created

USERENV(3d8.3dc) 16:07:51:390 CHashTable::HashAdd: S-1-5-21-515967899-329068152-1177238915-500 added in bucket 0

USERENV(3d8.3dc) 16:07:51:531 CUserProfile::CleanupUserProfile: Enter critical section.

USERENV(3d8.3dc) 16:07:51:609 CUserProfile::GetRefCountAndFlags: Ref count is 0, state is 00000104

USERENV(3d8.3dc) 16:07:51:687 CSyncManager::LeaveLock <S-1-5-21-515967899-329068152-1177238915-500>

USERENV(3d8.3dc) 16:07:51:781 CSyncManager::LeaveLock: Lock released

USERENV(3d8.3dc) 16:07:51:875 CHashTable::HashDelete: S-1-5-21-515967899-329068152-1177238915-500 deleted

USERENV(3d8.3dc) 16:07:51:968 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.3dc) 16:07:52:046 CUserProfile::CleanupUserProfile: Leave critical section

USERENV(3d8.3dc) 16:07:52:125 CUserProfile::Initialize: Proccessing S-1-5-21-473866232-1690843657-1110412475-500

USERENV(3d8.3dc) 16:07:52:218 CSyncManager::EnterLock <S-1-5-21-473866232-1690843657-1110412475-500>

USERENV(3d8.3dc) 16:07:52:296 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.3dc) 16:07:52:375 CSyncManager::EnterLock: New entry created

USERENV(3d8.3dc) 16:07:52:453 CHashTable::HashAdd: S-1-5-21-473866232-1690843657-1110412475-500 added in bucket 2

USERENV(3d8.3dc) 16:07:52:515 CUserProfile::CleanupUserProfile: Enter critical section.

USERENV(3d8.3dc) 16:07:52:593 CUserProfile::GetRefCountAndFlags: Ref count is 0, state is 00000110

USERENV(3d8.3dc) 16:07:52:671 CSyncManager::LeaveLock <S-1-5-21-473866232-1690843657-1110412475-500>

USERENV(3d8.3dc) 16:07:52:812 CSyncManager::LeaveLock: Lock released

USERENV(3d8.3dc) 16:07:52:875 CHashTable::HashDelete: S-1-5-21-473866232-1690843657-1110412475-500 deleted

USERENV(3d8.3dc) 16:07:52:953 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.3dc) 16:07:53:062 CUserProfile::CleanupUserProfile: Leave critical section

USERENV(3d8.3dc) 16:07:53:125 CUserProfile::Initialize: Proccessing S-1-5-21-473866232-1690843657-1110412475-1124

USERENV(3d8.3dc) 16:07:53:203 CSyncManager::EnterLock <S-1-5-21-473866232-1690843657-1110412475-1124>

USERENV(3d8.3dc) 16:07:53:281 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.3dc) 16:07:53:437 CSyncManager::EnterLock: New entry created

USERENV(3d8.3dc) 16:07:53:578 CHashTable::HashAdd: S-1-5-21-473866232-1690843657-1110412475-1124 added in bucket 7

USERENV(3d8.3dc) 16:07:53:718 CUserProfile::CleanupUserProfile: Enter critical section.

USERENV(3d8.3dc) 16:07:53:828 CUserProfile::GetRefCountAndFlags: Ref count is 0, state is 00000010

USERENV(3d8.3dc) 16:07:53:906 CSyncManager::LeaveLock <S-1-5-21-473866232-1690843657-1110412475-1124>

USERENV(3d8.3dc) 16:07:53:968 CSyncManager::LeaveLock: Lock released

USERENV(3d8.3dc) 16:07:54:031 CHashTable::HashDelete: S-1-5-21-473866232-1690843657-1110412475-1124 deleted

USERENV(3d8.3dc) 16:07:54:125 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.3dc) 16:07:54:218 CUserProfile::CleanupUserProfile: Leave critical section

USERENV(3d8.3dc) 16:07:54:296 CUserProfile::Initialize: Proccessing S-1-5-21-473866232-1690843657-1110412475-1122

USERENV(3d8.3dc) 16:07:54:406 CSyncManager::EnterLock <S-1-5-21-473866232-1690843657-1110412475-1122>

USERENV(3d8.3dc) 16:07:54:531 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.3dc) 16:07:54:640 CSyncManager::EnterLock: New entry created

USERENV(3d8.3dc) 16:07:54:734 CHashTable::HashAdd: S-1-5-21-473866232-1690843657-1110412475-1122 added in bucket 5

USERENV(3d8.3dc) 16:07:54:828 CUserProfile::CleanupUserProfile: Enter critical section.

USERENV(3d8.3dc) 16:07:54:906 CUserProfile::GetRefCountAndFlags: Ref count is 0, state is 00000014

USERENV(3d8.3dc) 16:07:54:984 CSyncManager::LeaveLock <S-1-5-21-473866232-1690843657-1110412475-1122>

USERENV(3d8.3dc) 16:07:55:046 CSyncManager::LeaveLock: Lock released

USERENV(3d8.3dc) 16:07:55:140 CHashTable::HashDelete: S-1-5-21-473866232-1690843657-1110412475-1122 deleted

USERENV(3d8.3dc) 16:07:55:234 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.3dc) 16:07:55:312 CUserProfile::CleanupUserProfile: Leave critical section

USERENV(3d8.3dc) 16:07:55:375 CUserProfile::Initialize: Proccessing S-1-5-20

USERENV(3d8.3dc) 16:07:55:562 CSyncManager::EnterLock <S-1-5-20>

USERENV(3d8.3dc) 16:07:55:640 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.3dc) 16:07:55:703 CSyncManager::EnterLock: New entry created

USERENV(3d8.3dc) 16:07:55:750 CHashTable::HashAdd: S-1-5-20 added in bucket 4

USERENV(3d8.3dc) 16:07:55:828 CUserProfile::CleanupUserProfile: Enter critical section.

USERENV(3d8.3dc) 16:07:55:906 CUserProfile::GetRefCountAndFlags: Ref count is 2, state is 00000000

USERENV(3d8.3dc) 16:07:56:000 CUserProfile::CleanupUserProfile: Ref Count is not 0

USERENV(3d8.3dc) 16:07:56:062 CSyncManager::LeaveLock <S-1-5-20>

USERENV(3d8.3dc) 16:07:56:140 CSyncManager::LeaveLock: Lock released

USERENV(3d8.3dc) 16:07:56:187 CHashTable::HashDelete: S-1-5-20 deleted

USERENV(3d8.3dc) 16:07:56:250 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.3dc) 16:07:56:328 CUserProfile::CleanupUserProfile: Leave critical section

USERENV(3d8.3dc) 16:07:56:562 CUserProfile::Initialize: Proccessing S-1-5-19

USERENV(3d8.3dc) 16:07:56:718 CSyncManager::EnterLock <S-1-5-19>

USERENV(3d8.3dc) 16:07:56:765 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.3dc) 16:07:56:875 CSyncManager::EnterLock: New entry created

USERENV(3d8.3dc) 16:07:56:953 CHashTable::HashAdd: S-1-5-19 added in bucket 12

USERENV(3d8.3dc) 16:07:57:031 CUserProfile::CleanupUserProfile: Enter critical section.

USERENV(3d8.3dc) 16:07:57:093 CUserProfile::GetRefCountAndFlags: Ref count is 2, state is 00000000

USERENV(3d8.3dc) 16:07:57:171 CUserProfile::CleanupUserProfile: Ref Count is not 0

USERENV(3d8.3dc) 16:07:57:250 CSyncManager::LeaveLock <S-1-5-19>

USERENV(3d8.3dc) 16:07:57:296 CSyncManager::LeaveLock: Lock released

USERENV(3d8.3dc) 16:07:57:359 CHashTable::HashDelete: S-1-5-19 deleted

USERENV(3d8.3dc) 16:07:57:453 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.3dc) 16:07:57:468 CUserProfile::CleanupUserProfile: Leave critical section

USERENV(3d8.3dc) 16:07:57:484 CUserProfile::Initialize: Proccessing S-1-5-18

USERENV(3d8.3dc) 16:07:57:500 CSyncManager::EnterLock <S-1-5-18>

USERENV(3d8.3dc) 16:07:57:500 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.3dc) 16:07:57:500 CSyncManager::EnterLock: New entry created

USERENV(3d8.3dc) 16:07:57:500 CHashTable::HashAdd: S-1-5-18 added in bucket 11

USERENV(3d8.3dc) 16:07:57:515 CUserProfile::CleanupUserProfile: Enter critical section.

USERENV(3d8.3dc) 16:07:57:515 CUserProfile::GetRefCountAndFlags: Ref count is 1, state is 00000000

USERENV(3d8.3dc) 16:07:57:515 CUserProfile::CleanupUserProfile: Ref Count is not 0

USERENV(3d8.3dc) 16:07:57:515 CSyncManager::LeaveLock <S-1-5-18>

USERENV(3d8.3dc) 16:07:57:515 CSyncManager::LeaveLock: Lock released

USERENV(3d8.3dc) 16:07:57:515 CHashTable::HashDelete: S-1-5-18 deleted

USERENV(3d8.3dc) 16:07:57:515 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.3dc) 16:07:57:515 CUserProfile::CleanupUserProfile: Leave critical section

USERENV(3d8.3dc) 16:07:57:531 CUserProfile::Initialize: RpcServerRegisterIfEx successful

USERENV(3d8.3dc) 16:07:57:531 Exiting CUserProfile::Initialize, successful

USERENV(410.414) 16:07:57:609 LibMain: Process Name:  C:\WINDOWS\system32\lsass.exe

USERENV(3d8.3dc) 16:07:57:640 IsSyncForegroundPolicyRefresh: Asynchronous, Reason: NoNeedForSync

USERENV(4c8.4d4) 16:07:58:078 LibMain: Process Name:  C:\WINDOWS\system32\svchost.exe

USERENV(404.408) 16:07:58:203 LoadUserProfile: Yes, we can impersonate the user. Running as self

USERENV(404.408) 16:07:58:203 =========================================================

USERENV(404.408) 16:07:58:203 LoadUserProfile: Entering, hToken = <0x2a0>, lpProfileInfo = 0x7fca8

USERENV(404.408) 16:07:58:203 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(404.408) 16:07:58:203 LoadUserProfile: lpProfileInfo->lpUserName = <NetworkService>

USERENV(404.408) 16:07:58:203 LoadUserProfile: NULL central profile path

USERENV(404.408) 16:07:58:203 LoadUserProfile: NULL default profile path

USERENV(404.408) 16:07:58:203 LoadUserProfile: NULL server name

USERENV(404.408) 16:07:58:218 GetInterface: Returning rpc binding handle

USERENV(3d8.3f0) 16:07:58:218 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.3f0) 16:07:58:218 DropClientContext: Got client token 000005FC, sid = S-1-5-18

USERENV(3d8.3f0) 16:07:58:218 MIDL_user_allocate enter

USERENV(3d8.3f0) 16:07:58:218 DropClientContext: load profile object successfully made

USERENV(3d8.3f0) 16:07:58:218 DropClientContext: Returning 0

USERENV(404.408) 16:07:58:218 LoadUserProfile: Calling DropClientToken (as self) succeeded

USERENV(3d8.520) 16:07:58:234 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.520) 16:07:58:234 In LoadUserProfileP

USERENV(3d8.520) 16:07:58:234 LoadUserProfile: Running as client

USERENV(3d8.520) 16:07:58:234 =========================================================

USERENV(3d8.520) 16:07:58:234 LoadUserProfile: Entering, hToken = <0x600>, lpProfileInfo = 0xebc6d8

USERENV(3d8.520) 16:07:58:234 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(3d8.520) 16:07:58:234 LoadUserProfile: lpProfileInfo->lpUserName = <NetworkService>

USERENV(3d8.520) 16:07:58:234 LoadUserProfile: NULL central profile path

USERENV(3d8.520) 16:07:58:250 LoadUserProfile: NULL default profile path

USERENV(3d8.520) 16:07:58:250 LoadUserProfile: NULL server name

USERENV(3d8.520) 16:07:58:250 LoadUserProfile: User sid: S-1-5-20

USERENV(3d8.520) 16:07:58:250 CSyncManager::EnterLock <S-1-5-20>

USERENV(3d8.520) 16:07:58:250 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.520) 16:07:58:250 CSyncManager::EnterLock: New entry created

USERENV(3d8.520) 16:07:58:250 CHashTable::HashAdd: S-1-5-20 added in bucket 4

USERENV(3d8.520) 16:07:58:250 LoadUserProfile: Wait succeeded. In critical section.

USERENV(3d8.520) 16:07:58:265 RestoreUserProfile:  Entering

USERENV(3d8.520) 16:07:58:265 IsCentralProfileReachable:  Entering

USERENV(3d8.520) 16:07:58:265 IsCentralProfileReachable:  Null path.  Leaving

USERENV(3d8.520) 16:07:58:265 RestoreUserProfile:  Profile path = <>

USERENV(3d8.520) 16:07:58:265 ExtractProfileFromBackup:  A profile already exists

USERENV(3d8.520) 16:07:58:265 PatchNewProfileIfRequred: A profile already exists with the current sid, exitting

USERENV(3d8.520) 16:07:58:265 CreateLocalProfileKey:  Not setting additional Security

USERENV(3d8.520) 16:07:58:265 GetExistingLocalProfileImage:  Found entry in profile list for existing local profile

USERENV(3d8.520) 16:07:58:265 GetExistingLocalProfileImage:  Local profile image filename = <%SystemDrive%\Documents and Settings\NetworkService>

USERENV(3d8.520) 16:07:58:281 GetExistingLocalProfileImage:  Expanded local profile image filename = <C:\Documents and Settings\NetworkService>

USERENV(3d8.520) 16:07:58:281 GetExistingLocalProfileImage:  No local mandatory profile.  Error = 2

USERENV(3d8.520) 16:07:58:281 GetExistingLocalProfileImage:  Found local profile image file ok <C:\Documents and Settings\NetworkService\ntuser.dat>

USERENV(3d8.520) 16:07:58:281 GetExistingLocalProfileImage:  Failed to query low profile unload time with error 2

USERENV(3d8.520) 16:07:58:281 Local Existing Profile Image is reachable

USERENV(3d8.520) 16:07:58:281 Local profile name is <C:\Documents and Settings\NetworkService>

USERENV(3d8.520) 16:07:58:281 RestoreUserProfile:  No central profile.  Attempting to load local profile.

USERENV(3d8.520) 16:07:58:296 MyRegLoadKey: Returning 00000000

USERENV(3d8.520) 16:07:58:296 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(3d8.520) 16:07:58:296 MyRegLoadKey: Returning 00000000

USERENV(3d8.520) 16:07:58:296 CreateClassHive: existing user classes hive found

USERENV(3d8.520) 16:07:58:296 RestoreUserProfile:  About to Leave.  Final Information follows:

USERENV(3d8.520) 16:07:58:312 Profile was successfully loaded.

