Hey,
We have a very random issue where Offline Files sometimes flags up 'Access denied' and users can only see the local cache copy of network drives.
After a few reboots it just seems to fix itself. We actually set slow-link mode too and this made me think it was some of the issue, but the offline files operational log doesn't not show anything untoward.
For a user that had 'access denied' yesterday, but is totally fine today:
Log Name: Microsoft-Windows-OfflineFiles/Operational
Source: Microsoft-Windows-OfflineFiles
Date: 17/07/2018 17:24:28
Event ID: 8
Task Category: None
Level: Information
Keywords: User logon/logoff
User: SYSTEM
Computer: XXX-SURFACE.corp.domain.com
Description:
User logoff detected
Account: domain\username
Session: 7
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
<EventID>8</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000008</Keywords>
<TimeCreated SystemTime="2018-07-17T16:24:28.403226200Z" />
<EventRecordID>3666</EventRecordID>
<Correlation />
<Execution ProcessID="2592" ThreadID="6624" />
<Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
<Computer>XXX-SURFACE.corp.domain.com</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Info xmlns="UserSessionNs">
<Account>domain\username</Account>
<Session>7</Session>
</Info>
</UserData>
</Event>
Log Name: Microsoft-Windows-OfflineFiles/Operational
Source: Microsoft-Windows-OfflineFiles
Date: 17/07/2018 16:01:02
Event ID: 1002
Task Category: None
Level: Information
Keywords: Background sync
User: domain\username
Computer: XXX-SURFACE.corp.domain.com
Description:
Background Synchronization executed successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
<EventID>1002</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000200</Keywords>
<TimeCreated SystemTime="2018-07-17T15:01:02.292615700Z" />
<EventRecordID>3665</EventRecordID>
<Correlation />
<Execution ProcessID="14044" ThreadID="10940" />
<Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
<Computer>XXX-SURFACE.corp.domain.com</Computer>
<Security UserID="S-1-5-21-360188567-1847476015-1310766017-82110" />
</System>
<EventData>
</EventData>
</Event>
Log Name: Microsoft-Windows-OfflineFiles/Operational
Source: Microsoft-Windows-OfflineFiles
Date: 17/07/2018 14:42:12
Event ID: 1002
Task Category: None
Level: Information
Keywords: Background sync
User: domain\username
Computer: XXX-SURFACE.corp.domain.com
Description:
Background Synchronization executed successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
<EventID>1002</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000200</Keywords>
<TimeCreated SystemTime="2018-07-17T13:42:12.436223000Z" />
<EventRecordID>3664</EventRecordID>
<Correlation />
<Execution ProcessID="9976" ThreadID="9824" />
<Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
<Computer>XXX-SURFACE.corp.domain.com</Computer>
<Security UserID="S-1-5-21-360188567-1847476015-1310766017-82110" />
</System>
<EventData>
</EventData>
</Event>
Log Name: Microsoft-Windows-OfflineFiles/Operational
Source: Microsoft-Windows-OfflineFiles
Date: 17/07/2018 14:36:23
Event ID: 7
Task Category: None
Level: Information
Keywords: User logon/logoff
User: SYSTEM
Computer: XXX-SURFACE.corp.domain.com
Description:
User logon detected
Account: domain\username
Session: 7
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
<EventID>7</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000008</Keywords>
<TimeCreated SystemTime="2018-07-17T13:36:23.555582900Z" />
<EventRecordID>3663</EventRecordID>
<Correlation />
<Execution ProcessID="2592" ThreadID="10996" />
<Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
<Computer>XXX-SURFACE.corp.domain.com</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Info xmlns="UserSessionNs">
<Account>domain\username</Account>
<Session>7</Session>
</Info>
</UserData>
</Event>
Log Name: Microsoft-Windows-OfflineFiles/Operational
Source: Microsoft-Windows-OfflineFiles
Date: 17/07/2018 14:34:50
Event ID: 8
Task Category: None
Level: Information
Keywords: User logon/logoff
User: SYSTEM
Computer: XXX-SURFACE.corp.domain.com
Description:
User logoff detected
Account: domain\username
Session: 6
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
<EventID>8</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000008</Keywords>
<TimeCreated SystemTime="2018-07-17T13:34:50.291909500Z" />
<EventRecordID>3662</EventRecordID>
<Correlation />
<Execution ProcessID="2592" ThreadID="14600" />
<Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
