Jump to content
Welcome to our new Citrix community!
  • 0

Citrix VDA 1906 - Local user profiles not deleted on log off due to NTUSER.dat being in use


Patrick Nordmyr

Question

Hi,

 

We're having a issue with a server running VDA 1906 on Windows Server 2012 R2.

What happens is that the server is operating normally, but suddenly we have users who are struggling with their profile. They're suddenly  logged off the server, and when they log on again they're having profile issues.  This issue does not affect all users, only some. 

 

When the user is logged off their local profile under C:\users is not deleted. I cannot delete it manually either due to files being locked. The files that are left in the users folder are the following:

AppData\Local\Microsoft\windows\UsrClass.dat

AppData\Local\Microsoft\Credentials
AppData\Roaming\Microsoft\Credentials

 

I cannot access either of the Credentials folders as i just get "Access denied". 

 

When checking the UPM logs i can see that during logoff, it tries to delete the ntuser.dat file several times but eventually gives up because the file is in use:

2019-10-23;13:02:27.473;INFORMATION;;;31;36540;DispatchLogonLogoff: ---------- Starting logoff processing...
2019-10-23;13:02:27.473;INFORMATION;SENTER;135karste;31;36540;DispatchLogonLogoff: Session is a console session.
2019-10-23;13:02:27.473;INFORMATION;SENTER;135karste;31;36540;DispatchLogonLogoff: UserSID = S-1-5-21-4265026867-2607109296-3072421796-10718
2019-10-23;13:02:27.473;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Updating Perfmon Logoff Counters failed.
2019-10-23;13:02:27.522;INFORMATION;SENTER;135karste;31;36540;SessionCount::RealTimeCount - User: 135karste, Domain: SENTER, Session Count: 0.
2019-10-23;13:02:27.523;INFORMATION;SENTER;135karste;31;36540;ProcessLogoff: Profile directory read from registry: C:\Users\135karste
2019-10-23;13:02:27.523;ERROR;SENTER;135karste;31;36540;CRegistryHive::Load: RegLoadKey of <C:\Users\135karste\NTUSER.DAT> to <upm_S-1-5-21-4265026867-2607109296-3072421796-10718_logoff> failed with: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:27.523;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Failed to open registry file NTUSER.DAT for cross-platform processing during logoff. Error 0x20: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:27.727;ERROR;SENTER;135karste;31;36540;CRegistryHive::Load: RegLoadKey of <C:\Users\135karste\NTUSER.DAT> to <upm_S-1-5-21-4265026867-2607109296-3072421796-10718_logoff> failed with: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:27.727;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Failed to open registry file NTUSER.DAT for cross-platform processing during logoff. Error 0x20: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:27.928;ERROR;SENTER;135karste;31;36540;CRegistryHive::Load: RegLoadKey of <C:\Users\135karste\NTUSER.DAT> to <upm_S-1-5-21-4265026867-2607109296-3072421796-10718_logoff> failed with: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:27.928;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Failed to open registry file NTUSER.DAT for cross-platform processing during logoff. Error 0x20: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:28.129;ERROR;SENTER;135karste;31;36540;CRegistryHive::Load: RegLoadKey of <C:\Users\135karste\NTUSER.DAT> to <upm_S-1-5-21-4265026867-2607109296-3072421796-10718_logoff> failed with: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:28.129;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Failed to open registry file NTUSER.DAT for cross-platform processing during logoff. Error 0x20: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:28.330;ERROR;SENTER;135karste;31;36540;CRegistryHive::Load: RegLoadKey of <C:\Users\135karste\NTUSER.DAT> to <upm_S-1-5-21-4265026867-2607109296-3072421796-10718_logoff> failed with: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:28.330;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Failed to open registry file NTUSER.DAT for cross-platform processing during logoff. Error 0x20: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:28.531;ERROR;SENTER;135karste;31;36540;CRegistryHive::Load: RegLoadKey of <C:\Users\135karste\NTUSER.DAT> to <upm_S-1-5-21-4265026867-2607109296-3072421796-10718_logoff> failed with: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:28.531;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Failed to open registry file NTUSER.DAT for cross-platform processing during logoff. Error 0x20: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:28.732;ERROR;SENTER;135karste;31;36540;CRegistryHive::Load: RegLoadKey of <C:\Users\135karste\NTUSER.DAT> to <upm_S-1-5-21-4265026867-2607109296-3072421796-10718_logoff> failed with: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:28.732;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Failed to open registry file NTUSER.DAT for cross-platform processing during logoff. Error 0x20: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:28.933;ERROR;SENTER;135karste;31;36540;CRegistryHive::Load: RegLoadKey of <C:\Users\135karste\NTUSER.DAT> to <upm_S-1-5-21-4265026867-2607109296-3072421796-10718_logoff> failed with: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:28.933;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Failed to open registry file NTUSER.DAT for cross-platform processing during logoff. Error 0x20: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:29.135;ERROR;SENTER;135karste;31;36540;CRegistryHive::Load: RegLoadKey of <C:\Users\135karste\NTUSER.DAT> to <upm_S-1-5-21-4265026867-2607109296-3072421796-10718_logoff> failed with: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:29.135;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Failed to open registry file NTUSER.DAT for cross-platform processing during logoff. Error 0x20: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:29.336;ERROR;SENTER;135karste;31;36540;CRegistryHive::Load: RegLoadKey of <C:\Users\135karste\NTUSER.DAT> to <upm_S-1-5-21-4265026867-2607109296-3072421796-10718_logoff> failed with: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:29.336;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Failed to open registry file NTUSER.DAT for cross-platform processing during logoff. Error 0x20: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:29.537;ERROR;SENTER;135karste;31;36540;CRegistryHive::Load: RegLoadKey of <C:\Users\135karste\NTUSER.DAT> to <upm_S-1-5-21-4265026867-2607109296-3072421796-10718_logoff> failed with: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:29.537;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Failed to open registry file NTUSER.DAT for cross-platform processing during logoff. Error 0x20: The process cannot access the file because it is being used by another process.
2019-10-23;13:02:29.738;INFORMATION;SENTER;135karste;31;36540;ProcessLogoff: Performing Cross Platform logoff processing
2019-10-23;13:02:29.738;ERROR;SENTER;135karste;31;36540;ProcessLogoff: Cross Platform initialisation failed with: The process cannot access the file because it is being used by another process.

 

 

Upon checking the server with Process Monitor while the user is logged off it looks like the file is being held onto by UserProfileManager.exe

image.thumb.png.c8d286a436afed6553c588c85bed7ad3.png

 

So far i've tried the following to resolve this issue after doing some googling:


Restart Citrix Profile Management
Enabled "Delay before deleting cached profiles" and set it to 60 seconds 

Checked for corrupt (.bak) profiles in regedit

 

Restarting the server resolves this issue, but we would love a permanent fix for this since the issue has occured twice the last week. Does anyone have any suggestions? 

 

 

Link to comment

6 answers to this question

Recommended Posts

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...