We have a Windows 2012 R2 RDS running as a virtual machine. From time to time, no specific shedule identifiable, a user session will be redirected to a temporary profile.
Whenever this happens we can observe a sharing violation on NTUSER.DAT on User loggon. I have added a screenshot of the ProcMon Output and blurred user names and IP-adresses for privacy reasons. All output on this screenshot is regarding the same user.
The issue is solved after the server is rebooted and all users can login just fine until this happens again. There are no handles on the users NTUSER.DAT file when he is not logged on, so no other process is locking the file in the background - it first gets opened / used when the user logs on to the server via RDP.
When the session is redirected we get the following output on "whoami" and "set":
C:\Windows\System32>whoami domain\user C:\Windows\System32>set ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\TEMP\AppData\Roaming HOMEPATH=\Users\TEMP LOCALAPPDATA=C:\Users\TEMP\AppData\Local TEMP=C:\Users\TEMP\AppData\Local\Temp\3 TMP=C:\Users\TEMP\AppData\Local\Temp\3 USERDNSDOMAIN=domain.LOCAL USERDOMAIN=domain USERDOMAIN_ROAMINGPROFILE=domain USERNAME=user USERPROFILE=C:\Users\TEMP
Again, I replaced the domain and user name.
Rebooting the server when this problem occurs is not an option since there are other users logged on to this remote desktop server, who have not yet encountered this problem.
What is the best way to get a clue on why there is a sharing violation at logon?