Jump to content
Welcome to our new Citrix community!
  • 0

ntuser.dat gets corrupted

Jorge Ponce de Leoacuten


Hi there!

We have a XenDesktop implementation using UPM 2.1. Randomly a user can't initiate a session and gets an error like this: "Windows cannot load profile, logging with a temporary profile".

We've checked the damaged profiles and found the error is in NTUSER.DAT file. If we try to load it, we receive this error: "Cannot load: NTUSER.DAT: Error while loading hive."

Our environment is:
+ XenDesktop 3.0.
+ UPM 2.1.
+ Windows XP sp3.
+ UPHClean

Any ideas?

Thanks in advance!

Link to comment

9 answers to this question

Recommended Posts

  • 0

Hi Helge,

I've just confirmed that there's no antivirus running at the file server that's hosting the profiles. It is an EMC NAS storage.

But we've found something interesting: there're random disconnections on our XenDesktop environment (some LAN issues). We also found that, when the user tries to reconnect, sometimes open a new session in a new virtual desktop, but the other session is still open.

And statistically we've found that is more probable that a profile becomes corrupted after the same user reports a disconnection from his/her desktop.

Could it be a clue about this problem?

Thank you for your help.

Link to comment
  • 0

Hmm, really difficult to say. I was asking about the antivirus because recently a customer of ours had the same problem (corrupt NTUSER.DATs) and after a very (!) long time of searching and trying out various tactics to isolate and reproduce the problem it turned out that the antivirus product on the file server had a bug.

What you could try to find out:

- Can you get your hands on a corrupt NTUSER.DAT? If so, please post it here if possible for data security reasons.

- When are the NTUSER.DATs becoming corrupt? Are they OK on the file server (which would mean the loading breaks them)?

- In order to find corrupt NTUSER.DATs on the file server, you could use a simple batch file that traverses the user stores and copies all NTUSER.DAT files found to a temporary location. From there you could use "reg load" to try to load each file into the local registry. If that succeeds, the file is OK.

- Can you discern anything from UPM's log files? There should be explicit error messages when something like copying the NTUSER.DAT fails for some reason. Errors are always logged to the event log, too.

I hope this helps.

Please visit my blog at http://blogs.sepago.de/helge

Link to comment
  • 0


Did one of you find out what the problem was? We have the same issue here with corrupt profiles.
Sometimes users are logging on with temporary profiles and the NTUSER.dat cant be loaded into registry hive.

very annoying because you cant see anything now. The UPM log says it succesfully logged of last time the user logged out but when logging on with corrupt profile logs the following:

2010-07-16;11:43:40.351;ERROR;DOMEIN1;nwcuser99;0;4056;ProcessLogoff: Profile directory could not be read from registry for user with SID <S-1-5-21-1202660629-764733703-725345543-38447> because: Het systeem kan het opgegeven bestand niet vinden.
2010-07-16;11:43:40.351;INFORMATION;DOMEIN1;nwcuser99;0;4056;DispatchLogonLogoff: ---------- Finished logoff processing successfully in : <0.14>.

(the because translated from dutch to english is: system cannot find the file specified)



Link to comment
  • 0

We already solved this issue (well ... most of it).

In our case we identified an application that didn't close normally when the user wanted to logoff. Then, we wrote a logoff script to send a kill (sysinternal's pskill) to this application. This reduced about 98% of corruption events.

We still have some cases where ntuser.dar gets corrupted. We're implementing AppSense to solve these issues.

Hope this helps!

Link to comment
  • 0

Since a couple of weeks this problem is now solved for us. The problem was only there when we used XenDesktop\Provisioning with writecache in RAM. Since we changed this back to writecache on clients harddisk the problem was gone. After all we still want to write our cache in RAM so Citrix is still investigating this issue.

I'll let you know when we have something new.

Link to comment
  • 0

Sorry to dig up and old thread but recently I am seeing a very large number of corrupt profiles and wondering if you could point me in the direction of how to diagnose this?


Our Setup:

DDC's are 5.5

PVS Servers are 6.1

Web Interface's are 5.4

Single fileserver with profiles and user data stored on the same server (7Tb of data total) 

Everything is running on VMware VM's - vShpere 5

Symantec Endpoint 12.1 is installed to VDA's and all servers

We are using UPM 5.1


Case is open with Citrix but we are not making any progress and we have not been instructed on how we can diagnose this problem. Our UPM logs are being saved to the WriteCache drive of the VDA's but we do not know how to tell what VM the user was last logged in to that would have corrupted the ntuser.dat.


Any assistance appreciated

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...