USERENV(3d8.520) 16:07:58:312 lpProfile->lpRoamingProfile = <>

USERENV(3d8.520) 16:07:58:312 lpProfile->lpLocalProfile = <C:\Documents and Settings\NetworkService>

USERENV(3d8.520) 16:07:58:312 lpProfile->dwInternalFlags = 0x0

USERENV(3d8.520) 16:07:58:312 RestoreUserProfile:  Leaving.

USERENV(3d8.520) 16:07:58:312 UpgradeProfile: Entering

USERENV(3d8.520) 16:07:58:312 UpgradeProfile: Build numbers match

USERENV(3d8.520) 16:07:58:312 UpgradeProfile: Leaving Successfully

USERENV(3d8.520) 16:07:58:328 GetProfileType:  Profile already loaded.

USERENV(3d8.520) 16:07:58:328 LoadProfileInfo:  Failed to query central profile with error 2

USERENV(3d8.520) 16:07:58:328 GetProfileType: ProfileFlags is 0

USERENV(3d8.520) 16:07:58:359 Profile Ref Count is 1

USERENV(3d8.520) 16:07:58:359 LoadUserProfile: Leaving critical Section.

USERENV(3d8.520) 16:07:58:359 CSyncManager::LeaveLock <S-1-5-20>

USERENV(3d8.520) 16:07:58:359 CSyncManager::LeaveLock: Lock released

USERENV(3d8.520) 16:07:58:359 CHashTable::HashDelete: S-1-5-20 deleted

USERENV(3d8.520) 16:07:58:375 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.520) 16:07:58:375 LoadUserProfile: Impersonated user: 00000600, 0000060c

USERENV(410.48c) 16:07:58:375 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(410.48c) 16:07:58:375 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(3d8.520) 16:07:58:406 LoadUserProfile: Reverted to user: 00000000

USERENV(3d8.520) 16:07:58:406 LoadUserProfile: Reverted back to user <00000000>

USERENV(3d8.520) 16:07:58:406 LoadUserProfile: Leaving with a value of 1.

USERENV(3d8.520) 16:07:58:406 =========================================================

USERENV(3d8.520) 16:07:58:406 LoadUserProfileI: returning 0

USERENV(404.408) 16:07:58:406 LoadUserProfile: Running as self

USERENV(404.408) 16:07:58:406 LoadUserProfile: Calling LoadUserProfileI (as user) succeeded

USERENV(404.408) 16:07:58:406 LoadUserProfile:  Returning success.  Final Information follows:

USERENV(404.408) 16:07:58:406 lpProfileInfo->UserName = <NetworkService>

USERENV(404.408) 16:07:58:421 lpProfileInfo->lpProfilePath = <>

USERENV(404.408) 16:07:58:421 lpProfileInfo->dwFlags = 0x9

USERENV(3d8.3f0) 16:07:58:421 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.3f0) 16:07:58:421 ReleaseClientContext: Releasing context

USERENV(3d8.3f0) 16:07:58:421 ReleaseClientContext_s: Releasing context

USERENV(3d8.3f0) 16:07:58:421 MIDL_user_free enter

USERENV(404.408) 16:07:58:421 ReleaseInterface: Releasing rpc binding handle

USERENV(404.408) 16:07:58:421 LoadUserProfile: Returning TRUE. hProfile = <0x334>

USERENV(404.408) 16:07:58:421 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(528.52c) 16:07:58:468 LibMain: Process Name:  C:\WINDOWS\system32\svchost.exe

USERENV(598.59c) 16:07:58:593 LibMain: Process Name:  C:\WINDOWS\System32\svchost.exe

USERENV(614.618) 16:07:58:843 LibMain: Process Name:  C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

USERENV(404.408) 16:07:58:984 LoadUserProfile: Yes, we can impersonate the user. Running as self

USERENV(404.408) 16:07:59:000 =========================================================

USERENV(404.408) 16:07:59:000 LoadUserProfile: Entering, hToken = <0x398>, lpProfileInfo = 0x7fca8

USERENV(404.408) 16:07:59:000 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(404.408) 16:07:59:000 LoadUserProfile: lpProfileInfo->lpUserName = <NetworkService>

USERENV(404.408) 16:07:59:015 LoadUserProfile: NULL central profile path

USERENV(404.408) 16:07:59:015 LoadUserProfile: NULL default profile path

USERENV(404.408) 16:07:59:015 LoadUserProfile: NULL server name

USERENV(404.408) 16:07:59:015 GetInterface: Returning rpc binding handle

USERENV(3d8.520) 16:07:59:015 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.520) 16:07:59:015 DropClientContext: Got client token 00000600, sid = S-1-5-18

USERENV(3d8.520) 16:07:59:015 MIDL_user_allocate enter

USERENV(3d8.520) 16:07:59:015 DropClientContext: load profile object successfully made

USERENV(3d8.520) 16:07:59:015 DropClientContext: Returning 0

USERENV(404.408) 16:07:59:015 LoadUserProfile: Calling DropClientToken (as self) succeeded

USERENV(3d8.3f0) 16:07:59:031 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.3f0) 16:07:59:031 In LoadUserProfileP

USERENV(3d8.3f0) 16:07:59:031 LoadUserProfile: Running as client

USERENV(3d8.3f0) 16:07:59:031 =========================================================

USERENV(3d8.3f0) 16:07:59:031 LoadUserProfile: Entering, hToken = <0x610>, lpProfileInfo = 0xec0b18

USERENV(3d8.3f0) 16:07:59:031 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(3d8.3f0) 16:07:59:031 LoadUserProfile: lpProfileInfo->lpUserName = <NetworkService>

USERENV(3d8.3f0) 16:07:59:031 LoadUserProfile: NULL central profile path

USERENV(3d8.3f0) 16:07:59:031 LoadUserProfile: NULL default profile path

USERENV(3d8.3f0) 16:07:59:031 LoadUserProfile: NULL server name

USERENV(3d8.3f0) 16:07:59:046 LoadUserProfile: User sid: S-1-5-20

USERENV(3d8.3f0) 16:07:59:046 CSyncManager::EnterLock <S-1-5-20>

USERENV(3d8.3f0) 16:07:59:046 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.3f0) 16:07:59:046 CSyncManager::EnterLock: New entry created

USERENV(3d8.3f0) 16:07:59:046 CHashTable::HashAdd: S-1-5-20 added in bucket 4

USERENV(3d8.3f0) 16:07:59:046 LoadUserProfile: Wait succeeded. In critical section.

USERENV(3d8.3f0) 16:07:59:046 TestIfUserProfileLoaded:  Profile already loaded.

USERENV(3d8.3f0) 16:07:59:546 Profile Ref Count is 2

USERENV(3d8.3f0) 16:07:59:546 LoadUserProfile: Leaving critical Section.

USERENV(3d8.3f0) 16:07:59:546 CSyncManager::LeaveLock <S-1-5-20>

USERENV(3d8.3f0) 16:07:59:546 CSyncManager::LeaveLock: Lock released

USERENV(3d8.3f0) 16:07:59:546 CHashTable::HashDelete: S-1-5-20 deleted

USERENV(3d8.3f0) 16:07:59:546 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.3f0) 16:07:59:546 LoadUserProfile: Impersonated user: 00000610, 00000654

USERENV(3d8.3dc) 16:07:59:562 IsSyncForegroundPolicyRefresh: Asynchronous, Reason: NoNeedForSync

USERENV(404.408) 16:07:59:593 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(3d8.650) 16:07:59:640 IsSyncForegroundPolicyRefresh: Asynchronous, Reason: NoNeedForSync

USERENV(6a8.6b4) 16:07:59:828 LibMain: Process Name:  C:\WINDOWS\system32\svchost.exe

USERENV(404.408) 16:07:59:843 LoadUserProfile: Yes, we can impersonate the user. Running as self

USERENV(404.408) 16:07:59:843 =========================================================

USERENV(404.408) 16:07:59:843 LoadUserProfile: Entering, hToken = <0x3b4>, lpProfileInfo = 0x7fca8

USERENV(404.408) 16:07:59:843 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(404.408) 16:07:59:859 LoadUserProfile: lpProfileInfo->lpUserName = <LocalService>

USERENV(404.408) 16:07:59:859 LoadUserProfile: NULL central profile path

USERENV(404.408) 16:07:59:859 LoadUserProfile: NULL default profile path

USERENV(404.408) 16:07:59:859 LoadUserProfile: NULL server name

USERENV(404.408) 16:07:59:859 GetInterface: Returning rpc binding handle

USERENV(3d8.3f0) 16:07:59:859 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.3f0) 16:07:59:859 DropClientContext: Got client token 00000620, sid = S-1-5-18

USERENV(3d8.3f0) 16:07:59:859 MIDL_user_allocate enter

USERENV(3d8.3f0) 16:07:59:875 DropClientContext: load profile object successfully made

USERENV(3d8.3f0) 16:07:59:875 DropClientContext: Returning 0

USERENV(404.408) 16:07:59:875 LoadUserProfile: Calling DropClientToken (as self) succeeded

USERENV(3d8.520) 16:07:59:875 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.520) 16:07:59:875 In LoadUserProfileP

USERENV(3d8.520) 16:07:59:875 LoadUserProfile: Running as client

USERENV(3d8.520) 16:07:59:875 =========================================================

USERENV(3d8.520) 16:07:59:875 LoadUserProfile: Entering, hToken = <0x638>, lpProfileInfo = 0xee8410

USERENV(3d8.520) 16:07:59:875 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(3d8.520) 16:07:59:890 LoadUserProfile: lpProfileInfo->lpUserName = <LocalService>

USERENV(3d8.520) 16:07:59:890 LoadUserProfile: NULL central profile path

USERENV(3d8.520) 16:07:59:890 LoadUserProfile: NULL default profile path

USERENV(3d8.520) 16:07:59:890 LoadUserProfile: NULL server name

USERENV(3d8.520) 16:07:59:890 LoadUserProfile: User sid: S-1-5-19

USERENV(3d8.520) 16:07:59:890 CSyncManager::EnterLock <S-1-5-19>

USERENV(3d8.520) 16:07:59:890 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.520) 16:07:59:890 CSyncManager::EnterLock: New entry created

USERENV(3d8.520) 16:07:59:890 CHashTable::HashAdd: S-1-5-19 added in bucket 12

USERENV(3d8.520) 16:07:59:906 LoadUserProfile: Wait succeeded. In critical section.

USERENV(3d8.520) 16:07:59:906 RestoreUserProfile:  Entering

USERENV(3d8.520) 16:07:59:906 IsCentralProfileReachable:  Entering

USERENV(3d8.520) 16:07:59:906 IsCentralProfileReachable:  Null path.  Leaving

USERENV(3d8.520) 16:07:59:906 RestoreUserProfile:  Profile path = <>

USERENV(3d8.520) 16:07:59:906 ExtractProfileFromBackup:  A profile already exists

USERENV(3d8.520) 16:07:59:906 PatchNewProfileIfRequred: A profile already exists with the current sid, exitting

USERENV(3d8.520) 16:07:59:906 CreateLocalProfileKey:  Not setting additional Security

USERENV(3d8.520) 16:07:59:906 GetExistingLocalProfileImage:  Found entry in profile list for existing local profile

USERENV(3d8.520) 16:07:59:921 GetExistingLocalProfileImage:  Local profile image filename = <%SystemDrive%\Documents and Settings\LocalService>

USERENV(3d8.520) 16:07:59:921 GetExistingLocalProfileImage:  Expanded local profile image filename = <C:\Documents and Settings\LocalService>

USERENV(3d8.520) 16:07:59:921 GetExistingLocalProfileImage:  No local mandatory profile.  Error = 2

USERENV(3d8.520) 16:07:59:921 GetExistingLocalProfileImage:  Found local profile image file ok <C:\Documents and Settings\LocalService\ntuser.dat>

USERENV(3d8.520) 16:07:59:921 GetExistingLocalProfileImage:  Failed to query low profile unload time with error 2

USERENV(3d8.520) 16:07:59:921 Local Existing Profile Image is reachable

USERENV(3d8.520) 16:07:59:921 Local profile name is <C:\Documents and Settings\LocalService>

USERENV(3d8.520) 16:07:59:921 RestoreUserProfile:  No central profile.  Attempting to load local profile.

USERENV(3d8.520) 16:07:59:937 MyRegLoadKey: Returning 00000000

USERENV(3d8.520) 16:07:59:937 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(3d8.520) 16:07:59:937 MyRegLoadKey: Returning 00000000

USERENV(3d8.520) 16:07:59:937 CreateClassHive: existing user classes hive found

USERENV(3d8.520) 16:07:59:937 RestoreUserProfile:  About to Leave.  Final Information follows:

USERENV(3d8.520) 16:07:59:937 Profile was successfully loaded.

USERENV(3d8.520) 16:07:59:953 lpProfile->lpRoamingProfile = <>

USERENV(3d8.520) 16:07:59:953 lpProfile->lpLocalProfile = <C:\Documents and Settings\LocalService>

USERENV(3d8.520) 16:07:59:953 lpProfile->dwInternalFlags = 0x0

USERENV(3d8.520) 16:07:59:953 RestoreUserProfile:  Leaving.

USERENV(3d8.520) 16:07:59:953 UpgradeProfile: Entering

USERENV(3d8.520) 16:07:59:953 UpgradeProfile: Build numbers match

USERENV(3d8.520) 16:07:59:953 UpgradeProfile: Leaving Successfully

USERENV(3d8.520) 16:07:59:953 GetProfileType:  Profile already loaded.

USERENV(3d8.520) 16:07:59:968 LoadProfileInfo:  Failed to query central profile with error 2

USERENV(3d8.520) 16:07:59:968 GetProfileType: ProfileFlags is 0

USERENV(3d8.520) 16:07:59:968 Profile Ref Count is 1

USERENV(3d8.520) 16:07:59:968 LoadUserProfile: Leaving critical Section.

USERENV(3d8.520) 16:07:59:968 CSyncManager::LeaveLock <S-1-5-19>

USERENV(3d8.520) 16:07:59:968 CSyncManager::LeaveLock: Lock released

USERENV(3d8.520) 16:07:59:984 CHashTable::HashDelete: S-1-5-19 deleted

USERENV(3d8.520) 16:07:59:984 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.520) 16:07:59:984 LoadUserProfile: Impersonated user: 00000638, 0000011c

USERENV(410.48c) 16:07:59:984 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(410.48c) 16:08:00:000 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(3d8.520) 16:08:00:015 LoadUserProfile: Reverted to user: 00000000

USERENV(3d8.520) 16:08:00:015 LoadUserProfile: Reverted back to user <00000000>

USERENV(3d8.520) 16:08:00:015 LoadUserProfile: Leaving with a value of 1.

