DFS, Offline Files, Access Denied

Hey,

We have a very random issue where Offline Files sometimes flags up 'Access denied' and users can only see the local cache copy of network drives.

After a few reboots it just seems to fix itself. We actually set slow-link mode too and this made me think it was some of the issue, but the offline files operational log doesn't not show anything untoward.

For a user that had 'access denied' yesterday, but is totally fine today:

Log Name:      Microsoft-Windows-OfflineFiles/Operational
Source:        Microsoft-Windows-OfflineFiles
Date:          17/07/2018 17:24:28
Event ID:      8
Task Category: None
Level:         Information
Keywords:      User logon/logoff
User:          SYSTEM
Computer:      XXX-SURFACE.corp.domain.com
Description:
User logoff detected
Account: domain\username
Session: 7
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
    <EventID>8</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000008</Keywords>
    <TimeCreated SystemTime="2018-07-17T16:24:28.403226200Z" />
    <EventRecordID>3666</EventRecordID>
    <Correlation />
    <Execution ProcessID="2592" ThreadID="6624" />
    <Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
    <Computer>XXX-SURFACE.corp.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <Info xmlns="UserSessionNs">
      <Account>domain\username</Account>
      <Session>7</Session>
    </Info>
  </UserData>
</Event>

Log Name:      Microsoft-Windows-OfflineFiles/Operational
Source:        Microsoft-Windows-OfflineFiles
Date:          17/07/2018 16:01:02
Event ID:      1002
Task Category: None
Level:         Information
Keywords:      Background sync
User:          domain\username
Computer:      XXX-SURFACE.corp.domain.com
Description:
Background Synchronization executed successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
    <EventID>1002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000200</Keywords>
    <TimeCreated SystemTime="2018-07-17T15:01:02.292615700Z" />
    <EventRecordID>3665</EventRecordID>
    <Correlation />
    <Execution ProcessID="14044" ThreadID="10940" />
    <Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
    <Computer>XXX-SURFACE.corp.domain.com</Computer>
    <Security UserID="S-1-5-21-360188567-1847476015-1310766017-82110" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-OfflineFiles/Operational
Source:        Microsoft-Windows-OfflineFiles
Date:          17/07/2018 14:42:12
Event ID:      1002
Task Category: None
Level:         Information
Keywords:      Background sync
User:          domain\username
Computer:      XXX-SURFACE.corp.domain.com
Description:
Background Synchronization executed successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
    <EventID>1002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000200</Keywords>
    <TimeCreated SystemTime="2018-07-17T13:42:12.436223000Z" />
    <EventRecordID>3664</EventRecordID>
    <Correlation />
    <Execution ProcessID="9976" ThreadID="9824" />
    <Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
    <Computer>XXX-SURFACE.corp.domain.com</Computer>
    <Security UserID="S-1-5-21-360188567-1847476015-1310766017-82110" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-OfflineFiles/Operational
Source:        Microsoft-Windows-OfflineFiles
Date:          17/07/2018 14:36:23
Event ID:      7
Task Category: None
Level:         Information
Keywords:      User logon/logoff
User:          SYSTEM
Computer:      XXX-SURFACE.corp.domain.com
Description:
User logon detected
Account: domain\username
Session: 7
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
    <EventID>7</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000008</Keywords>
    <TimeCreated SystemTime="2018-07-17T13:36:23.555582900Z" />
    <EventRecordID>3663</EventRecordID>
    <Correlation />
    <Execution ProcessID="2592" ThreadID="10996" />
    <Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
    <Computer>XXX-SURFACE.corp.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <Info xmlns="UserSessionNs">
      <Account>domain\username</Account>
      <Session>7</Session>
    </Info>
  </UserData>
</Event>

Log Name:      Microsoft-Windows-OfflineFiles/Operational
Source:        Microsoft-Windows-OfflineFiles
Date:          17/07/2018 14:34:50
Event ID:      8
Task Category: None
Level:         Information
Keywords:      User logon/logoff
User:          SYSTEM
Computer:      XXX-SURFACE.corp.domain.com
Description:
User logoff detected
Account: domain\username
Session: 6
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
    <EventID>8</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000008</Keywords>
    <TimeCreated SystemTime="2018-07-17T13:34:50.291909500Z" />
    <EventRecordID>3662</EventRecordID>
    <Correlation />
    <Execution ProcessID="2592" ThreadID="14600" />
    <Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
    <Computer>XXX-SURFACE.corp.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <Info xmlns="UserSessionNs">
      <Account>domain\username</Account>
      <Session>6</Session>
    </Info>
  </UserData>
</Event>