<Computer>XXX-SURFACE.corp.domain.com</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Info xmlns="UserSessionNs">
<Account>domain\username</Account>
<Session>6</Session>
</Info>
</UserData>
</Event>
Log Name: Microsoft-Windows-OfflineFiles/Operational
Source: Microsoft-Windows-OfflineFiles
Date: 17/07/2018 12:30:51
Event ID: 1002
Task Category: None
Level: Information
Keywords: Background sync
User: domain\username
Computer: XXX-SURFACE.corp.domain.com
Description:
Background Synchronization executed successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
<EventID>1002</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000200</Keywords>
<TimeCreated SystemTime="2018-07-17T11:30:51.488904200Z" />
<EventRecordID>3661</EventRecordID>
<Correlation />
<Execution ProcessID="13420" ThreadID="2492" />
<Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
<Computer>XXX-SURFACE.corp.domain.com</Computer>
<Security UserID="S-1-5-21-360188567-1847476015-1310766017-82110" />
</System>
<EventData>
</EventData>
</Event>
Log Name: Microsoft-Windows-OfflineFiles/Operational
Source: Microsoft-Windows-OfflineFiles
Date: 17/07/2018 10:50:04
Event ID: 1002
Task Category: None
Level: Information
Keywords: Background sync
User: domain\username
Computer: XXX-SURFACE.corp.domain.com
Description:
Background Synchronization executed successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
<EventID>1002</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000200</Keywords>
<TimeCreated SystemTime="2018-07-17T09:50:04.218079200Z" />
<EventRecordID>3660</EventRecordID>
<Correlation />
<Execution ProcessID="8684" ThreadID="10084" />
<Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
<Computer>XXX-SURFACE.corp.domain.com</Computer>
<Security UserID="S-1-5-21-360188567-1847476015-1310766017-82110" />
</System>
<EventData>
</EventData>
</Event>
Log Name: Microsoft-Windows-OfflineFiles/Operational
Source: Microsoft-Windows-OfflineFiles
Date: 17/07/2018 10:47:13
Event ID: 7
Task Category: None
Level: Information
Keywords: User logon/logoff
User: SYSTEM
Computer: XXX-SURFACE.corp.domain.com
Description:
User logon detected
Account: domain\username
Session: 6
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
<EventID>7</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000008</Keywords>
<TimeCreated SystemTime="2018-07-17T09:47:13.478449600Z" />
<EventRecordID>3659</EventRecordID>
<Correlation />
<Execution ProcessID="2592" ThreadID="14532" />
<Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
<Computer>XXX-SURFACE.corp.domain.com</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Info xmlns="UserSessionNs">
<Account>domain\username</Account>
<Session>6</Session>
</Info>
</UserData>
</Event>
Log Name: Microsoft-Windows-OfflineFiles/Operational
Source: Microsoft-Windows-OfflineFiles
Date: 17/07/2018 10:47:10
Event ID: 9
Task Category: None
Level: Information
Keywords: Online/offline transitions
User: SYSTEM
Computer: XXX-SURFACE.corp.domain.com
Description:
Path disconnected.
\\corp.domain.com\corp-file-01\Public
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
<EventID>9</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000002</Keywords>
<TimeCreated SystemTime="2018-07-17T09:47:10.650665800Z" />
<EventRecordID>3658</EventRecordID>
<Correlation />
<Execution ProcessID="2592" ThreadID="2812" />
<Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
<Computer>XXX-SURFACE.corp.domain.com</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Info xmlns="SinglePathArgNs">
<Path>\\corp.domain.com\corp-file-01\Public</Path>
</Info>
</UserData>
</Event>
Log Name: Microsoft-Windows-OfflineFiles/Operational
Source: Microsoft-Windows-OfflineFiles
Date: 17/07/2018 10:47:09
Event ID: 9
Task Category: None
Level: Information
Keywords: Online/offline transitions
User: SYSTEM
Computer: XXX-SURFACE.corp.domain.com
Description:
Path disconnected.
\\corp.domain.com\corp-file-01\Users
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
<EventID>9</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000002</Keywords>
<TimeCreated SystemTime="2018-07-17T09:47:09.070977800Z" />
<EventRecordID>3657</EventRecordID>
<Correlation />
<Execution ProcessID="2592" ThreadID="2812" />
<Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
<Computer>XXX-SURFACE.corp.domain.com</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Info xmlns="SinglePathArgNs">
<Path>\\corp.domain.com\corp-file-01\Users</Path>
</Info>
</UserData>
</Event>