USERENV(3d8.520) 16:08:00:015 =========================================================

USERENV(3d8.520) 16:08:00:015 LoadUserProfileI: returning 0

USERENV(404.408) 16:08:00:015 LoadUserProfile: Running as self

USERENV(404.408) 16:08:00:015 LoadUserProfile: Calling LoadUserProfileI (as user) succeeded

USERENV(404.408) 16:08:00:015 LoadUserProfile:  Returning success.  Final Information follows:

USERENV(404.408) 16:08:00:031 lpProfileInfo->UserName = <LocalService>

USERENV(404.408) 16:08:00:031 lpProfileInfo->lpProfilePath = <>

USERENV(404.408) 16:08:00:031 lpProfileInfo->dwFlags = 0x9

USERENV(3d8.3f0) 16:08:00:031 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.3f0) 16:08:00:031 ReleaseClientContext: Releasing context

USERENV(3d8.3f0) 16:08:00:031 ReleaseClientContext_s: Releasing context

USERENV(3d8.3f0) 16:08:00:031 MIDL_user_free enter

USERENV(404.408) 16:08:00:031 ReleaseInterface: Releasing rpc binding handle

USERENV(404.408) 16:08:00:031 LoadUserProfile: Returning TRUE. hProfile = <0x3b8>

USERENV(404.408) 16:08:00:031 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(704.708) 16:08:00:078 LibMain: Process Name:  C:\WINDOWS\system32\svchost.exe

USERENV(614.67c) 16:08:00:140 ImpersonateUser: Failed to impersonate user with 5.

USERENV(614.67c) 16:08:00:140 GetUserNameAndDomain Failed to impersonate user

USERENV(614.67c) 16:08:00:140 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(6e8.6f4) 16:08:00:203 LibMain: Process Name:  C:\Program Files\Symantec\Symantec Endpoint Protection\SescLU.exe

USERENV(790.794) 16:08:00:500 LibMain: Process Name:  C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

USERENV(d0.d4) 16:08:01:062 LibMain: Process Name:  C:\WINDOWS\system32\spoolsv.exe

USERENV(404.408) 16:08:07:562 LoadUserProfile: Yes, we can impersonate the user. Running as self

USERENV(404.408) 16:08:07:562 =========================================================

USERENV(404.408) 16:08:07:562 LoadUserProfile: Entering, hToken = <0x3f0>, lpProfileInfo = 0x7fca8

USERENV(404.408) 16:08:07:562 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(404.408) 16:08:07:562 LoadUserProfile: lpProfileInfo->lpUserName = <LocalService>

USERENV(404.408) 16:08:07:562 LoadUserProfile: NULL central profile path

USERENV(404.408) 16:08:07:562 LoadUserProfile: NULL default profile path

USERENV(404.408) 16:08:07:578 LoadUserProfile: NULL server name

USERENV(404.408) 16:08:07:578 GetInterface: Returning rpc binding handle

USERENV(3d8.520) 16:08:07:578 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.520) 16:08:07:578 DropClientContext: Got client token 0000079C, sid = S-1-5-18

USERENV(3d8.520) 16:08:07:578 MIDL_user_allocate enter

USERENV(3d8.520) 16:08:07:578 DropClientContext: load profile object successfully made

USERENV(3d8.520) 16:08:07:578 DropClientContext: Returning 0

USERENV(404.408) 16:08:07:578 LoadUserProfile: Calling DropClientToken (as self) succeeded

USERENV(3d8.3f0) 16:08:07:593 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.3f0) 16:08:07:593 In LoadUserProfileP

USERENV(3d8.3f0) 16:08:07:593 LoadUserProfile: Running as client

USERENV(3d8.3f0) 16:08:07:593 =========================================================

USERENV(3d8.3f0) 16:08:07:593 LoadUserProfile: Entering, hToken = <0x788>, lpProfileInfo = 0xee8348

USERENV(3d8.3f0) 16:08:07:593 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(3d8.3f0) 16:08:07:593 LoadUserProfile: lpProfileInfo->lpUserName = <LocalService>

USERENV(3d8.3f0) 16:08:07:593 LoadUserProfile: NULL central profile path

USERENV(3d8.3f0) 16:08:07:593 LoadUserProfile: NULL default profile path

USERENV(3d8.3f0) 16:08:07:609 LoadUserProfile: NULL server name

USERENV(3d8.3f0) 16:08:07:609 LoadUserProfile: User sid: S-1-5-19

USERENV(3d8.3f0) 16:08:07:609 CSyncManager::EnterLock <S-1-5-19>

USERENV(3d8.3f0) 16:08:07:609 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.3f0) 16:08:07:609 CSyncManager::EnterLock: New entry created

USERENV(3d8.3f0) 16:08:07:609 CHashTable::HashAdd: S-1-5-19 added in bucket 12

USERENV(3d8.3f0) 16:08:07:609 LoadUserProfile: Wait succeeded. In critical section.

USERENV(3d8.3f0) 16:08:07:609 TestIfUserProfileLoaded:  Profile already loaded.

USERENV(3d8.3f0) 16:08:07:625 Profile Ref Count is 2

USERENV(3d8.3f0) 16:08:07:625 LoadUserProfile: Leaving critical Section.

USERENV(3d8.3f0) 16:08:07:625 CSyncManager::LeaveLock <S-1-5-19>

USERENV(3d8.3f0) 16:08:07:625 CSyncManager::LeaveLock: Lock released

USERENV(3d8.3f0) 16:08:07:625 CHashTable::HashDelete: S-1-5-19 deleted

USERENV(3d8.3f0) 16:08:07:625 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.3f0) 16:08:07:625 LoadUserProfile: Impersonated user: 00000788, 00000790

USERENV(3d8.3f0) 16:08:07:625 LoadUserProfile: Reverted to user: 00000000

USERENV(3d8.3f0) 16:08:07:625 LoadUserProfile: Reverted back to user <00000000>

USERENV(3d8.3f0) 16:08:07:640 LoadUserProfile: Leaving with a value of 1.

USERENV(3d8.3f0) 16:08:07:640 =========================================================

USERENV(3d8.3f0) 16:08:07:640 LoadUserProfileI: returning 0

USERENV(404.408) 16:08:07:640 LoadUserProfile: Running as self

USERENV(404.408) 16:08:07:640 LoadUserProfile: Calling LoadUserProfileI (as user) succeeded

USERENV(404.408) 16:08:07:640 LoadUserProfile:  Returning success.  Final Information follows:

USERENV(404.408) 16:08:07:640 lpProfileInfo->UserName = <LocalService>

USERENV(404.408) 16:08:07:640 lpProfileInfo->lpProfilePath = <>

USERENV(404.408) 16:08:07:640 lpProfileInfo->dwFlags = 0x9

USERENV(3d8.520) 16:08:07:640 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.520) 16:08:07:656 ReleaseClientContext: Releasing context

USERENV(3d8.520) 16:08:07:656 ReleaseClientContext_s: Releasing context

USERENV(3d8.520) 16:08:07:656 MIDL_user_free enter

USERENV(404.408) 16:08:07:656 ReleaseInterface: Releasing rpc binding handle

USERENV(404.408) 16:08:07:656 LoadUserProfile: Returning TRUE. hProfile = <0x3d4>

USERENV(404.408) 16:08:07:656 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(318.314) 16:08:07:703 LibMain: Process Name:  C:\WINDOWS\system32\svchost.exe

USERENV(5d4.5e0) 16:08:11:046 LibMain: Process Name:  C:\Program Files\LogMeIn\x86\RaMaint.exe

USERENV(5e4.5c4) 16:08:11:046 LibMain: Process Name:  C:\Program Files\Google\Update\GoogleUpdate.exe

USERENV(f4.f8) 16:08:11:140 LibMain: Process Name:  C:\Program Files\LogMeIn\x86\LogMeIn.exe

USERENV(404.408) 16:08:11:531 LoadUserProfile: Yes, we can impersonate the user. Running as self

USERENV(404.408) 16:08:11:531 =========================================================

USERENV(404.408) 16:08:11:531 LoadUserProfile: Entering, hToken = <0x49c>, lpProfileInfo = 0x7fca8

USERENV(404.408) 16:08:11:531 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(404.408) 16:08:11:546 LoadUserProfile: lpProfileInfo->lpUserName = <LocalService>

USERENV(404.408) 16:08:11:546 LoadUserProfile: NULL central profile path

USERENV(404.408) 16:08:11:562 LoadUserProfile: NULL default profile path

USERENV(404.408) 16:08:11:562 LoadUserProfile: NULL server name

USERENV(404.408) 16:08:11:562 GetInterface: Returning rpc binding handle

USERENV(3d8.3f0) 16:08:11:562 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.3f0) 16:08:11:578 DropClientContext: Got client token 00000788, sid = S-1-5-18

USERENV(3d8.3f0) 16:08:11:578 MIDL_user_allocate enter

USERENV(3d8.3f0) 16:08:11:578 DropClientContext: load profile object successfully made

USERENV(3d8.3f0) 16:08:11:578 DropClientContext: Returning 0

USERENV(404.408) 16:08:11:578 LoadUserProfile: Calling DropClientToken (as self) succeeded

USERENV(3d8.520) 16:08:11:609 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.520) 16:08:11:609 In LoadUserProfileP

USERENV(3d8.520) 16:08:11:609 LoadUserProfile: Running as client

USERENV(3d8.520) 16:08:11:609 =========================================================

USERENV(3d8.520) 16:08:11:609 LoadUserProfile: Entering, hToken = <0x784>, lpProfileInfo = 0xee9a18

USERENV(3d8.520) 16:08:11:609 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(3d8.520) 16:08:11:609 LoadUserProfile: lpProfileInfo->lpUserName = <LocalService>

USERENV(3d8.520) 16:08:11:609 LoadUserProfile: NULL central profile path

USERENV(3d8.520) 16:08:11:625 LoadUserProfile: NULL default profile path

USERENV(3d8.520) 16:08:11:625 LoadUserProfile: NULL server name

USERENV(3d8.520) 16:08:11:625 LoadUserProfile: User sid: S-1-5-19

USERENV(3d8.520) 16:08:11:625 CSyncManager::EnterLock <S-1-5-19>

USERENV(3d8.520) 16:08:11:625 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.520) 16:08:11:625 CSyncManager::EnterLock: New entry created

USERENV(3d8.520) 16:08:11:625 CHashTable::HashAdd: S-1-5-19 added in bucket 12

USERENV(3d8.520) 16:08:11:625 LoadUserProfile: Wait succeeded. In critical section.

USERENV(3d8.520) 16:08:11:625 TestIfUserProfileLoaded:  Profile already loaded.

USERENV(3d8.520) 16:08:11:640 Profile Ref Count is 3

USERENV(3d8.520) 16:08:11:640 LoadUserProfile: Leaving critical Section.

USERENV(3d8.520) 16:08:11:640 CSyncManager::LeaveLock <S-1-5-19>

USERENV(3d8.520) 16:08:11:640 CSyncManager::LeaveLock: Lock released

USERENV(3d8.520) 16:08:11:640 CHashTable::HashDelete: S-1-5-19 deleted

USERENV(3d8.520) 16:08:11:640 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.520) 16:08:11:640 LoadUserProfile: Impersonated user: 00000784, 0000078c

USERENV(3d8.520) 16:08:11:640 LoadUserProfile: Reverted to user: 00000000

USERENV(3d8.520) 16:08:11:640 LoadUserProfile: Reverted back to user <00000000>

USERENV(3d8.520) 16:08:11:640 LoadUserProfile: Leaving with a value of 1.

USERENV(3d8.520) 16:08:11:656 =========================================================

USERENV(3d8.520) 16:08:11:656 LoadUserProfileI: returning 0

USERENV(404.408) 16:08:11:656 LoadUserProfile: Running as self

USERENV(404.408) 16:08:11:656 LoadUserProfile: Calling LoadUserProfileI (as user) succeeded

USERENV(404.408) 16:08:11:656 LoadUserProfile:  Returning success.  Final Information follows:

USERENV(404.408) 16:08:11:656 lpProfileInfo->UserName = <LocalService>

USERENV(404.408) 16:08:11:656 lpProfileInfo->lpProfilePath = <>

USERENV(404.408) 16:08:11:656 lpProfileInfo->dwFlags = 0x9

USERENV(3d8.3f0) 16:08:11:671 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.3f0) 16:08:11:671 ReleaseClientContext: Releasing context

USERENV(3d8.3f0) 16:08:11:671 ReleaseClientContext_s: Releasing context

USERENV(3d8.3f0) 16:08:11:671 MIDL_user_free enter

USERENV(404.408) 16:08:11:671 ReleaseInterface: Releasing rpc binding handle

USERENV(404.408) 16:08:11:687 LoadUserProfile: Returning TRUE. hProfile = <0x498>

USERENV(404.408) 16:08:11:687 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(2ec.2b0) 16:08:11:750 LibMain: Process Name:  C:\WINDOWS\System32\svchost.exe

USERENV(404.408) 16:08:11:781 LoadUserProfile: Yes, we can impersonate the user. Running as self

USERENV(404.408) 16:08:11:796 =========================================================

USERENV(404.408) 16:08:11:796 LoadUserProfile: Entering, hToken = <0x4ac>, lpProfileInfo = 0x7fca8

USERENV(404.408) 16:08:11:812 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(404.408) 16:08:11:812 LoadUserProfile: lpProfileInfo->lpUserName = <LocalService>

USERENV(404.408) 16:08:11:812 LoadUserProfile: NULL central profile path

USERENV(404.408) 16:08:11:828 LoadUserProfile: NULL default profile path

USERENV(404.408) 16:08:11:828 LoadUserProfile: NULL server name

USERENV(404.408) 16:08:11:828 GetInterface: Returning rpc binding handle

USERENV(3d8.520) 16:08:11:828 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.520) 16:08:11:828 DropClientContext: Got client token 00000788, sid = S-1-5-18

USERENV(3d8.520) 16:08:11:828 MIDL_user_allocate enter

USERENV(3d8.520) 16:08:11:828 DropClientContext: load profile object successfully made

USERENV(3d8.520) 16:08:11:843 DropClientContext: Returning 0

USERENV(404.408) 16:08:11:843 LoadUserProfile: Calling DropClientToken (as self) succeeded

USERENV(3d8.3f0) 16:08:11:859 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.3f0) 16:08:11:859 In LoadUserProfileP

USERENV(3d8.3f0) 16:08:11:859 LoadUserProfile: Running as client

USERENV(3d8.3f0) 16:08:11:859 =========================================================

USERENV(3d8.3f0) 16:08:11:859 LoadUserProfile: Entering, hToken = <0x784>, lpProfileInfo = 0xee94e0

USERENV(3d8.3f0) 16:08:11:859 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(3d8.3f0) 16:08:11:859 LoadUserProfile: lpProfileInfo->lpUserName = <LocalService>

USERENV(3d8.3f0) 16:08:11:859 LoadUserProfile: NULL central profile path

USERENV(3d8.3f0) 16:08:11:875 LoadUserProfile: NULL default profile path

USERENV(3d8.3f0) 16:08:11:875 LoadUserProfile: NULL server name

USERENV(3d8.3f0) 16:08:11:875 LoadUserProfile: User sid: S-1-5-19

USERENV(3d8.3f0) 16:08:11:875 CSyncManager::EnterLock <S-1-5-19>

USERENV(3d8.3f0) 16:08:11:875 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.3f0) 16:08:11:875 CSyncManager::EnterLock: New entry created

USERENV(3d8.3f0) 16:08:11:875 CHashTable::HashAdd: S-1-5-19 added in bucket 12

USERENV(3d8.3f0) 16:08:11:890 LoadUserProfile: Wait succeeded. In critical section.

