Background: We are a full Windows Shop with Server 2012 and 2008 R2 Domain / Virtual Servers (VMWare). DFS namespace for Folder Redirection (via GPO) of "My Documents" (Not AppData/Profile Info), Shared Drives. We use Endpoint Protection and do all of our Imaging via SCCM 2012, and are a full Windows 7 Enterprise desktop shop.
Problem: Over the past 4 months this problem has gone from once in a while to about 30-40 calls a day inconveniencing our users. It is best explained on these forums, of which I have copied and pasted to save my fingers: http://forums.anandtech.com/showthread.php?t=2251262
"One of the problems we have at my work is when a user logs on they get a red x on the network icon, but it isn't a network issue. When this happens the computer is almost unusable. You cant use things like windows explorer, or internet explorer. We know how to fix the issue, which is deleting the usrclass.dat file in the users profile. It has been suggested that SCCM could be causing the issue but i don't know. Has anybody else ran into this issue on a Windows 7 enterprise environment? I've tried googling the issue but some of the stuff is way over my head, and I dont know much about SCCM and if that is causing the issue."
Here are the Event Log ID captures:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1508</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2013-11-05T21:50:21.712962100Z" />
<EventRecordID>3302</EventRecordID>
<Correlation />
<Execution ProcessID="1000" ThreadID="1084" />
<Channel>Application</Channel>
<Computer>ABK-A23-BW87.acsd.local</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData Name="EVENT_REGLOADKEYFAILED">
<Data Name="Error">The process cannot access the file because it is being used by another process.</Data>
<Data Name="File">C:\Users\95142\AppData\Local\Microsoft\Windows\\UsrClass.dat</Data>
</EventData>
</Event>
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1542</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2013-11-05T21:50:21.712962100Z" />
<EventRecordID>3303</EventRecordID>
<Correlation />
<Execution ProcessID="1000" ThreadID="1084" />
<Channel>Application</Channel>
<Computer>ABK-A23-BW87.acsd.local</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="Error">The process cannot access the file because it is being used by another process.</Data>
</EventData>
</Event>
Any input would be appreciated.
Notes: We originally thought it was our SCCM Image because the guy who did it did a sysprep style image, but we installed a couple of computers from the DVD and were able to make this problem happen.
We can resolve the issue by deleting the users profile, OR by deleting the UsrClass.dat file and letting it rebuild each login, however, we prefer to get to the root cause of the problem.
We've also applied the following patches to see if they would resolve the issue but it still occurs:
http://support.microsoft.com/kb/2775511/en-us
http://support.microsoft.com/kb/2444677/en-us
Thank you.