Question : How to resolve Event IDs 1508, 1502, 1515, 1511

I have an issue with multiple users (not all) on TS 2003 R2. In the morning, when they try to log in, the system logs them into a tempory profile.  After rebooting server, these users can log with their profile.  My server reboots every night around 3 a.m. - but I still have to do a manual reboot of it first thing in the morning to allow these users to log in with their profiles.  In the event viewer, i find the follow errors: (using one profile as example)

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1508
Date:            12/12/2008
Time:            6:52:54 AM
User:            NT AUTHORITY\SYSTEM
Computer:      HSIWIN
Description:
Windows was unable to load the registry. This is often caused by insufficient memory or insufficient security rights.
 DETAIL - The process cannot access the file because it is being used by another process.  for C:\Documents and Settings\john\ntuser.dat

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1502
Date:            12/12/2008
Time:            6:53:14 AM
User:            HOWARDSHEPPARD\john
Computer:      HSIWIN
Description:
Windows cannot load the locally stored profile. Possible causes of this error include insufficient security rights or a corrupt local profile. If this problem persists, contact your network administrator.
 DETAIL - The process cannot access the file because it is being used by another process.

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1515
Date:            12/12/2008
Time:            6:53:14 AM
User:            HOWARDSHEPPARD\john
Computer:      HSIWIN
Description:
Windows has backed up this user's profile. Windows will automatically try to use the backed up profile the next time this user logs on.

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1511
Date:            12/12/2008
Time:            6:53:15 AM
User:            HOWARDSHEPPARD\john
Computer:      HSIWIN
Description:
Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.

I have deleted & recreated all the user profiles that are affected, but it does not seem to matter. I still have to reboot.   This particular user is normally one of the first to log on, so I know it's not related to the number of users logged on at the time.
As far as I know my system has not changed ....  this particular problem just started occuring this week (specifically on 12/07/2008) - prior to that we had no issues.
Can someone please help?

Answer : How to resolve Event IDs 1508, 1502, 1515, 1511

Below is the answer which finally resolved my issue:

This can happen if some users ProfileImagePath registries are duplicated with other users' ProfileImagePath. To resolve the issue, perform the following steps:
1. Run "WHOAMI /USER /SID" to determine the users correct SID.
If you do not have the whoami command tool, you can download and install it from the link below.
Note: By default, it will install to the C:\Program files\Resource Kit folder. To run it, go to a command prompt and change the path to C:\Program Files\Resource Kit. Then type "whoami /USER /SID" (without quotes) and press Enter. It should display the current users name and SID.
2. Check the ProfileImagePath value under the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\.
Note down this ProfileImagePath value.
3. Check the other ProfileList\ keys for matching ProfileImagePath values and deleted those keys.
Note: Please make sure you have backed up the registry key before you delete them.
4. Test and see if the problem is fixed.
Did you manually move your users' profiles to another drive? If you have moved the Documents and Settings folder, it will lead to the issue. Microsoft does not support moving the Documents and Settings folder in Windows Server 2003 or Windows XP to another drive. Although you can try the steps in M236621, Microsoft provides it for informational purposes only.
Random Solutions  
 
programming4us programming4us