USERENV(3d8.3f0) 16:08:11:890 TestIfUserProfileLoaded:  Profile already loaded.

USERENV(3d8.3f0) 16:08:11:890 Profile Ref Count is 4

USERENV(3d8.3f0) 16:08:11:890 LoadUserProfile: Leaving critical Section.

USERENV(3d8.3f0) 16:08:11:890 CSyncManager::LeaveLock <S-1-5-19>

USERENV(3d8.3f0) 16:08:11:890 CSyncManager::LeaveLock: Lock released

USERENV(3d8.3f0) 16:08:11:890 CHashTable::HashDelete: S-1-5-19 deleted

USERENV(3d8.3f0) 16:08:11:906 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.3f0) 16:08:11:906 LoadUserProfile: Impersonated user: 00000784, 0000078c

USERENV(3d8.3f0) 16:08:11:906 LoadUserProfile: Reverted to user: 00000000

USERENV(3d8.3f0) 16:08:11:906 LoadUserProfile: Reverted back to user <00000000>

USERENV(3d8.3f0) 16:08:11:906 LoadUserProfile: Leaving with a value of 1.

USERENV(3d8.3f0) 16:08:11:906 =========================================================

USERENV(3d8.3f0) 16:08:11:906 LoadUserProfileI: returning 0

USERENV(404.408) 16:08:11:906 LoadUserProfile: Running as self

USERENV(404.408) 16:08:11:921 LoadUserProfile: Calling LoadUserProfileI (as user) succeeded

USERENV(404.408) 16:08:11:921 LoadUserProfile:  Returning success.  Final Information follows:

USERENV(404.408) 16:08:11:921 lpProfileInfo->UserName = <LocalService>

USERENV(404.408) 16:08:11:921 lpProfileInfo->lpProfilePath = <>

USERENV(404.408) 16:08:11:921 lpProfileInfo->dwFlags = 0x9

USERENV(3d8.520) 16:08:11:937 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.520) 16:08:11:937 ReleaseClientContext: Releasing context

USERENV(3d8.520) 16:08:11:937 ReleaseClientContext_s: Releasing context

USERENV(3d8.520) 16:08:11:937 MIDL_user_free enter

USERENV(404.408) 16:08:11:937 ReleaseInterface: Releasing rpc binding handle

USERENV(404.408) 16:08:11:937 LoadUserProfile: Returning TRUE. hProfile = <0x4b0>

USERENV(404.408) 16:08:11:937 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(348.1a0) 16:08:12:015 LibMain: Process Name:  C:\WINDOWS\System32\svchost.exe

USERENV(6c0.714) 16:08:12:312 LibMain: Process Name:  C:\WINDOWS\system32\svchost.exe

USERENV(718.684) 16:08:12:578 LibMain: Process Name:  C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

USERENV(624.898) 16:08:12:953 LibMain: Process Name:  C:\Program Files\smartagent\bin\sprtsvc.exe

USERENV(894.89c) 16:08:13:171 LibMain: Process Name:  C:\WINDOWS\system32\wuauclt.exe

USERENV(8a0.8a4) 16:08:13:375 LibMain: Process Name:  C:\WINDOWS\system32\cscript.exe

USERENV(450.6a4) 16:08:13:578 LibMain: Process Name:  C:\Program Files\Dell Support Center\bin\sprtsvc.exe

USERENV(450.6a4) 16:08:13:578 ImpersonateUser: Failed to impersonate user with 5.

USERENV(450.6a4) 16:08:13:578 GetUserNameAndDomain Failed to impersonate user

USERENV(450.6a4) 16:08:13:593 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(450.6a4) 16:08:13:593 ImpersonateUser: Failed to impersonate user with 5.

USERENV(450.6a4) 16:08:13:593 GetUserNameAndDomain Failed to impersonate user

USERENV(450.6a4) 16:08:13:593 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(3d8.650) 16:08:30:984 ApplyGroupPolicy: Entering. Flags = f

USERENV(3d8.650) 16:08:30:984 ProcessGPOs:

USERENV(3d8.650) 16:08:30:984 ProcessGPOs:

USERENV(3d8.650) 16:08:30:984 ProcessGPOs:  Starting computer Group Policy (Async forground) processing...

USERENV(3d8.650) 16:08:30:984 ProcessGPOs:

USERENV(3d8.650) 16:08:30:984 ProcessGPOs:

USERENV(3d8.650) 16:08:30:984 EnterCriticalPolicySectionEx: Entering with timeout 600000 and flags 0x0

USERENV(3d8.650) 16:08:31:000 EnterCriticalPolicySectionEx: Machine critical section has been claimed.  Handle = 0x740

USERENV(3d8.650) 16:08:31:000 EnterCriticalPolicySectionEx: Leaving successfully.

USERENV(3d8.650) 16:08:31:000 ProcessGPOs:  Machine role is 2.

USERENV(3d8.650) 16:08:31:000 PingComputer: PingBufferSize set as 2048

USERENV(3d8.650) 16:08:31:140 PingComputer: Adapter speed 10000000 bps

USERENV(598.b90) 16:08:31:593 GetProfileType:  Profile already loaded.

USERENV(598.b90) 16:08:31:593 LoadProfileInfo:  Failed to query central profile with error 2

USERENV(598.b90) 16:08:31:593 GetProfileType: ProfileFlags is 0

USERENV(3d8.650) 16:08:32:203 PingComputer:  First time:  1070

USERENV(3d8.650) 16:08:32:218 PingComputer:  Second time:  4

USERENV(3d8.650) 16:08:32:218 PingComputer:  Fast link.  Exiting.

USERENV(3d8.650) 16:08:32:218 ProcessGPOs: network name is 206.22.35.128

USERENV(b98.b9c) 16:08:32:593 LibMain: Process Name:  C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

USERENV(404.640) 16:08:32:671 LoadUserProfile: Yes, we can impersonate the user. Running as self

USERENV(404.640) 16:08:32:671 =========================================================

USERENV(404.640) 16:08:32:671 LoadUserProfile: Entering, hToken = <0x40c>, lpProfileInfo = 0xe4f690

USERENV(404.640) 16:08:32:671 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(404.640) 16:08:32:687 LoadUserProfile: lpProfileInfo->lpUserName = <LocalService>

USERENV(404.640) 16:08:32:687 LoadUserProfile: NULL central profile path

USERENV(404.640) 16:08:32:687 LoadUserProfile: NULL default profile path

USERENV(404.640) 16:08:32:687 LoadUserProfile: NULL server name

USERENV(404.640) 16:08:32:687 GetInterface: Returning rpc binding handle

USERENV(3d8.3f0) 16:08:32:687 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.3f0) 16:08:32:687 DropClientContext: Got client token 000007C0, sid = S-1-5-18

USERENV(3d8.3f0) 16:08:32:687 MIDL_user_allocate enter

USERENV(3d8.3f0) 16:08:32:703 DropClientContext: load profile object successfully made

USERENV(3d8.3f0) 16:08:32:703 DropClientContext: Returning 0

USERENV(404.640) 16:08:32:703 LoadUserProfile: Calling DropClientToken (as self) succeeded

USERENV(3d8.520) 16:08:32:703 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.520) 16:08:32:703 In LoadUserProfileP

USERENV(3d8.520) 16:08:32:703 LoadUserProfile: Running as client

USERENV(3d8.520) 16:08:32:703 =========================================================

USERENV(3d8.520) 16:08:32:703 LoadUserProfile: Entering, hToken = <0x78c>, lpProfileInfo = 0xecf358

USERENV(3d8.520) 16:08:32:703 LoadUserProfile: lpProfileInfo->dwFlags = <0x9>

USERENV(3d8.520) 16:08:32:718 LoadUserProfile: lpProfileInfo->lpUserName = <LocalService>

USERENV(3d8.520) 16:08:32:718 LoadUserProfile: NULL central profile path

USERENV(3d8.520) 16:08:32:718 LoadUserProfile: NULL default profile path

USERENV(3d8.520) 16:08:32:718 LoadUserProfile: NULL server name

USERENV(3d8.520) 16:08:32:718 LoadUserProfile: User sid: S-1-5-19

USERENV(3d8.520) 16:08:32:718 CSyncManager::EnterLock <S-1-5-19>

USERENV(3d8.520) 16:08:32:718 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.520) 16:08:32:718 CSyncManager::EnterLock: New entry created

USERENV(3d8.520) 16:08:32:734 CHashTable::HashAdd: S-1-5-19 added in bucket 12

USERENV(3d8.520) 16:08:32:734 LoadUserProfile: Wait succeeded. In critical section.

USERENV(3d8.520) 16:08:32:734 TestIfUserProfileLoaded:  Profile already loaded.

USERENV(3d8.520) 16:08:32:734 Profile Ref Count is 5

USERENV(3d8.520) 16:08:32:734 LoadUserProfile: Leaving critical Section.

USERENV(3d8.520) 16:08:32:734 CSyncManager::LeaveLock <S-1-5-19>

USERENV(3d8.520) 16:08:32:734 CSyncManager::LeaveLock: Lock released

USERENV(3d8.520) 16:08:32:734 CHashTable::HashDelete: S-1-5-19 deleted

USERENV(3d8.520) 16:08:32:734 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.520) 16:08:32:750 LoadUserProfile: Impersonated user: 0000078c, 00000758

USERENV(3d8.520) 16:08:32:750 LoadUserProfile: Reverted to user: 00000000

USERENV(3d8.520) 16:08:32:750 LoadUserProfile: Reverted back to user <00000000>

USERENV(3d8.520) 16:08:32:750 LoadUserProfile: Leaving with a value of 1.

USERENV(3d8.520) 16:08:32:750 =========================================================

USERENV(3d8.520) 16:08:32:750 LoadUserProfileI: returning 0

USERENV(404.640) 16:08:32:750 LoadUserProfile: Running as self

USERENV(404.640) 16:08:32:750 LoadUserProfile: Calling LoadUserProfileI (as user) succeeded

USERENV(404.640) 16:08:32:750 LoadUserProfile:  Returning success.  Final Information follows:

USERENV(404.640) 16:08:32:765 lpProfileInfo->UserName = <LocalService>

USERENV(404.640) 16:08:32:765 lpProfileInfo->lpProfilePath = <>

USERENV(404.640) 16:08:32:765 lpProfileInfo->dwFlags = 0x9

USERENV(3d8.3f0) 16:08:32:765 IProfileSecurityCallBack: client authenticated.

USERENV(3d8.3f0) 16:08:32:765 ReleaseClientContext: Releasing context

USERENV(3d8.3f0) 16:08:32:765 ReleaseClientContext_s: Releasing context

USERENV(3d8.3f0) 16:08:32:765 MIDL_user_free enter

USERENV(404.640) 16:08:32:765 ReleaseInterface: Releasing rpc binding handle

USERENV(404.640) 16:08:32:781 LoadUserProfile: Returning TRUE. hProfile = <0x36c>

USERENV(404.640) 16:08:32:781 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(450.b94) 16:08:32:828 ImpersonateUser: Failed to impersonate user with 5.

USERENV(450.b94) 16:08:32:875 GetUserNameAndDomain Failed to impersonate user

USERENV(450.b94) 16:08:32:921 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(d1c.d24) 16:08:33:015 LibMain: Process Name:  C:\WINDOWS\System32\alg.exe

USERENV(f04.f08) 16:08:34:296 LibMain: Process Name:  C:\WINDOWS\system32\wbem\wmiprvse.exe

USERENV(3d8.650) 16:09:48:466 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.650) 16:09:48:466 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.

USERENV(624.748) 16:09:54:071 LibMain: Process Name:  C:\Program Files\smartagent\bin\sprtsvc.exe

USERENV(624.748) 16:09:54:091 ImpersonateUser: Failed to impersonate user with 5.

USERENV(624.748) 16:09:54:091 GetUserNameAndDomain Failed to impersonate user

USERENV(624.748) 16:09:54:091 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(624.748) 16:09:54:091 ImpersonateUser: Failed to impersonate user with 5.

USERENV(624.748) 16:09:54:110 GetUserNameAndDomain Failed to impersonate user

USERENV(624.748) 16:09:54:110 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(3d8.650) 16:11:09:012 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.650) 16:11:09:012 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.

USERENV(614.c68) 16:11:20:617 ImpersonateUser: Failed to impersonate user with 5.

USERENV(614.c68) 16:11:20:617 GetUserNameAndDomain Failed to impersonate user

USERENV(614.c68) 16:11:20:637 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(614.c6c) 16:11:20:893 ImpersonateUser: Failed to impersonate user with 5.

USERENV(614.c6c) 16:11:20:893 GetUserNameAndDomain Failed to impersonate user

USERENV(614.c6c) 16:11:20:893 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(984.99c) 16:11:21:308 LibMain: Process Name:  C:\Program Files\Symantec\Symantec Endpoint Protection\SescLU.exe

USERENV(3d8.650) 16:12:30:110 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.650) 16:12:30:110 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.

USERENV(688.bdc) 16:13:27:031 LibMain: Process Name:  C:\Program Files\Symantec\Symantec Endpoint Protection\SescLU.exe

USERENV(3d8.650) 16:13:50:932 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.650) 16:13:50:932 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.650) 16:13:50:932 ProcessGPOs: No WMI logging done in this policy cycle.

USERENV(3d8.650) 16:13:50:932 ProcessGPOs: Processing failed with error 1722.

USERENV(3d8.650) 16:13:50:932 LeaveCriticalPolicySection: Critical section 0x740 has been released.

USERENV(3d8.650) 16:13:50:932 ProcessGPOs: Computer Group Policy has been applied.

USERENV(3d8.650) 16:13:50:932 ProcessGPOs: Leaving with 0.

USERENV(3d8.650) 16:13:50:932 ApplyGroupPolicy: Leaving successfully.

