• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3174
  • Last Modified:

User getting black screens when logging into their profiles.

Hello.

We have approximately 550 users.
Our machines were mostly Windows XP, but half were upgraded to Windows 7.
Users have two profiles.   XPprofile  and W7profile.v2.

We are getting an awful lot of users logging in and getting a black screen, with no desktop loading.  This happens when they login into Windows 7, the new Windows 7 machines that were imaged over the summer holiday.   Half of our machines are XP and half are Windows 7.  A typical student will login to both XP and Windows 7 on a daily basis.

I can press ctrl-alt + delete and log the user off.  Reboot into safe mode with admin credentials, then delete the local profile, remote to the server where the profiles are stored and delete the profile on the server - then get the user to login and have a new profile created again, then the user can see their desktop.

So, is this a corrupted profile issue, in that the users existing XP profile was downloaded to the new Windows 7 machine and has become corrupted during this process?

Users have their home folder on a separate server to that of their profile.  

Also, the strange thing is that after deleting some profiles - some users are complaining that it has happened again after going to a different machine.  

If you need me to explain anything in more detail, please just ask.

Thanks.
0
SpencerKarnovski
Asked:
SpencerKarnovski
4 Solutions
 
PAdocITCommented:
Sounds like a strange symptom. They only way parts of the XP profile could end up in the W7 profile is if you captured them during the imaging process using USMT or they were manually copied from one profile to the other. XP will not read a W7 profile and vice-versa. Have you checked the event viewer for any profile specific errors? If you look for the source "User Profile General" under Windows Logs > Application it will usually tell you if there is an issue with a users profile (not always though). Attached is an XML file that you can import into the event viewers custom views that will show only the source "User Profile General"

Open event viewer
Right click the Custom Views folder
Select import
Navigate to the XML file
profile-issues.xml
0
 
jeffiepooCommented:
In my experience, Microsoft simply didn't do a very good job with their upgrade scripts. My guess is that there are a lot of variables that are environmental and they didn't have enough test cases in their labs to account for all of the possible upgrade scenarios so people run into this problem a lot

When this happens, I usually have to start troubleshooting from the beginning, and most of the time replacing the profile fixes the issue. Since you are on a controlled environment, I'm guessing you won't see the black screen for reasons like malware or a corrupted explorer.exe very often.

Users that see this repeatedly could possibly have a CD/DVD in the drive or didn't logout or shutdown correctly.. Is this possible? Also, since it happens when some students go to different machines, the first thing I would exhaustively check is if there is some sort of profile loaded locally. Maybe there is a cached local copy on the machine of what is stored on the server and it doesn't reload that file until the machine is restarted? That is just one hypothesis along those lines, but you get the jist..  The thing is.. I don't know the order that things were fixed and on what machines.. I.E. -

1) User logs onto machine 1
2) Admin resets profile from admin machine in separate office.
3) Machine 1 fixed
4).....
5) User logs onto machine 2 and it doesn't work.

This type of info can be tremendously helpful in helping us guess at what might be happening.

Hope this helps,

-Jeff
0
 
MeultjeCommented:
For our TS sessions we are (also) using TS / RDP profiles. In the policy of the TS / RDP machines (in our case Citrix / Xenapp) the user profiles are removed from the machine when they log off.

Delete cached copies of roaming profiles -> Setting Path:
Computer Configuration/Administrative Templates/System/User Profiles

This might help you with a clean profile each time a user logs on..
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
SpencerKarnovskiAuthor Commented:
Hello guys, thanks for the information here.  The problem has died down now - only getting one or two cases per day.  But this is simply due to the fact that I have deleted the local, and server profiles; thus when they have logged in they get a new profile.

I do believe this issue is due to the having cached copies of local profiles, as someone stated above.  When looking in the event viewer, I see this error;

"Windows has detected that Offline Caching is enabled on the Roaming Profile share" .

Deleting all local profiles, on all 550 computers, is not going to happen.  We do have a script we can run that will do this, but we cannot afford possible downtime.

Furthermore, as we have, every other period, 400+ students logging onto the network - getting them to download a new copy of their profile each time they logon would put a strain on the network structure, would it not?


Thanks for you help, again.
0
 
PAdocITCommented:
Sounds like it's trying to synchronize changes in the profile as opposed to loading/unloading the roaming profile during logon and logoff. I would set your caching to be not available offline.

on your share:
Right click choose properties > Sharing Tab > Clikc Caching > select " Files and programs from the share will not be available offline"

Having cached local copies on a desktop is not as big of a deal as it is on a terminal server which is what was mentioned above. A cached local copy and offline share caching aren't the same thing. Users will still get a local copy of the roaming profile.

Caching
0
 
SpencerKarnovskiAuthor Commented:
Hello guys,

Thanks for the info PadocIT.  The strange thing is, our user profiles are obviously not shared.  The home drives, which are stored on a separate server, are shared.

