Friday 8 June 2012

Problem with expiring old user profiles on Windows 7



I was testing the "Delete user profiles older than a specified number of days on system restart" local policy - which deletes the profile from the computer if it hadn't been logged into for X days - on two Windows 7 Enterprise (32-bit) computers that are used a lot of different people logging in with their own domain accounts, so I wanted old profiles to get deleted & not cruft up the local system over time (these are local profiles not roaming profiles).

The problem I've run into now that the first profiles have started to expire is:

a) If the user comes back X+ days after their last login to use the computer again, they can't log on at all with a "The User Profile Service failed the logon. User profile cannot be loaded." error.

b) The user profile folder still exists - it's just empty. Not really a problem in itself - but could it be a symptom/cause of a)?

The problem profile SIDs are removed (no longer listed in the registry under Local_Machine\..\Windows NT\CurrentVersion\ProfileList nor do they appear in Advanced System Settings -> User Profiles.  (ie they appear to be properly deleted).

The policy has since been turned off so it won't affect any more people, but why is this preventing those old users from logging back in? I'd expect Windows to just rebuild the profile like it would for a brand new user, instead it errors out.

I know Vista has a hotfix for a problem relating to that policy, but that was for premature deletion, not this error. 7 doesn't appear to have any related updates.

Just had a bad thought: could that policy have deleted the Default profile? I wonder if whomever built that system image did something kooky when setting it up that would allow that.

---
Update: the error also happens for a user account that has never logged into the machine as well. That does sound like a Default profile problem.

---
Update 2: Damn. Advanced System Settings > User Profiles, for one computer, there is no entry for "Default profile". The other one has it, but zero bytes. Looks like I'm going to have to re-install the suckers when I'm back next week unless if anyone knows a quick way of re-establishing a new default profile for the system. I'll try a System Restore first, with luck it'll save it. Either way it'll have to wait.

How could that policy delete the default profile anyways? Can a machine be set so that the default profile is C:\Users\regularuser instead of the normal (hidden) Default user folder?

---
Update 3: Stayed on it & managed to get it fixed.

System Restore brought back the default profile (but that in turn broke the trust relationship with the domain... leaving & rejoining the domain under a new PC name fixed that). Domain users with no existing profile (either old & deleted, or never existed on that PC) are now able to log in normally.

Now these computers are working as they should, but the question remains of how this happened in the first place: why did the profile expiry policy delete the default profile? I may need to figure out some things with the original system image.

No comments:

Post a Comment