USERENV(f4c.f50) 16:13:51:663 LibMain: Process Name:  C:\WINDOWS\system32\userinit.exe

USERENV(8f0.8f4) 16:15:59:792 LibMain: Process Name:  C:\WINDOWS\system32\cscript.exe

USERENV(80c.9c4) 16:16:00:152 LibMain: Process Name:  C:\Program Files\smartagent\bin\tgsrvc.exe

USERENV(9d4.9f0) 16:16:00:323 LibMain: Process Name:  C:\WINDOWS\system32\regsvr32.exe

USERENV(c5c.bf8) 16:16:00:938 LibMain: Process Name:  C:\WINDOWS\system32\cscript.exe

USERENV(c5c.bf8) 16:16:05:523 ImpersonateUser: Failed to impersonate user with 5.

USERENV(c5c.bf8) 16:16:05:523 GetUserNameAndDomain Failed to impersonate user

USERENV(c5c.bf8) 16:16:05:523 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(c5c.bf8) 16:16:05:523 ImpersonateUser: Failed to impersonate user with 5.

USERENV(c5c.bf8) 16:16:05:523 GetUserNameAndDomain Failed to impersonate user

USERENV(c5c.bf8) 16:16:05:540 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(c5c.c64) 16:16:05:796 ImpersonateUser: Failed to impersonate user with 5.

USERENV(c5c.c64) 16:16:05:796 GetUserNameAndDomain Failed to impersonate user

USERENV(c5c.c64) 16:16:05:796 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(3d8.ee0) 16:18:54:796 IsSyncForegroundPolicyRefresh: Synchronous, Reason: FirstPolicyRefresh

USERENV(f50.f4c) 16:18:55:685 LibMain: Process Name:  C:\WINDOWS\system32\mpnotify.exe

USERENV(3d8.3dc) 16:18:55:702 LoadUserProfile: Yes, we can impersonate the user. Running as self

USERENV(3d8.3dc) 16:18:55:702 =========================================================

USERENV(3d8.3dc) 16:18:55:702 LoadUserProfile: Entering, hToken = <0x63c>, lpProfileInfo = 0x6e3e0

USERENV(3d8.3dc) 16:18:55:702 LoadUserProfile: lpProfileInfo->dwFlags = <0x0>

USERENV(3d8.3dc) 16:18:55:702 LoadUserProfile: lpProfileInfo->lpUserName = <mshaff01>

USERENV(3d8.3dc) 16:18:55:702 LoadUserProfile: lpProfileInfo->lpProfilePath = <\\PQSV12159\profiles\mshaff01\>

USERENV(3d8.3dc) 16:18:55:702 LoadUserProfile: lpProfileInfo->lpDefaultPath = <\\PQSV12159\netlogon\Default User>

USERENV(3d8.3dc) 16:18:55:719 LoadUserProfile: NULL server name

USERENV(3d8.3dc) 16:18:55:719 LoadUserProfile: In console winlogon process

USERENV(3d8.3dc) 16:18:55:719 In LoadUserProfileP

USERENV(3d8.3dc) 16:18:55:719 =========================================================

USERENV(3d8.3dc) 16:18:55:719 LoadUserProfile: Entering, hToken = <0x63c>, lpProfileInfo = 0x6e3e0

USERENV(3d8.3dc) 16:18:55:719 LoadUserProfile: lpProfileInfo->dwFlags = <0x0>

USERENV(3d8.3dc) 16:18:55:719 LoadUserProfile: lpProfileInfo->lpUserName = <mshaff01>

USERENV(3d8.3dc) 16:18:55:736 LoadUserProfile: lpProfileInfo->lpProfilePath = <\\PQSV12159\profiles\mshaff01\>

USERENV(3d8.3dc) 16:18:55:736 LoadUserProfile: lpProfileInfo->lpDefaultPath = <\\PQSV12159\netlogon\Default User>

USERENV(3d8.3dc) 16:18:55:736 LoadUserProfile: NULL server name

USERENV(3d8.3dc) 16:18:55:736 LoadUserProfile: User sid: S-1-5-21-473866232-1690843657-1110412475-1122

USERENV(3d8.3dc) 16:18:55:736 CSyncManager::EnterLock <S-1-5-21-473866232-1690843657-1110412475-1122>

USERENV(3d8.3dc) 16:18:55:736 CSyncManager::EnterLock: No existing entry found

USERENV(3d8.3dc) 16:18:55:736 CSyncManager::EnterLock: New entry created

USERENV(3d8.3dc) 16:18:55:754 CHashTable::HashAdd: S-1-5-21-473866232-1690843657-1110412475-1122 added in bucket 5

USERENV(3d8.3dc) 16:18:55:754 LoadUserProfile: Wait succeeded. In critical section.

USERENV(3d8.3dc) 16:18:55:754 LoadUserProfile: Expanded profile path is \\PQSV12159\profiles\mshaff01\

USERENV(3d8.3dc) 16:18:55:754 ParseProfilePath: Entering, lpProfilePath = <\\PQSV12159\profiles\mshaff01\>

USERENV(3d8.3dc) 16:18:55:754 CheckXForestLogon: checking x-forest logon, user handle = 1596

USERENV(3d8.3dc) 16:18:55:754 CheckXForestLogon: not XForest logon.

USERENV(3d8.3dc) 16:18:55:805 AbleToBypassCSC: Try to bypass CSC

USERENV(3d8.3dc) 16:18:55:890 AbleToBypassCSC: tried NPAddConnection3ForCSCAgent. Error 2109

USERENV(3d8.3dc) 16:18:55:890 AbleToBypassCSC: Share \\PQSV12159\profiles mapped to drive E. Returned Path E:\mshaff01\

USERENV(3d8.3dc) 16:18:55:890 ParseProfilePath: CSC bypassed. Profile path E:\mshaff01\

USERENV(3d8.3dc) 16:18:55:890 ParseProfilePath: Tick Count = 0

USERENV(3d8.3dc) 16:18:55:908 PingComputer: PingBufferSize set as 2048

USERENV(3d8.3dc) 16:18:55:908 PingComputer: Adapter speed 10000000 bps

USERENV(3d8.3dc) 16:18:55:993 PingComputer:  First time:  81

USERENV(3d8.3dc) 16:18:56:113 PingComputer:  Second time:  109

USERENV(3d8.3dc) 16:18:56:215 PingComputer:  First time:  81

USERENV(3d8.3dc) 16:18:56:335 PingComputer:  Second time:  109

USERENV(3d8.3dc) 16:18:56:421 PingComputer:  First time:  81

USERENV(3d8.3dc) 16:18:56:540 PingComputer:  Second time:  109

USERENV(3d8.3dc) 16:18:56:540 PingComputer:  Transfer rate:  1142 Kbps  Loop count:  3

USERENV(3d8.3dc) 16:18:56:558 ParseProfilePath: GetFileAttributes found something with attributes <0x10>

USERENV(3d8.3dc) 16:18:56:558 ParseProfilePath: Found a directory

USERENV(3d8.3dc) 16:18:56:558 LoadUserProfile: ParseProfilePath returned a directory of <E:\mshaff01\>

USERENV(3d8.3dc) 16:18:56:558 RestoreUserProfile:  Entering

USERENV(3d8.3dc) 16:18:56:558 RestoreUserProfile:  User is a Admin

USERENV(3d8.3dc) 16:18:56:558 IsCentralProfileReachable:  Entering

USERENV(3d8.3dc) 16:18:56:558 CheckRoamingShareOwnership: checking ownership for E:\mshaff01\

USERENV(3d8.3dc) 16:18:56:592 CheckRoamingShareOwnership: owner is admin

USERENV(3d8.3dc) 16:18:56:592 IsCentralProfileReachable:  Testing <E:\mshaff01\ntuser.man>

USERENV(3d8.3dc) 16:18:56:592 IsCentralProfileReachable:  Profile is not reachable, error = 2

USERENV(3d8.3dc) 16:18:56:592 IsCentralProfileReachable:  Testing <E:\mshaff01\ntuser.dat>

USERENV(3d8.3dc) 16:18:56:694 IsCentralProfileReachable:  Found a user profile.

USERENV(3d8.3dc) 16:18:56:694 RestoreUserProfile:  Central Profile is reachable

USERENV(3d8.3dc) 16:18:56:694 RestoreUserProfile:  Central Profile is roaming

USERENV(3d8.3dc) 16:18:56:694 RestoreUserProfile:  Profile path = <E:\mshaff01\>

USERENV(3d8.3dc) 16:18:56:694 ExtractProfileFromBackup:  A profile already exists

USERENV(3d8.3dc) 16:18:56:694 PatchNewProfileIfRequred: A profile already exists with the current sid, exitting

USERENV(3d8.3dc) 16:18:56:711 CreateLocalProfileKey:  Not setting additional Security

USERENV(3d8.3dc) 16:18:56:711 GetExistingLocalProfileImage:  Found entry in profile list for existing local profile

USERENV(3d8.3dc) 16:18:56:711 GetExistingLocalProfileImage:  Local profile image filename = <%SystemDrive%\Documents and Settings\mshaff01>

USERENV(3d8.3dc) 16:18:56:711 GetExistingLocalProfileImage:  Expanded local profile image filename = <C:\Documents and Settings\mshaff01>

USERENV(3d8.3dc) 16:18:56:729 GetExistingLocalProfileImage:  No local mandatory profile.  Error = 2

USERENV(3d8.3dc) 16:18:56:729 GetExistingLocalProfileImage:  Found local profile image file ok <C:\Documents and Settings\mshaff01\ntuser.dat>

USERENV(3d8.3dc) 16:18:56:729 Local Existing Profile Image is reachable

USERENV(3d8.3dc) 16:18:56:746 Local profile name is <C:\Documents and Settings\mshaff01>

USERENV(3d8.3dc) 16:18:56:746 RestoreUserProfile:  Reconciling roaming profile with local profile

USERENV(3d8.3dc) 16:18:56:814 GetExclusionList: The exclusion on both server and client are same: <Local Settings;Temporary Internet Files;History;Temp;Desktop; My Documents; Application Data; Start Menu; Net Hood; Temp; Temporary Internet Files; local settings\temp\; local settings\temporary internet files>

USERENV(3d8.3dc) 16:18:56:814 CopyProfileDirectoryEx: Entering, lpSourceDir = <E:\mshaff01\>, lpDestinationDir = <C:\Documents and Settings\mshaff01>, dwFlags = 0x4c20

USERENV(3d8.3dc) 16:18:56:831 CopyProfileDirectoryEx: lpExclusionList = <Local Settings;Temporary Internet Files;History;Temp;Desktop; My Documents; Application Data; Start Menu; Net Hood; Temp; Temporary Internet Files; local settings\temp\; local settings\temporary internet files>

USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\Local Settings to ExclusionList

USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\Temporary Internet Files to ExclusionList

USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\History to ExclusionList

USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\Temp to ExclusionList

USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\Desktop to ExclusionList

USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\My Documents to ExclusionList

USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\Application Data to ExclusionList

USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\Start Menu to ExclusionList

USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\Net Hood to ExclusionList

USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\Temp to ExclusionList

USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\Temporary Internet Files to ExclusionList

USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\local settings\temp\ to ExclusionList

USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\local settings\temporary internet files to ExclusionList

USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Local Settings to ExclusionList

USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Temporary Internet Files to ExclusionList

USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\History to ExclusionList

USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Temp to ExclusionList

USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Desktop to ExclusionList

USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\My Documents to ExclusionList

USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Application Data to ExclusionList

USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Start Menu to ExclusionList

USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Net Hood to ExclusionList

USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Temp to ExclusionList

USERENV(3d8.3dc) 16:18:56:883 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Temporary Internet Files to ExclusionList

USERENV(3d8.3dc) 16:18:56:883 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\local settings\temp\ to ExclusionList

USERENV(3d8.3dc) 16:18:56:883 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\local settings\temporary internet files to ExclusionList

USERENV(3d8.3dc) 16:18:56:968 RecurseDirectory: Adding E:\mshaff01\.wizards\images\tools\adwizard-promo\images\adwizard-promo\ to the list of directories

USERENV(3d8.3dc) 16:18:56:968 RecurseDirectory: Adding E:\mshaff01\.wizards\images\tools\adwizard-promo\images\ to the list of directories

USERENV(3d8.3dc) 16:18:56:985 RecurseDirectory: Adding E:\mshaff01\.wizards\images\tools\adwizard-promo\ to the list of directories

USERENV(3d8.3dc) 16:18:56:985 RecurseDirectory: Adding E:\mshaff01\.wizards\images\tools\ to the list of directories

USERENV(3d8.3dc) 16:18:56:985 RecurseDirectory: Adding E:\mshaff01\.wizards\images\ to the list of directories

USERENV(3d8.3dc) 16:18:56:985 RecurseDirectory: Adding E:\mshaff01\.wizards\ to the list of directories

USERENV(3d8.3dc) 16:18:57:002 RecurseDirectory: Adding E:\mshaff01\.wizards99-1\ to the list of directories

USERENV(3d8.3dc) 16:18:57:054 RecurseDirectory: Adding E:\mshaff01\Cookies\ to the list of directories

USERENV(3d8.3dc) 16:18:57:088 RecurseDirectory: Adding E:\mshaff01\Favorites\Cobalt Group\Cobalt Websites\ to the list of directories

USERENV(3d8.3dc) 16:18:57:088 RecurseDirectory: Adding E:\mshaff01\Favorites\Cobalt Group\ to the list of directories

USERENV(3d8.3dc) 16:18:57:105 RecurseDirectory: Adding E:\mshaff01\Favorites\Dell\ to the list of directories

USERENV(3d8.3dc) 16:18:57:122 RecurseDirectory: Adding E:\mshaff01\Favorites\Files\ to the list of directories

USERENV(3d8.3dc) 16:18:57:139 RecurseDirectory: Adding E:\mshaff01\Favorites\Financial\ to the list of directories

USERENV(3d8.3dc) 16:18:57:139 RecurseDirectory: Adding E:\mshaff01\Favorites\From ICQ\ to the list of directories

USERENV(3d8.3dc) 16:18:57:156 RecurseDirectory: Adding E:\mshaff01\Favorites\FTC - Privacy\ to the list of directories

USERENV(3d8.3dc) 16:18:57:173 RecurseDirectory: Adding E:\mshaff01\Favorites\General Motors\ to the list of directories

USERENV(3d8.3dc) 16:18:57:190 RecurseDirectory: Adding E:\mshaff01\Favorites\Info Tech\ to the list of directories

USERENV(3d8.3dc) 16:18:57:208 RecurseDirectory: Adding E:\mshaff01\Favorites\Links\ to the list of directories

USERENV(3d8.3dc) 16:18:57:225 RecurseDirectory: Adding E:\mshaff01\Favorites\Microsoft Websites\ to the list of directories

USERENV(3d8.3dc) 16:18:57:225 RecurseDirectory: Adding E:\mshaff01\Favorites\Misc\ to the list of directories

