Wednesday, 10 September 2008

Vista - Event ID 1511, 1515 Profile loss to TEMP

We had a strange Vista hiccup this afternoon with one of our clients: She was working in Word, opened a template to begin a project and the system literally hiccuped hiccupped her out.

When she logged back in, her profile was initialized in temporary mode with no messages at all indicating that there was a problem.

She knew there was a problem though because from there on in she was essentially answering all of the same initial questions one would get when logging onto the system for the first time.

Her profile was in C:\Users\Temp.

We tried to recover the profile by checking the settings in the registry, but they were correct.

We tried to rename her original local profile folder, but when she logged in she still received the TEMP folder as her profile location.

The errors associated:

Log Name: Application
Source: User Profile Service
Date: 9/9/2008 2:45:06 PM
Event ID: 1511
Task Category: None
Level: Warning
Keywords: Classic
User: domain\UserName
Computer: MyComputer
Description: Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.

and

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 9/9/2008 2:45:06 PM
Event ID: 1515
Task Category: None
Level: Warning
Keywords: Classic
User: domain\UserName
Computer: MyComputer
Description: Windows has backed up this user profile. Windows will automatically try to use the backup profile the next time this user logs on.
It was a bit of a strange puzzle, but a bit of searching turned up the cure:
  1. Reboot
  2. Log on as a local admin other than the user with the profile problem.
  3. Copy the old C:\Users\%UserName% contents to a network location.
  4. Delete the C:\Users\%UserName% directory
  5. Delete Delte the C:\Users\TEMP directory
  6. Regedit
  7. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
  8. Find the SID for the user with the corrupted profile and delete it (profile directory will be C:\Users\%UserName%.
  9. Reboot.
  10. Logon with the affected user's account.
The profile will recreate itself and work just as it should. Copy the contents of the original profile back into their respective places.

For Exchange integrated and My Documents redirected sites the contents will essentially be the user's Desktop and Favorites folders. Keep in mind that the Offline Files feature may take time to synchronize for large profiles and Outlook may take some time to build up the OST file.

Links:

Note that no message was displayed to the user.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

17 comments:

Unknown said...

It took me a while to chance upon your post here, but I'm glad I did - it seems to have been just what I needed.

I've spent the last two hours trying to figure out this very problem... only in the last ten minutes did it occur to me to search for the Event IDs and not just a generic description of the cause of my frustration.

Thanks very much!!!

(The epiphany came when you revealed where in the registry my fate was kept: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList)

Philip Elder Cluster MVP said...

Arya,

Glad we could help!

Philip

Anonymous said...

I'd just like to say thanks as well ...

and to let you know, this applies to XP (at least SP3) as well ...

I'd never have thought to look on Microsoft under Vista rather than XP :-)

Anonymous said...

We are having this happen a lot in the month or so. Sometimes the user can reboot the system and it will use the correct profile other times we have to copy the stuff out of the profile that we want to keep, delete the old profile and have the user log back in to create a new profile and copy the saved data back. We are getting the same events in the event log. Do you know the root of the problem? It just started the last month or so and it happens to at least one user a day.

Anonymous said...

Works for Windows 2008 WTS also !

Just had to delete all .bak profile listings in the hklm regkey and nothing else.

nice work, thanks. Gordon

Anonymous said...

This tip help me so much!
Thanks!!!!!!

Anonymous said...

Helped a lot! Thanks!

First result on "1511 event vista" for me.

Hopefully this will be the last step for me in transferring my Users folder to the D: drive from C:!

(Pretty sure an incomplete modifying of the related registry keys led to this problem.)

Anonymous said...

But why the hell this is happening?
Got the soultion, but why it caused is an mystery?If we know exactly which application is creating this, we can take care of that. Am I right?

PH Admin said...

Worked like a charm! Thank you very much!

Anonymous said...

Same problem on Windows 2008 32bit in remote desktop mode. The user gets a task tray notification to say the profile failed to load and temporary is being used. When I looked at the c:\users folder, they had no profile folder there, but the registry keys were in place and once deleted, the user logged in without problems.

Sad that the error message in event viewer is so vague, MS have been doing roaming profiles and terminal services so long... oh well...

Thanks for the help, Vista = Windows 2008 for this problem.

Anonymous said...

Tnx for the help, 2008 R2.. youre tips fixed the same issue..

Anonymous said...

GREAT! Thought this was a problem with W2K8R2 and our Samba -but it was just this little registry entry ...
Thanks a lot and greetings from germany,
Tom

Anonymous said...

You saved me my friend! Thanks a bunch. This was also connected to a Citrix profile manager problem that I had. It continued to use Citrix profile manager to logon with. Somehow it must be connected to the profile.
Now it works! :)

Anonymous said...

This wasn't the cure for me, every time the user logged out the TEMP profile removed itself as did the SID form the registry. Deleted the Domain User account and rec-created it however the problem remains that every time this user logs on they get a TEMP profile, worth noting the SID has also changed so im thinking it might be some sort of corruption with the particular users domain name. if I create a new user with the same name but add a '1' at the end this user works fine...any ideas

Anonymous said...

Awesome!

Anonymous said...

Awesome !

Anonymous said...

dont forget to reboot!