Virtual Server 2008 R2 Multiple 2511 Event ID after Migration from Physical 2003 R2

Posted on 2012-09-03
Last Modified: 2012-11-15
'morning Experts.

We picked up on a problem with our data server on Friday where a number of users shares had 'disappeared' to be replaced in the folder root by multiple folders called 'My Documents'.  Over the weekend an automatic disc check kicked off and we have now found that we have multiple event 2511 entries in the system log.  Back tracking the log has shown that these first appeared in January a few months after our physical 2003 R2 data box was migrated to a virtaul 2008 R2 running under VMware.

Most of the orphaned shares do appear to be true orphans in that they point to some very old data that is no longer required / on the server.  What I am looking for is:
a) some pointers as to what may have caused this
b) a powershell or vbscript that will go through AD and the event log and remove the orphaned shares - preferably with a 'dummy run' switch first as this is a production server.

I have found a couple of similar questions elsewhere but they either relate to 2003 or don't do quite what I am looking for.  The closest are:


Question by:cmdown
    LVL 39

    Expert Comment

    by:Krzysztof Pytko
    Looks like after migration drive letters were changed. Is that true ?
    To remove orphaned shares, you can simply go into Windows registry and remove them manually (just only those you do not need anymore). Please see where shares are stored in a registry

    Just use only information about shares location in registry

    LVL 1

    Author Comment

    Hi Krzysztof

    Thanks for your reply.  I can do this manually but we have quite a large user base and I would ideally like a tool that will give me a report of problem shares and the option to remove orphaned shares automatically.

    Anyway, to answer your question,.. for some users yes.When the data was migrated from the physical 2003 box to the virtualised 2008 server one entire set of users were moved to a new drive due to space constraints.  However the few orphans  I've sampled seem to have dropped a space from the share name, i.e. Smith John has become SmithJohn ( yes I know there shouldn't have been a space there in the first place !!).  However as to why/ how this has occurred I don't know - There shouldn't have been any manually 'intervention' on these folders.
    LVL 44

    Accepted Solution

    The folders will appear as 'My Documents' as the way Server 2008 / Vista / 7 handles the My Documents folder is different to Server 2003 / XP / 2000, etc.

    The folder names won't have changed - it's just that the server will display what's in the .ini file within the folder (it's a bit like the folder preferences).

    This might help...
    LVL 1

    Author Comment

    Thanks for the feedback on the folder name issue Craig. Can the .ini file be safely deleted?  It is causing a problem because at the root level we have some 140 or so staff folders - mostly showing their correct folder name, such as SmithJB, but as per part of the question we have quite a few that show 'My Documents' which is difficult when trying to track down staff work!

    Do you have any idea why we are getting the problem with the orphaned shares (event 2511) which was the main issue we were concerned about?
    LVL 44

    Assisted Solution

    by:Craig Beck
    You can delete the .ini file but it will come back as soon as the user accesses the folder.

    I don't know why it would cause the initial issue, but what I've done to get around the 'My Documents' issue is to set the redirected folder to go to \\server\share\%username%\Documents

    That way, you still see the username, and the My Documents folder goes into the Documents folder below the user's root share.
    LVL 1

    Author Comment

    Thanks Craig

    I'll give this a go tomorrow and feed back on result.  Apologies for the delay in picking up your post.
    LVL 1

    Author Comment

    Hi Craig

    Sorry this one slipped off of the radar due to holiday and a major comms infrastructure change.  I'll try and re-visit this later next week.
    LVL 1

    Author Closing Comment

    Hi Craig

    This worked - thank you

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Join & Write a Comment

    Microsoft Windows Server Update Service (WSUS) is free for everyone, but it lacks of some desirable features like send an e-mail to the administrator with the status of all computers on the WSUS server. This article is based on my PowerShell script …
    Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
    This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
    This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now