USERENV(3d8.3dc) 16:18:57:242 RecurseDirectory: Adding E:\mshaff01\Favorites\Shopping\ to the list of directories

USERENV(3d8.3dc) 16:18:57:259 RecurseDirectory: Adding E:\mshaff01\Favorites\Systems\ to the list of directories

USERENV(3d8.3dc) 16:18:57:276 RecurseDirectory: Adding E:\mshaff01\Favorites\Thermal Paper\ to the list of directories

USERENV(3d8.3dc) 16:18:57:276 RecurseDirectory: Adding E:\mshaff01\Favorites\ to the list of directories

USERENV(3d8.3dc) 16:18:57:293 RecurseDirectory: Adding E:\mshaff01\IECompatCache\ to the list of directories

USERENV(3d8.3dc) 16:18:57:310 RecurseDirectory: Adding E:\mshaff01\IETldCache\ to the list of directories

USERENV(3d8.3dc) 16:18:57:327 RecurseDirectory: Adding E:\mshaff01\Links\ to the list of directories

USERENV(3d8.3dc) 16:18:57:361 RecurseDirectory: Adding E:\mshaff01\NetHood\AIntg-Bkrst on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:57:379 RecurseDirectory: Adding E:\mshaff01\NetHood\AIntg-CF on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:57:396 RecurseDirectory: Adding E:\mshaff01\NetHood\body_shop_mi on LinkStation (net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:396 RecurseDirectory: Adding E:\mshaff01\NetHood\body_shop_mi on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:413 RecurseDirectory: Adding E:\mshaff01\NetHood\body_shop_mi on Network Attached Storage Device (net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:430 RecurseDirectory: Adding E:\mshaff01\NetHood\c on Edna\ to the list of directories

USERENV(3d8.3dc) 16:18:57:447 RecurseDirectory: Adding E:\mshaff01\NetHood\c on Jeff\ to the list of directories

USERENV(3d8.3dc) 16:18:57:447 RecurseDirectory: Adding E:\mshaff01\NetHood\c on Matt\ to the list of directories

USERENV(3d8.3dc) 16:18:57:464 RecurseDirectory: Adding E:\mshaff01\NetHood\delivery_log on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:481 RecurseDirectory: Adding E:\mshaff01\NetHood\dnc_files on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:498 RecurseDirectory: Adding E:\mshaff01\NetHood\dnc_files on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:515 RecurseDirectory: Adding E:\mshaff01\NetHood\emul-flexlm on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:57:533 RecurseDirectory: Adding E:\mshaff01\NetHood\exec_share on LinkStation (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:550 RecurseDirectory: Adding E:\mshaff01\NetHood\exec_share on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:567 RecurseDirectory: Adding E:\mshaff01\NetHood\exec_share on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:567 RecurseDirectory: Adding E:\mshaff01\NetHood\E_emul on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:57:584 RecurseDirectory: Adding E:\mshaff01\NetHood\finance_logs on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:601 RecurseDirectory: Adding E:\mshaff01\NetHood\F_emul on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:57:618 RecurseDirectory: Adding E:\mshaff01\NetHood\GMDU-Bkrst on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:57:635 RecurseDirectory: Adding E:\mshaff01\NetHood\gmdu-cf on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:57:635 RecurseDirectory: Adding E:\mshaff01\NetHood\GMDU-flexlm on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:57:652 RecurseDirectory: Adding E:\mshaff01\NetHood\GMDU-Intg on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:57:669 RecurseDirectory: Adding E:\mshaff01\NetHood\GMDU-View on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:57:686 RecurseDirectory: Adding E:\mshaff01\NetHood\Internet on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:686 RecurseDirectory: Adding E:\mshaff01\NetHood\jjohns46 on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:704 RecurseDirectory: Adding E:\mshaff01\NetHood\jruckm01 on Jeffr\ to the list of directories

USERENV(3d8.3dc) 16:18:57:721 RecurseDirectory: Adding E:\mshaff01\NetHood\kbiddl01 on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:738 RecurseDirectory: Adding E:\mshaff01\NetHood\matt816.workspace.office.live.com\ to the list of directories

USERENV(3d8.3dc) 16:18:57:738 RecurseDirectory: Adding E:\mshaff01\NetHood\mid_cash on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:755 RecurseDirectory: Adding E:\mshaff01\NetHood\mid_finance on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:772 RecurseDirectory: Adding E:\mshaff01\NetHood\mid_mis_part on LinkStation (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:789 RecurseDirectory: Adding E:\mshaff01\NetHood\MID_MIS_Part on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:789 RecurseDirectory: Adding E:\mshaff01\NetHood\mid_mis_part on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:823 RecurseDirectory: Adding E:\mshaff01\NetHood\mid_mis_serv on LinkStation (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:823 RecurseDirectory: Adding E:\mshaff01\NetHood\MID_MIS_Serv on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:858 RecurseDirectory: Adding E:\mshaff01\NetHood\mid_mis_serv on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:858 RecurseDirectory: Adding E:\mshaff01\NetHood\mshaff01 on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:875 RecurseDirectory: Adding E:\mshaff01\NetHood\mshaffner.workspace.office.live.com\ to the list of directories

USERENV(3d8.3dc) 16:18:57:892 RecurseDirectory: Adding E:\mshaff01\NetHood\My Web Sites on MSN\ to the list of directories

USERENV(3d8.3dc) 16:18:57:909 RecurseDirectory: Adding E:\mshaff01\NetHood\office_share on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:926 RecurseDirectory: Adding E:\mshaff01\NetHood\office_share on Network Attached Storage Device (net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:926 RecurseDirectory: Adding E:\mshaff01\NetHood\office_staff on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:943 RecurseDirectory: Adding E:\mshaff01\NetHood\office_staff on Network Attached Storage Device (net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:960 RecurseDirectory: Adding E:\mshaff01\NetHood\palm on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:57:977 RecurseDirectory: Adding E:\mshaff01\NetHood\parts_mis on LinkStation (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:977 RecurseDirectory: Adding E:\mshaff01\NetHood\parts_mis on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:57:994 RecurseDirectory: Adding E:\mshaff01\NetHood\parts_mis on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:58:011 RecurseDirectory: Adding E:\mshaff01\NetHood\profiles on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:58:029 RecurseDirectory: Adding E:\mshaff01\NetHood\public_forms on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:58:046 RecurseDirectory: Adding E:\mshaff01\NetHood\scanned_docs on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:58:046 RecurseDirectory: Adding E:\mshaff01\NetHood\secure_share on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:58:063 RecurseDirectory: Adding E:\mshaff01\NetHood\service_mis on LinkStation (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:58:080 RecurseDirectory: Adding E:\mshaff01\NetHood\service_mis on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:58:097 RecurseDirectory: Adding E:\mshaff01\NetHood\service_mis on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:58:097 RecurseDirectory: Adding E:\mshaff01\NetHood\SharedDocs on Matt\ to the list of directories

USERENV(3d8.3dc) 16:18:58:114 RecurseDirectory: Adding E:\mshaff01\NetHood\sharon on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:58:131 RecurseDirectory: Adding E:\mshaff01\NetHood\sys_tools on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:58:148 RecurseDirectory: Adding E:\mshaff01\NetHood\usbdisk2 on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:58:148 RecurseDirectory: Adding E:\mshaff01\NetHood\Users on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:58:165 RecurseDirectory: Adding E:\mshaff01\NetHood\ to the list of directories

USERENV(3d8.3dc) 16:18:58:165 RecurseDirectory: Adding E:\mshaff01\PrintHood\ to the list of directories

USERENV(3d8.3dc) 16:18:58:183 RecurseDirectory: Adding E:\mshaff01\PrivacIE\ to the list of directories

USERENV(3d8.3dc) 16:18:58:200 RecurseDirectory: Adding E:\mshaff01\QuickLaunch\ to the list of directories

USERENV(3d8.3dc) 16:18:58:234 RecurseDirectory: Adding E:\mshaff01\Recent\ to the list of directories

USERENV(3d8.3dc) 16:18:58:251 RecurseDirectory: Adding E:\mshaff01\SendTo\ to the list of directories

USERENV(3d8.3dc) 16:18:58:268 RecurseDirectory: Adding E:\mshaff01\Templates\ to the list of directories

USERENV(3d8.3dc) 16:18:58:302 RecurseDirectory: Adding E:\mshaff01\Tracing\WPPMedia\ to the list of directories

USERENV(3d8.3dc) 16:18:58:302 RecurseDirectory: Adding E:\mshaff01\Tracing\ to the list of directories

USERENV(3d8.3dc) 16:18:58:319 RecurseDirectory: Adding E:\mshaff01\UserData\029V6JRP\ to the list of directories

USERENV(3d8.3dc) 16:18:58:336 RecurseDirectory: Adding E:\mshaff01\UserData\E50X50XC\ to the list of directories

USERENV(3d8.3dc) 16:18:58:354 RecurseDirectory: Adding E:\mshaff01\UserData\JOESFCC3\ to the list of directories

USERENV(3d8.3dc) 16:18:58:354 RecurseDirectory: Adding E:\mshaff01\UserData\TOG2B5M1\ to the list of directories

USERENV(3d8.3dc) 16:18:58:371 RecurseDirectory: Adding E:\mshaff01\UserData\ to the list of directories

USERENV(3d8.3dc) 16:18:58:559 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\.wizards\images\tools\adwizard-promo\images\adwizard-promo\ to the list of directories

USERENV(3d8.3dc) 16:18:58:559 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\.wizards\images\tools\adwizard-promo\images\ to the list of directories

USERENV(3d8.3dc) 16:18:58:559 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\.wizards\images\tools\adwizard-promo\ to the list of directories

USERENV(3d8.3dc) 16:18:58:559 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\.wizards\images\tools\ to the list of directories

USERENV(3d8.3dc) 16:18:58:559 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\.wizards\images\ to the list of directories

USERENV(3d8.3dc) 16:18:58:559 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\.wizards\ to the list of directories

USERENV(3d8.3dc) 16:18:58:559 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\.wizards99-1\ to the list of directories

USERENV(3d8.3dc) 16:18:58:559 RecurseDirectory: Skipping <C:\Documents and Settings\mshaff01\Application Data> due to exclusion list.

USERENV(3d8.3dc) 16:18:58:781 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Cookies\ to the list of directories

USERENV(3d8.3dc) 16:18:58:781 RecurseDirectory: Skipping <C:\Documents and Settings\mshaff01\Desktop> due to exclusion list.

USERENV(3d8.3dc) 16:18:58:833 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Cobalt Group\Cobalt Websites\ to the list of directories

USERENV(3d8.3dc) 16:18:58:850 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Cobalt Group\ to the list of directories

USERENV(3d8.3dc) 16:18:58:850 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Dell\ to the list of directories

USERENV(3d8.3dc) 16:18:58:867 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Files\ to the list of directories

USERENV(3d8.3dc) 16:18:58:867 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Financial\ to the list of directories

USERENV(3d8.3dc) 16:18:58:867 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\From ICQ\ to the list of directories

USERENV(3d8.3dc) 16:18:58:884 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\FTC - Privacy\ to the list of directories

USERENV(3d8.3dc) 16:18:58:901 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\General Motors\ to the list of directories

USERENV(3d8.3dc) 16:18:58:918 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Info Tech\ to the list of directories

USERENV(3d8.3dc) 16:18:58:918 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Links\ to the list of directories

USERENV(3d8.3dc) 16:18:58:935 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Microsoft Websites\ to the list of directories

USERENV(3d8.3dc) 16:18:58:952 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Misc\ to the list of directories

USERENV(3d8.3dc) 16:18:58:969 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Shopping\ to the list of directories

USERENV(3d8.3dc) 16:18:58:969 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Systems\ to the list of directories

USERENV(3d8.3dc) 16:18:58:986 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\Thermal Paper\ to the list of directories

USERENV(3d8.3dc) 16:18:58:986 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Favorites\ to the list of directories

USERENV(3d8.3dc) 16:18:58:986 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\IECompatCache\ to the list of directories

USERENV(3d8.3dc) 16:18:58:986 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\IETldCache\ to the list of directories

USERENV(3d8.3dc) 16:18:58:986 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Links\ to the list of directories

USERENV(3d8.3dc) 16:18:58:986 RecurseDirectory: Skipping <C:\Documents and Settings\mshaff01\Local Settings> due to exclusion list.

USERENV(3d8.3dc) 16:18:59:021 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\AIntg-Bkrst on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:021 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\AIntg-CF on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:038 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\body_shop_mi on LinkStation (net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:038 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\body_shop_mi on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:038 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\body_shop_mi on Network Attached Storage Device (net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:038 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\c on Edna\ to the list of directories

USERENV(3d8.3dc) 16:18:59:038 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\c on Jeff\ to the list of directories

USERENV(3d8.3dc) 16:18:59:038 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\c on Matt\ to the list of directories

USERENV(3d8.3dc) 16:18:59:038 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\delivery_log on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:055 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\dnc_files on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:055 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\dnc_files on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:055 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\emul-flexlm on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:055 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\exec_share on LinkStation (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:055 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\exec_share on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:055 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\exec_share on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:055 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\E_emul on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:072 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\finance_logs on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:072 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\F_emul on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:072 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\GMDU-Bkrst on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:072 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\gmdu-cf on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:072 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\GMDU-flexlm on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:072 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\GMDU-Intg on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:072 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\GMDU-View on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:106 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\Internet on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:106 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\jjohns46 on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:106 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\jruckm01 on Jeffr\ to the list of directories

USERENV(3d8.3dc) 16:18:59:106 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\kbiddl01 on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:106 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\matt816.workspace.office.live.com\ to the list of directories

USERENV(3d8.3dc) 16:18:59:106 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\mid_cash on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:106 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\mid_finance on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:123 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\mid_mis_part on LinkStation (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:123 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\MID_MIS_Part on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:123 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\mid_mis_part on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:123 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\mid_mis_serv on LinkStation (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:123 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\MID_MIS_Serv on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:123 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\mid_mis_serv on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:123 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\mshaff01 on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:140 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\mshaffner.workspace.office.live.com\ to the list of directories

USERENV(3d8.3dc) 16:18:59:140 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\My Web Sites on MSN\ to the list of directories

USERENV(3d8.3dc) 16:18:59:140 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\office_share on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:140 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\office_share on Network Attached Storage Device (net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:140 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\office_staff on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:140 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\office_staff on Network Attached Storage Device (net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:158 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\palm on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:158 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\parts_mis on LinkStation (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:158 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\parts_mis on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:158 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\parts_mis on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:158 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\profiles on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:158 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\public_forms on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:158 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\scanned_docs on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:175 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\secure_share on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:175 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\service_mis on LinkStation (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:175 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\service_mis on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:175 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\service_mis on Network Attached Storage Device (Net_drive)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:175 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\SharedDocs on Matt\ to the list of directories

USERENV(3d8.3dc) 16:18:59:175 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\sharon on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:175 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\sys_tools on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:192 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\usbdisk2 on Network Attached Storage Device (206.22.35.216)\ to the list of directories

USERENV(3d8.3dc) 16:18:59:192 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\Users on Pqsv12159\ to the list of directories

USERENV(3d8.3dc) 16:18:59:192 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\NetHood\ to the list of directories

USERENV(3d8.3dc) 16:18:59:192 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\PrintHood\ to the list of directories

USERENV(3d8.3dc) 16:18:59:192 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\PrivacIE\ to the list of directories

USERENV(3d8.3dc) 16:18:59:226 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\QuickLaunch\ to the list of directories

USERENV(3d8.3dc) 16:18:59:448 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Recent\ to the list of directories

USERENV(3d8.3dc) 16:18:59:465 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\SendTo\ to the list of directories

USERENV(3d8.3dc) 16:18:59:465 RecurseDirectory: Skipping <C:\Documents and Settings\mshaff01\Start Menu> due to exclusion list.