Log Name:      Microsoft-Windows-OfflineFiles/Operational
Source:        Microsoft-Windows-OfflineFiles
Date:          17/07/2018 12:30:51
Event ID:      1002
Task Category: None
Level:         Information
Keywords:      Background sync
User:          domain\username
Computer:      XXX-SURFACE.corp.domain.com
Description:
Background Synchronization executed successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
    <EventID>1002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000200</Keywords>
    <TimeCreated SystemTime="2018-07-17T11:30:51.488904200Z" />
    <EventRecordID>3661</EventRecordID>
    <Correlation />
    <Execution ProcessID="13420" ThreadID="2492" />
    <Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
    <Computer>XXX-SURFACE.corp.domain.com</Computer>
    <Security UserID="S-1-5-21-360188567-1847476015-1310766017-82110" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-OfflineFiles/Operational
Source:        Microsoft-Windows-OfflineFiles
Date:          17/07/2018 10:50:04
Event ID:      1002
Task Category: None
Level:         Information
Keywords:      Background sync
User:          domain\username
Computer:      XXX-SURFACE.corp.domain.com
Description:
Background Synchronization executed successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
    <EventID>1002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000200</Keywords>
    <TimeCreated SystemTime="2018-07-17T09:50:04.218079200Z" />
    <EventRecordID>3660</EventRecordID>
    <Correlation />
    <Execution ProcessID="8684" ThreadID="10084" />
    <Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
    <Computer>XXX-SURFACE.corp.domain.com</Computer>
    <Security UserID="S-1-5-21-360188567-1847476015-1310766017-82110" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-OfflineFiles/Operational
Source:        Microsoft-Windows-OfflineFiles
Date:          17/07/2018 10:47:13
Event ID:      7
Task Category: None
Level:         Information
Keywords:      User logon/logoff
User:          SYSTEM
Computer:      XXX-SURFACE.corp.domain.com
Description:
User logon detected
Account: domain\username
Session: 6
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
    <EventID>7</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000008</Keywords>
    <TimeCreated SystemTime="2018-07-17T09:47:13.478449600Z" />
    <EventRecordID>3659</EventRecordID>
    <Correlation />
    <Execution ProcessID="2592" ThreadID="14532" />
    <Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
    <Computer>XXX-SURFACE.corp.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <Info xmlns="UserSessionNs">
      <Account>domain\username</Account>
      <Session>6</Session>
    </Info>
  </UserData>
</Event>

Log Name:      Microsoft-Windows-OfflineFiles/Operational
Source:        Microsoft-Windows-OfflineFiles
Date:          17/07/2018 10:47:10
Event ID:      9
Task Category: None
Level:         Information
Keywords:      Online/offline transitions
User:          SYSTEM
Computer:      XXX-SURFACE.corp.domain.com
Description:
Path disconnected.
\\corp.domain.com\corp-file-01\Public
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
    <EventID>9</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000002</Keywords>
    <TimeCreated SystemTime="2018-07-17T09:47:10.650665800Z" />
    <EventRecordID>3658</EventRecordID>
    <Correlation />
    <Execution ProcessID="2592" ThreadID="2812" />
    <Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
    <Computer>XXX-SURFACE.corp.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <Info xmlns="SinglePathArgNs">
      <Path>\\corp.domain.com\corp-file-01\Public</Path>
    </Info>
  </UserData>
</Event>

Log Name:      Microsoft-Windows-OfflineFiles/Operational
Source:        Microsoft-Windows-OfflineFiles
Date:          17/07/2018 10:47:09
Event ID:      9
Task Category: None
Level:         Information
Keywords:      Online/offline transitions
User:          SYSTEM
Computer:      XXX-SURFACE.corp.domain.com
Description:
Path disconnected.
\\corp.domain.com\corp-file-01\Users
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-OfflineFiles" Guid="{95353826-4FBE-41D4-9C42-F521C6E86360}" />
    <EventID>9</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000002</Keywords>
    <TimeCreated SystemTime="2018-07-17T09:47:09.070977800Z" />
    <EventRecordID>3657</EventRecordID>
    <Correlation />
    <Execution ProcessID="2592" ThreadID="2812" />
    <Channel>Microsoft-Windows-OfflineFiles/Operational</Channel>
    <Computer>XXX-SURFACE.corp.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <Info xmlns="SinglePathArgNs">
      <Path>\\corp.domain.com\corp-file-01\Users</Path>
    </Info>
  </UserData>
</Event>