User gets logged on with temporary profile - Windows 2012 R2 RDS

Question

We have a Windows 2012 R2 RDS running as a virtual machine. From time to time, no specific shedule identifiable, a user session will be redirected to a temporary profile.

Whenever this happens we can observe a sharing violation on NTUSER.DAT on User loggon. I have added a screenshot of the ProcMon Output and blurred user names and IP-adresses for privacy reasons. All output on this screenshot is regarding the same user.

^{(Click image to enlarge)}

The issue is solved after the server is rebooted and all users can login just fine until this happens again. There are no handles on the users NTUSER.DAT file when he is not logged on, so no other process is locking the file in the background - it first gets opened / used when the user logs on to the server via RDP.

When the session is redirected we get the following output on "whoami" and "set":

C:\Windows\System32>whoami
domain\user

C:\Windows\System32>set
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\TEMP\AppData\Roaming
HOMEPATH=\Users\TEMP
LOCALAPPDATA=C:\Users\TEMP\AppData\Local
TEMP=C:\Users\TEMP\AppData\Local\Temp\3
TMP=C:\Users\TEMP\AppData\Local\Temp\3
USERDNSDOMAIN=domain.LOCAL
USERDOMAIN=domain
USERDOMAIN_ROAMINGPROFILE=domain
USERNAME=user
USERPROFILE=C:\Users\TEMP

Again, I replaced the domain and user name.

Rebooting the server when this problem occurs is not an option since there are other users logged on to this remote desktop server, who have not yet encountered this problem.

What is the best way to get a clue on why there is a sharing violation at logon?

Answer 1

Open regedit on that server and look for that user in the Profile list under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ that users profile should have a .bak and the end of it. Delete that key. Then have user login again.