USERENV(3d8.3dc) 16:18:59:483 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Templates\ to the list of directories

USERENV(3d8.3dc) 16:18:59:483 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Tracing\WPPMedia\ to the list of directories

USERENV(3d8.3dc) 16:18:59:483 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\Tracing\ to the list of directories

USERENV(3d8.3dc) 16:18:59:500 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\UserData\029V6JRP\ to the list of directories

USERENV(3d8.3dc) 16:18:59:500 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\UserData\E50X50XC\ to the list of directories

USERENV(3d8.3dc) 16:18:59:500 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\UserData\JOESFCC3\ to the list of directories

USERENV(3d8.3dc) 16:18:59:517 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\UserData\TOG2B5M1\ to the list of directories

USERENV(3d8.3dc) 16:18:59:517 RecurseDirectory: Adding C:\Documents and Settings\mshaff01\UserData\ to the list of directories

USERENV(3d8.3dc) 16:18:59:517 FindTotalDiskSpaceNeeded: Largest 7 file size is 6178712

USERENV(3d8.3dc) 16:18:59:517 Available		624701440

USERENV(3d8.3dc) 16:18:59:517 Needed		14995193

USERENV(3d8.3dc) 16:18:59:517 Src size		20200933

USERENV(3d8.3dc) 16:18:59:517 Dest size		20200427

USERENV(3d8.3dc) 16:18:59:517 Largest hive file		13631488

USERENV(3d8.3dc) 16:18:59:585 CopyProfileDirectoryEx: Found hive file ntuser.dat

USERENV(3d8.3dc) 16:19:15:681 ReconcileFile: E:\mshaff01\ntuser.dat ==> C:\Documents and Settings\mshaff01\ntuser.dat  [OK]

USERENV(3d8.3dc) 16:19:15:681 CopyProfileDirectoryEx: Found hive file ntuser.dat.LOG

USERENV(3d8.3dc) 16:19:15:784 ReconcileFile: E:\mshaff01\ntuser.dat.LOG ==> C:\Documents and Settings\mshaff01\ntuser.dat.LOG  [OK]

USERENV(3d8.3dc) 16:19:15:784 CopyProfileDirectoryEx: Found hive file ntuser.ini

USERENV(3d8.3dc) 16:19:15:904 ReconcileFile: E:\mshaff01\ntuser.ini ==> C:\Documents and Settings\mshaff01\ntuser.ini  [OK]

USERENV(3d8.3dc) 16:19:15:904 CopyProfileDirectoryEx: Found hive file ntuser.pol

USERENV(3d8.3dc) 16:19:15:955 ReconcileFile: Unable to open temporary file

USERENV(3d8.3dc) 16:19:15:955 ReconcileFile: E:\mshaff01\ntuser.pol ==> C:\Documents and Settings\mshaff01\ntuser.pol  [OK]

USERENV(3d8.3dc) 16:19:15:955 CopyProfileDirectoryEx: Calling ReconcileDirectory for all Directories

USERENV(3d8.3dc) 16:19:17:682 CopyProfileDirectoryEx: Reconcile Directory Done for all Directories

USERENV(3d8.dac) 16:19:17:854 ReconcileFile: E:\mshaff01\Recent\Startup (2).lnk ==> C:\Documents and Settings\mshaff01\Recent\Startup (2).lnk  [OK]

USERENV(3d8.9b8) 16:19:17:871 ReconcileFile: E:\mshaff01\Recent\Dec 8 2010 Test Text File on Desktop.txt.lnk ==> C:\Documents and Settings\mshaff01\Recent\Dec 8 2010 Test Text File on Desktop.txt.lnk  [OK]

USERENV(3d8.d70) 16:19:17:905 ReconcileFile: E:\mshaff01\Recent\desktop.ini (2).lnk ==> C:\Documents and Settings\mshaff01\Recent\desktop.ini (2).lnk  [OK]

USERENV(3d8.9bc) 16:19:17:973 ReconcileFile: E:\mshaff01\NetHood\Users on Pqsv12159\Desktop.ini ==> C:\Documents and Settings\mshaff01\NetHood\Users on Pqsv12159\Desktop.ini  [OK]

USERENV(3d8.c04) 16:19:18:332 ReconcileFile: E:\mshaff01\IETldCache\index.dat ==> C:\Documents and Settings\mshaff01\IETldCache\index.dat  [OK]

USERENV(3d8.9bc) 16:19:18:452 ReconcileFile: E:\mshaff01\Cookies\index.dat ==> C:\Documents and Settings\mshaff01\Cookies\index.dat  [OK]

USERENV(3d8.3dc) 16:19:18:452 CopyProfileDirectoryEx: Setting Directory TimeStamps all Directories

USERENV(3d8.3dc) 16:19:18:486 CopyProfileDirectoryEx: Set times on all directories

USERENV(3d8.3dc) 16:19:18:486 CopyProfileDirectoryEx: Leaving with a return value of 1

USERENV(3d8.3dc) 16:19:18:623 MyRegLoadKey: Returning 00000000

USERENV(3d8.3dc) 16:19:18:657 MyRegLoadKey: Returning 00000000

USERENV(3d8.3dc) 16:19:18:657 CreateClassHive: existing user classes hive found

USERENV(3d8.3dc) 16:19:18:657 RestoreUserProfile:  About to Leave.  Final Information follows:

USERENV(3d8.3dc) 16:19:18:657 Profile was successfully loaded.

USERENV(3d8.3dc) 16:19:18:657 lpProfile->lpRoamingProfile = <E:\mshaff01\>

USERENV(3d8.3dc) 16:19:18:657 lpProfile->lpLocalProfile = <C:\Documents and Settings\mshaff01>

USERENV(3d8.3dc) 16:19:18:657 lpProfile->dwInternalFlags = 0x110

USERENV(3d8.3dc) 16:19:18:675 RestoreUserProfile:  Leaving.

USERENV(3d8.3dc) 16:19:18:675 UpgradeProfile: Entering

USERENV(3d8.3dc) 16:19:18:675 UpgradeProfile: Build numbers match

USERENV(3d8.3dc) 16:19:18:675 UpgradeProfile: Leaving Successfully

USERENV(3d8.3dc) 16:19:18:675 GetProfileType:  Profile already loaded.

USERENV(3d8.3dc) 16:19:18:675 LoadProfileInfo:  Failed to query central profile with error 2

USERENV(3d8.3dc) 16:19:18:675 GetProfileType: ProfileFlags is 0

USERENV(3d8.3dc) 16:19:18:692 Profile Ref Count is 1

USERENV(3d8.3dc) 16:19:18:692 LoadUserProfile: Leaving critical Section.

USERENV(3d8.3dc) 16:19:18:692 CSyncManager::LeaveLock <S-1-5-21-473866232-1690843657-1110412475-1122>

USERENV(3d8.3dc) 16:19:18:692 CSyncManager::LeaveLock: Lock released

USERENV(3d8.3dc) 16:19:18:692 CHashTable::HashDelete: S-1-5-21-473866232-1690843657-1110412475-1122 deleted

USERENV(3d8.3dc) 16:19:18:692 CSyncManager::LeaveLock: Lock deleted

USERENV(3d8.3dc) 16:19:18:709 LoadUserProfile: Impersonated user: 0000063c, 00000000

USERENV(3d8.3dc) 16:19:18:982 LoadUserProfile: Reverted to user: 00000000

USERENV(3d8.3dc) 16:19:18:982 CancelCSCBypassedConnection: Cancelling connection of E:

USERENV(3d8.3dc) 16:19:19:000 CancelCSCBypassedConnection: Connection deleted.

USERENV(3d8.3dc) 16:19:19:000 LoadUserProfile: Leaving with a value of 1.

USERENV(3d8.3dc) 16:19:19:000 =========================================================

USERENV(3d8.3dc) 16:19:19:000 LoadUserProfile: LoadUserProfileP succeeded

USERENV(3d8.3dc) 16:19:19:017 LoadUserProfile:  Returning success.  Final Information follows:

USERENV(3d8.3dc) 16:19:19:017 lpProfileInfo->UserName = <mshaff01>

USERENV(3d8.3dc) 16:19:19:017 lpProfileInfo->lpProfilePath = <\\PQSV12159\profiles\mshaff01\>

USERENV(3d8.3dc) 16:19:19:017 lpProfileInfo->dwFlags = 0x0

USERENV(3d8.3dc) 16:19:19:017 LoadUserProfile: Returning TRUE. hProfile = <0x6f4>

USERENV(3d8.3dc) 16:19:19:068 IsSyncForegroundPolicyRefresh: Synchronous, Reason: FirstPolicyRefresh

USERENV(3d8.df4) 16:19:19:068 IsSyncForegroundPolicyRefresh: Synchronous, Reason: FirstPolicyRefresh

USERENV(3d8.df4) 16:19:19:119 ApplyGroupPolicy: Entering. Flags = 6

USERENV(3d8.df4) 16:19:19:119 ProcessGPOs:

USERENV(3d8.df4) 16:19:19:119 ProcessGPOs:

USERENV(3d8.df4) 16:19:19:136 ProcessGPOs: Starting user Group Policy (Background) processing...

USERENV(3d8.df4) 16:19:19:136 ProcessGPOs:

USERENV(3d8.df4) 16:19:19:136 ProcessGPOs:

USERENV(3d8.df4) 16:19:19:136 EnterCriticalPolicySectionEx: Entering with timeout 600000 and flags 0x0

USERENV(3d8.df4) 16:19:19:136 EnterCriticalPolicySectionEx: User critical section has been claimed.  Handle = 0x804

USERENV(3d8.df4) 16:19:19:136 EnterCriticalPolicySectionEx: Leaving successfully.

USERENV(3d8.df4) 16:19:19:136 ProcessGPOs:  Machine role is 2.

USERENV(3d8.df4) 16:19:19:136 PingComputer: PingBufferSize set as 2048

USERENV(3d8.df4) 16:19:19:154 PingComputer: Adapter speed 10000000 bps

USERENV(3d8.df4) 16:19:19:154 PingComputer:  First time:  0

USERENV(3d8.df4) 16:19:19:154 PingComputer:  Fast link.  Exiting.

USERENV(ca0.2dc) 16:19:40:672 LibMain: Process Name:  C:\Program Files\Symantec\Symantec Endpoint Protection\SescLU.exe

USERENV(3d8.df4) 16:20:28:977 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.df4) 16:20:28:977 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.

USERENV(3d8.df4) 16:21:35:432 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.df4) 16:21:35:432 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.

USERENV(3d8.df4) 16:22:41:938 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.df4) 16:22:41:938 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.

USERENV(3d8.df4) 16:23:48:218 MyGetUserName:  GetUserNameEx failed with 1722.

USERENV(3d8.df4) 16:23:48:218 ProcessGPOs: MyGetUserName failed with 1722.

USERENV(3d8.df4) 16:23:48:218 ProcessGPOs: No WMI logging done in this policy cycle.

USERENV(3d8.df4) 16:23:48:218 ProcessGPOs: Processing failed with error 1722.

USERENV(3d8.df4) 16:23:48:218 LeaveCriticalPolicySection: Critical section 0x804 has been released.

USERENV(3d8.df4) 16:23:48:218 ProcessGPOs: User Group Policy has been applied.

USERENV(3d8.df4) 16:23:48:218 ProcessGPOs: Leaving with 0.

USERENV(3d8.df4) 16:23:48:234 ApplyGroupPolicy: Leaving successfully.

USERENV(3d8.3dc) 16:23:48:606 IsSyncForegroundPolicyRefresh: Synchronous, Reason: FirstPolicyRefresh

USERENV(650.f64) 16:23:49:737 LibMain: Process Name:  C:\WINDOWS\system32\userinit.exe

USERENV(ef4.efc) 16:23:49:753 LibMain: Process Name:  C:\WINDOWS\system32\userinit.exe

USERENV(410.430) 16:23:50:028 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.430) 16:23:50:044 GetUserNameAndDomain Failed to impersonate user

USERENV(410.430) 16:23:50:044 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.430) 16:23:50:044 GetUserDNSDomainName: Failed to impersonate user

USERENV(f9c.fa0) 16:23:51:369 LibMain: Process Name:  C:\WINDOWS\Explorer.EXE

USERENV(f80.f84) 16:23:51:821 LibMain: Process Name:  C:\WINDOWS\system32\WgaTray.exe

USERENV(4b0.3bc) 16:23:52:597 LibMain: Process Name:  C:\WINDOWS\system32\wbem\wmiprvse.exe

USERENV(118.ef8) 16:23:52:807 LibMain: Process Name:  C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

USERENV(f9c.fa0) 16:23:52:904 GetProfileType:  Profile already loaded.

USERENV(f9c.fa0) 16:23:52:904 GetProfileType: ProfileFlags is 2

USERENV(b98.2d0) 16:23:53:001 LibMain: Process Name:  C:\WINDOWS\system32\rundll32.exe

USERENV(320.588) 16:23:55:198 LibMain: Process Name:  C:\WINDOWS\INF\unregmp2.exe

USERENV(f9c.564) 16:23:56:846 GetProfileType:  Profile already loaded.

USERENV(f9c.564) 16:23:56:846 GetProfileType: ProfileFlags is 2

USERENV(f9c.564) 16:23:56:879 GetProfileType:  Profile already loaded.