The error message above, was from a Windows XP machine.  The event info below shows errors from a machine that had a user with a black screen.

I still have to investigate these, but thought I would post them here to start with.

Log Name:      Application
Source:        Microsoft-Windows-User Profiles Service
Date:          13/09/2012 10:23:43
Event ID:      1530
Task Category: None
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.  

 DETAIL - 
 1 user registry handles leaked from \Registry\User\S-1-5-21-1229272821-343818398-682003330-12053:
Process 2088 (\Device\HarddiskVolume2\Program Files\Lightspeed Systems\User Agent\UAService.exe) has opened key \REGISTRY\USER\S-1-5-21-1229272821-343818398-682003330-12053

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1530</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-09-13T09:23:43.699318800Z" />
    <EventRecordID>5833</EventRecordID>
    <Correlation />
    <Execution ProcessID="920" ThreadID="5916" />
    <Channel>Application</Channel>
    <Computer></Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData Name="EVENT_HIVE_LEAK">
    <Data Name="Detail">1 user registry handles leaked from \Registry\User\S-1-5-21-1229272821-343818398-682003330-12053:
Process 2088 (\Device\HarddiskVolume2\Program Files\Lightspeed Systems\User Agent\UAService.exe) has opened key \REGISTRY\USER\S-1-5-21-1229272821-343818398-682003330-12053
</Data>
  </EventData>
</Event>


Log Name:      Application
Source:        Microsoft-Windows-Folder Redirection
Date:          13/09/2012 09:50:30
Event ID:      510
Task Category: None
Level:         Warning
Keywords:      
User:          DTC\09flecha
Computer:      ICT211.dtc.com
Description:
Folder redirection policy application has been delayed until the next logon because the group policy logon optimization is in effect.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Folder Redirection" Guid="{7D7B0C39-93F6-4100-BD96-4DDA859652C5}" />
    <EventID>510</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-09-13T08:50:30.450329700Z" />
    <EventRecordID>5816</EventRecordID>
    <Correlation ActivityID="{13E52F6B-3EA9-45E5-A253-606929B17BA3}" />
    <Execution ProcessID="920" ThreadID="2064" />
    <Channel>Application</Channel>
    <Computer>ICT211.dtc.com</Computer>
    <Security UserID="S-1-5-21-1229272821-343818398-682003330-12053" />
  </System>
  <EventData Name="EVENT_FDEPLOY_WarningSyncLogonRequired">
  </EventData>
</Event>


Log Name:      Application
Source:        Microsoft-Windows-Folder Redirection
Date:          13/09/2012 08:49:24
Event ID:      502
Task Category: None
Level:         Error
Keywords:      
User:          
Computer:      
Description:
Failed to apply policy and redirect folder "Documents" to "N:\MyWork".
 Redirection options=0x9211.
 The following error occurred: "Can not create folder "N:\MyWork"".
 Error details: "This security ID may not be assigned as the owner of this object.
".
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Folder Redirection" Guid="{7D7B0C39-93F6-4100-BD96-4DDA859652C5}" />
    <EventID>502</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-09-13T07:49:24.691424100Z" />
    <EventRecordID>5763</EventRecordID>
    <Correlation ActivityID="{BEF21A7E-F7E5-4511-91C0-6145456838DC}" />
    <Execution ProcessID="924" ThreadID="3840" />
    <Channel>Application</Channel>
    <Computer>ICT211.dtc.com</Computer>
    <Security UserID="S-1-5-21-1229272821-343818398-682003330-16646" />
  </System>
  <EventData Name="EVENT_FDEPLOY_FailedToApplyPolicy">
    <Data Name="FromFolder">Documents</Data>
    <Data Name="ToFolder">N:\MyWork</Data>
    <Data Name="Options">0x9211</Data>
    <Data Name="Error">Can not create folder "N:\MyWork"</Data>
    <Data Name="ErrorDetails">This security ID may not be assigned as the owner of this object.
</Data>
  </EventData>
</Event>

Open in new window

0
 
PAdocITCommented:
The registry issue is "normal" you will see that in XP and 7.
http://support.microsoft.com/kb/947238

As for the redirection looks the user can't take ownership. Do you have CREATOR OWNER in your NTFS permissions for the share? That account should have full control of Subfolders and files only.

CREATOR OWNER
0
 
SpencerKarnovskiAuthor Commented:
Hello PadocIT,

The problem is, the actual profiles are not shared.  The individual profiles, for each student, cannot be shared.  The user, obviously, has been added and has full control.  The home drive is shared.

But the parent directory, which holds all the individual profiles is shared - thus we can set the offline shared settings on that.  For now, though, we are getting no more black screens because I have reset the profile.   But I do believe the problem is something to do with the  offline share caching and how they sync up with the server.

Thanks for all your help.
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now