Virtual Server 2008 R2 Multiple 2511 Event ID after Migration from Physical 2003 R2

Posted on 2012-09-03
Medium Priority
Last Modified: 2012-11-15
'morning Experts.

We picked up on a problem with our data server on Friday where a number of users shares had 'disappeared' to be replaced in the folder root by multiple folders called 'My Documents'.  Over the weekend an automatic disc check kicked off and we have now found that we have multiple event 2511 entries in the system log.  Back tracking the log has shown that these first appeared in January a few months after our physical 2003 R2 data box was migrated to a virtaul 2008 R2 running under VMware.

Most of the orphaned shares do appear to be true orphans in that they point to some very old data that is no longer required / on the server.  What I am looking for is:
a) some pointers as to what may have caused this
b) a powershell or vbscript that will go through AD and the event log and remove the orphaned shares - preferably with a 'dummy run' switch first as this is a production server.

I have found a couple of similar questions elsewhere but they either relate to 2003 or don't do quite what I am looking for.  The closest are:



Question by:cmdown
  • 5
  • 2
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 38360465
Looks like after migration drive letters were changed. Is that true ?
To remove orphaned shares, you can simply go into Windows registry and remove them manually (just only those you do not need anymore). Please see where shares are stored in a registry

Just use only information about shares location in registry


Author Comment

ID: 38360509
Hi Krzysztof

Thanks for your reply.  I can do this manually but we have quite a large user base and I would ideally like a tool that will give me a report of problem shares and the option to remove orphaned shares automatically.

Anyway, to answer your question,.. for some users yes.When the data was migrated from the physical 2003 box to the virtualised 2008 server one entire set of users were moved to a new drive due to space constraints.  However the few orphans  I've sampled seem to have dropped a space from the share name, i.e. Smith John has become SmithJohn ( yes I know there shouldn't have been a space there in the first place !!).  However as to why/ how this has occurred I don't know - There shouldn't have been any manually 'intervention' on these folders.
LVL 47

Accepted Solution

Craig Beck earned 2000 total points
ID: 38430586
The folders will appear as 'My Documents' as the way Server 2008 / Vista / 7 handles the My Documents folder is different to Server 2003 / XP / 2000, etc.

The folder names won't have changed - it's just that the server will display what's in the .ini file within the folder (it's a bit like the folder preferences).

This might help...

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.


Author Comment

ID: 38431842
Thanks for the feedback on the folder name issue Craig. Can the .ini file be safely deleted?  It is causing a problem because at the root level we have some 140 or so staff folders - mostly showing their correct folder name, such as SmithJB, but as per part of the question we have quite a few that show 'My Documents' which is difficult when trying to track down staff work!

Do you have any idea why we are getting the problem with the orphaned shares (event 2511) which was the main issue we were concerned about?
LVL 47

Assisted Solution

by:Craig Beck
Craig Beck earned 2000 total points
ID: 38434684
You can delete the .ini file but it will come back as soon as the user accesses the folder.

I don't know why it would cause the initial issue, but what I've done to get around the 'My Documents' issue is to set the redirected folder to go to \\server\share\%username%\Documents

That way, you still see the username, and the My Documents folder goes into the Documents folder below the user's root share.

Author Comment

ID: 38502925
Thanks Craig

I'll give this a go tomorrow and feed back on result.  Apologies for the delay in picking up your post.

Author Comment

ID: 38584765
Hi Craig

Sorry this one slipped off of the radar due to holiday and a major comms infrastructure change.  I'll try and re-visit this later next week.

Author Closing Comment

ID: 38602151
Hi Craig

This worked - thank you

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let's recap what we learned from yesterday's Skyport Systems webinar.
A walk-through example of how to obtain and apply new DID phone numbers to your cloud PBX enabled users that are configured in Office 365. Whether you have 1, 10 or 100+ users in your tenant, it's quite easy to get them phone-enabled and making/rece…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
Suggested Courses

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question