USERENV(f9c.564) 16:23:56:879 GetProfileType: ProfileFlags is 2

USERENV(a88.aa8) 16:24:01:144 LibMain: Process Name:  C:\Program Files\Common Files\Symantec Shared\ccApp.exe

USERENV(c64.a3c) 16:24:03:600 LibMain: Process Name:  C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

USERENV(d20.7ec) 16:24:03:794 LibMain: Process Name:  C:\WINDOWS\system32\userinit.exe

USERENV(c54.c50) 16:24:03:891 LibMain: Process Name:  C:\WINDOWS\system32\imapi.exe

USERENV(c58.d74) 16:24:05:701 LibMain: Process Name:  C:\WINDOWS\system32\mobsync.exe

USERENV(bd0.dfc) 16:24:05:798 LibMain: Process Name:  C:\WINDOWS\system32\ctfmon.exe

USERENV(bd0.dfc) 16:24:05:895 GetProfileType:  Profile already loaded.

USERENV(bd0.dfc) 16:24:05:911 GetProfileType: ProfileFlags is 2

USERENV(eec.a4) 16:24:06:784 LibMain: Process Name:  C:\WINDOWS\System32\NOTEPAD.EXE

USERENV(e2c.e30) 16:24:06:832 LibMain: Process Name:  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

USERENV(e2c.e30) 16:24:06:832 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e2c.e30) 16:24:06:832 GetUserNameAndDomain Failed to impersonate user

USERENV(e2c.e30) 16:24:06:832 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e2c.e30) 16:24:06:832 GetUserDNSDomainName: Failed to impersonate user

USERENV(e2c.e30) 16:24:06:848 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e2c.e30) 16:24:06:848 GetUserNameAndDomain Failed to impersonate user

USERENV(e2c.e30) 16:24:06:848 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e2c.e30) 16:24:06:848 GetUserDNSDomainName: Failed to impersonate user

USERENV(410.6b8) 16:24:07:543 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:07:543 GetUserNameAndDomain Failed to impersonate user

USERENV(410.6b8) 16:24:07:543 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:07:543 GetUserDNSDomainName: Failed to impersonate user

USERENV(410.6b8) 16:24:09:676 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:09:676 GetUserNameAndDomain Failed to impersonate user

USERENV(410.6b8) 16:24:09:676 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:09:676 GetUserDNSDomainName: Failed to impersonate user

USERENV(410.488) 16:24:09:708 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.488) 16:24:09:708 GetUserNameAndDomain Failed to impersonate user

USERENV(410.488) 16:24:09:708 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.488) 16:24:09:708 GetUserDNSDomainName: Failed to impersonate user

USERENV(410.488) 16:24:09:837 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.488) 16:24:09:854 GetUserNameAndDomain Failed to impersonate user

USERENV(410.488) 16:24:09:854 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.488) 16:24:09:854 GetUserDNSDomainName: Failed to impersonate user

USERENV(410.6b8) 16:24:09:854 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:09:854 GetUserNameAndDomain Failed to impersonate user

USERENV(410.6b8) 16:24:09:870 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:09:870 GetUserDNSDomainName: Failed to impersonate user

USERENV(410.6b8) 16:24:09:886 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:09:886 GetUserNameAndDomain Failed to impersonate user

USERENV(410.6b8) 16:24:09:886 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:09:886 GetUserDNSDomainName: Failed to impersonate user

USERENV(410.488) 16:24:09:886 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.488) 16:24:09:902 GetUserNameAndDomain Failed to impersonate user

USERENV(410.488) 16:24:09:902 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.488) 16:24:09:902 GetUserDNSDomainName: Failed to impersonate user

USERENV(410.488) 16:24:09:918 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.488) 16:24:09:918 GetUserNameAndDomain Failed to impersonate user

USERENV(410.488) 16:24:09:918 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.488) 16:24:09:918 GetUserDNSDomainName: Failed to impersonate user

USERENV(a5c.9ec) 16:24:11:889 LibMain: Process Name:  C:\Program Files\Dell Support Center\gs_agent\dsc.exe

USERENV(410.6b8) 16:24:14:087 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:14:087 GetUserNameAndDomain Failed to impersonate user

USERENV(410.6b8) 16:24:14:087 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:14:087 GetUserDNSDomainName: Failed to impersonate user

USERENV(410.6b8) 16:24:14:119 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:14:119 GetUserNameAndDomain Failed to impersonate user

USERENV(410.6b8) 16:24:14:119 ImpersonateUser: Failed to impersonate user with 5.

USERENV(410.6b8) 16:24:14:119 GetUserDNSDomainName: Failed to impersonate user

USERENV(e2c.b44) 16:24:14:281 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e2c.b44) 16:24:14:281 GetUserNameAndDomain Failed to impersonate user

USERENV(e2c.b44) 16:24:14:297 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e2c.b44) 16:24:14:297 GetUserDNSDomainName: Failed to impersonate user

USERENV(e2c.e00) 16:24:15:525 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e2c.e00) 16:24:15:525 GetUserNameAndDomain Failed to impersonate user

USERENV(e2c.e00) 16:24:15:541 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e2c.e00) 16:24:15:541 GetUserDNSDomainName: Failed to impersonate user

USERENV(ce4.ce8) 16:24:22:925 LibMain: Process Name:  C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

USERENV(68c.110) 16:24:25:931 LibMain: Process Name:  C:\WINDOWS\system32\rundll32.exe

USERENV(e4c.c68) 16:24:39:713 LibMain: Process Name:  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\bgsview.exe

USERENV(e4c.c68) 16:24:39:713 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e4c.c68) 16:24:39:713 GetUserNameAndDomain Failed to impersonate user

USERENV(e4c.c68) 16:24:39:729 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e4c.c68) 16:24:39:729 GetUserDNSDomainName: Failed to impersonate user

USERENV(e4c.c68) 16:24:39:729 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e4c.c68) 16:24:39:729 GetUserNameAndDomain Failed to impersonate user

USERENV(e4c.c68) 16:24:39:729 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e4c.c68) 16:24:39:746 GetUserDNSDomainName: Failed to impersonate user

USERENV(e4c.e0c) 16:24:40:764 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e4c.e0c) 16:24:40:764 GetUserNameAndDomain Failed to impersonate user

USERENV(e4c.e0c) 16:24:40:764 ImpersonateUser: Failed to impersonate user with 5.

USERENV(e4c.e0c) 16:24:40:780 GetUserDNSDomainName: Failed to impersonate user

USERENV(ab0.d2c) 16:25:30:223 LibMain: Process Name:  C:\Program Files\Symantec\Symantec Endpoint Protection\SescLU.exe

USERENV(a5c.9ec) 16:25:45:074 GetProfileType:  Profile already loaded.

USERENV(a5c.9ec) 16:25:45:074 GetProfileType: ProfileFlags is 2

USERENV(b34.db4) 16:26:34:075 LibMain: Process Name:  C:\Program Files\Dell Support Center\bin\sprtcmd.exe

USERENV(b34.db4) 16:26:34:090 ImpersonateUser: Failed to impersonate user with 5.

USERENV(b34.db4) 16:26:34:090 GetUserNameAndDomain Failed to impersonate user

USERENV(b34.db4) 16:26:34:090 ImpersonateUser: Failed to impersonate user with 5.

USERENV(b34.db4) 16:26:34:090 GetUserDNSDomainName: Failed to impersonate user

USERENV(b34.db4) 16:26:34:090 ImpersonateUser: Failed to impersonate user with 5.

USERENV(b34.db4) 16:26:34:090 GetUserNameAndDomain Failed to impersonate user

USERENV(b34.db4) 16:26:34:106 ImpersonateUser: Failed to impersonate user with 5.

USERENV(b34.db4) 16:26:34:106 GetUserDNSDomainName: Failed to impersonate user

USERENV(b34.e78) 16:26:34:992 ImpersonateUser: Failed to impersonate user with 5.

USERENV(b34.e78) 16:26:34:992 GetUserNameAndDomain Failed to impersonate user

USERENV(b34.e78) 16:26:35:008 ImpersonateUser: Failed to impersonate user with 5.

USERENV(b34.e78) 16:26:35:008 GetUserDNSDomainName: Failed to impersonate user

USERENV(b34.db4) 16:26:58:464 GetProfileType:  Profile already loaded.

USERENV(b34.db4) 16:26:58:464 GetProfileType: ProfileFlags is 2

USERENV(68c.f14) 16:26:58:559 LibMain: Process Name:  C:\WINDOWS\system32\wscript.exe

USERENV(318.6e8) 16:27:02:007 ImpersonateUser: Failed to impersonate user with 5.

USERENV(318.6e8) 16:27:02:023 GetUserNameAndDomain Failed to impersonate user

USERENV(318.6e8) 16:27:02:023 GetUserDNSDomainName:  Domain name is NT Authority.  No DNS domain name available.

USERENV(9c0.90c) 16:27:39:463 LibMain: Process Name:  C:\WINDOWS\explorer.exe

USERENV(f9c.564) 16:27:55:882 GetProfileType:  Profile already loaded.

USERENV(f9c.564) 16:27:55:882 GetProfileType: ProfileFlags is 2

USERENV(b1c.ef0) 16:28:57:663 LibMain: Process Name:  C:\WINDOWS\system32\NOTEPAD.EXE

Open in new window

0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34307366
Im no expert at these by any means, but Ive seeen enough of them to hopefully help....

Where EXACTLY is the delay occurring, after hitting CTRL+ALT+DEL, to get to the Desktop? Before getting to a login box?

From the looks of it, is that it takes about 11 minutes to get from starting  winlogon.exe to a login for your User account 'mshaff01'

This is all good here...... Your exclusions...
USERENV(3d8.3dc) 16:18:56:814 GetExclusionList: The exclusion on both server and client are same: <Local Settings;Temporary Internet Files;History;Temp;Desktop; My Documents; Application Data; Start Menu; Net Hood; Temp; Temporary Internet Files; local settings\temp\; local settings\temporary internet files>
USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\Local Settings to ExclusionList
USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\Temporary Internet Files to ExclusionList
USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\History to ExclusionList
USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\Temp to ExclusionList
USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\Desktop to ExclusionList
USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\My Documents to ExclusionList
USERENV(3d8.3dc) 16:18:56:831 ConvertExclusionList: Adding E:\mshaff01\Application Data to ExclusionList
USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\Start Menu to ExclusionList
USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\Net Hood to ExclusionList
USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\Temp to ExclusionList
USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\Temporary Internet Files to ExclusionList
USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\local settings\temp\ to ExclusionList
USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\local settings\temporary internet files to ExclusionList
USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Local Settings to ExclusionList
USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Temporary Internet Files to ExclusionList
USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\History to ExclusionList
USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Temp to ExclusionList
USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Desktop to ExclusionList
USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\My Documents to ExclusionList
USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Application Data to ExclusionList
USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Start Menu to ExclusionList
USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Net Hood to ExclusionList
USERENV(3d8.3dc) 16:18:56:865 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Temp to ExclusionList
USERENV(3d8.3dc) 16:18:56:883 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\Temporary Internet Files to ExclusionList
USERENV(3d8.3dc) 16:18:56:883 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\local settings\temp\ to ExclusionList
USERENV(3d8.3dc) 16:18:56:883 ConvertExclusionList: Adding C:\Documents and Settings\mshaff01\local settings\temporary internet files to ExclusionList

Might have a Typo in your GPO.... Small size , but still should exclude it.....
USERENV(3d8.3dc) 16:18:56:848 ConvertExclusionList: Adding E:\mshaff01\Net Hood to ExclusionList  <~~~ Notice the space.....
Here it is reconciling the following.....
USERENV(3d8.3dc) 16:18:57:361 RecurseDirectory: Adding E:\mshaff01\NetHood\AIntg-Bkrst on Pqsv12159\ to the list of directories

Logon occurs here....
USERENV(3d8.3dc) 16:18:55:702 LoadUserProfile: lpProfileInfo->lpUserName = <mshaff01>
Gets to the Desktop, or at least starts here.....
USERENV(f9c.fa0) 16:23:51:369 LibMain: Process Name:  C:\WINDOWS\Explorer.EXE
(actually a second one here, which is odd.....).....
USERENV(9c0.90c) 16:27:39:463 LibMain: Process Name:  C:\WINDOWS\explorer.exe

GPO starts here....
USERENV(3d8.3dc) 16:19:19:068 IsSyncForegroundPolicyRefresh: Synchronous, Reason: FirstPolicyRefresh

But looks like it has failed.... Look at the time delay....
USERENV(3d8.df4) 16:20:28:977 MyGetUserName:  GetUserNameEx failed with 1722.
USERENV(3d8.df4) 16:20:28:977 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.
USERENV(3d8.df4) 16:21:35:432 MyGetUserName:  GetUserNameEx failed with 1722.
USERENV(3d8.df4) 16:21:35:432 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.
USERENV(3d8.df4) 16:22:41:938 MyGetUserName:  GetUserNameEx failed with 1722.
USERENV(3d8.df4) 16:22:41:938 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.
USERENV(3d8.df4) 16:23:48:218 MyGetUserName:  GetUserNameEx failed with 1722.
USERENV(3d8.df4) 16:23:48:218 ProcessGPOs: MyGetUserName failed with 1722.

From http://technet.microsoft.com/en-us/library/cc786775(WS.10).aspx
1722
 RPC Server is unavailable. This error can mean several different things. Check for name resolution problems first. This is a common cause of this error. The next thing is to use a utility, like Port Query or RPC Ping, to make sure that client and the target server are communicating. Due to Windows dependency on RPC, any failures in RPC can have a repercussions. Make sure the critical services like the RPC Endpoint Mapper and RPCSS are turned on. Also make sure port 135 is not blocked so clients can bind and connect to the endpoint mapper. Finally, you can take a network trace to make sure RPC connectively is valid. Because RPC traffic is usually encrypted, you need someone that knows how to look for RPC in a network trace.
 
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34307368
Also, what version of SEP are you using? And is your clients set to scan on "File Modified", or "Modified AND on Access"?
0
 
LVL 66

Accepted Solution

by:
johnb6767 earned 500 total points
ID: 34307400
USERENV(3d8.df4) 16:19:19:136 EnterCriticalPolicySectionEx: Entering with timeout 600000 and flags 0x0
USERENV(3d8.df4) 16:19:19:136 EnterCriticalPolicySectionEx: User critical section has been claimed.  Handle = 0x804
USERENV(3d8.df4) 16:19:19:136 EnterCriticalPolicySectionEx: Leaving successfully.

EnterCriticalPolicySection Messages
This is a potentially serious log message. It could indicate that certain portions of the operating system have become corrupt due to improper shut-down or system crashes. It could also indicate a system resource problem, similar to the "Failed to…" errors mentioned earlier in this section. To troubleshoot this issue, remove all third-party software to determine if a non-Microsoft program is causing this error. If that does not fix the problem, start with a clean installation of Windows, install all necessary service packs, and then introduce the clean computer into your environment. Monitor the Userenv log while installing any additional programs to determine what could be causing this error.

0
 

Author Comment

by:mshaffner
ID: 34623288
Unable to resolve question with the limited support available.  If experts were available for real-time discussions or chat, we may have been able to fix this one.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Suggested Solutions

On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now