We have a Windows 2012 R2 RDS running as a virtual machine. From time to time, no specific shedule identifiable, a user session will be redirected to a temporary profile.

Whenever this happens we can observe a sharing violation on NTUSER.DAT on User loggon. I have added a screenshot of the ProcMon Output and blurred user names and IP-adresses for privacy reasons. All output on this screenshot is regarding the same user.

ProcessMonitor Output
(Click image to enlarge)

The issue is solved after the server is rebooted and all users can login just fine until this happens again. There are no handles on the users NTUSER.DAT file when he is not logged on, so no other process is locking the file in the background - it first gets opened / used when the user logs on to the server via RDP.

When the session is redirected we get the following output on "whoami" and "set":



Again, I replaced the domain and user name.

Rebooting the server when this problem occurs is not an option since there are other users logged on to this remote desktop server, who have not yet encountered this problem.

What is the best way to get a clue on why there is a sharing violation at logon?

  • Can you please send us some more details to hueiwang﹫microsoft.com, catalda﹫microsoft.com and niraja﹫microsoft.com - we are engineers working on this and will be in touch with you to try to set up a repro. Thanks! – cdavid Oct 22 '15 at 16:56
  • Hi David, what details exactly are you interessted in? As I said, we cannot reproduce this issue on purpose and it happens only every 2-3 weeks, but next time it happens I will collect all the data you need. – HannesS Oct 26 '15 at 8:23
  • I am reaching out to my colleagues to ask for detailed steps to gather logs. – cdavid Oct 26 '15 at 22:29
  • 1
    We would need traces from sessenv, winlogon, sdclient, tssdjet, terminal services. For winlogon: reg add HKLM\System\CurrentControlSet\Control\Winlogon /v TracingControlLevel /t REG_DWORD /d 0xffffffff. For TS: HKLM\System\CurrentControlSet\Control\Terminal Server\Debug REG_DWORD 0x1 and HKLM\System\CurrentControlSet\Control\Terminal Server\DebugFlags REG_DWORD 0xFFFFFFFF and HKLM\System\CurrentControlSet\Control\Terminal Server\DebugLevel REG_DWORD 0xFFFFFFFF. – cdavid Nov 3 '15 at 22:17
  • 1
    The winlogon trace is umstart*.etl at c:\windows or c:\windows\system32. For TS, trace is at C:\Windows\System32\LogFiles\WMI\*terminal-service*.etl – cdavid Nov 3 '15 at 22:18

Open regedit on that server and look for that user in the Profile list under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ that users profile should have a .bak and the end of it. Delete that key. Then have user login again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.