Archives for posts with tag: Roaming Profile

I had a client call in about their Xenapp users getting temporary profiles. I logged into the Application Servers and found lots of event ids 1508 , 1502, 1511, and 1500.

“Windows is unable to load the registry. This problem is often caused by insufficient memory or insufficient security rights.”

After investigating the problem and checking all the obvious things like space, security permissions, etc… I found the problem to be the Registry Hive on the Application Server was extremely bloated. Digging deeper I found the users Roaming profiles had an NTUSER.DAT file anywhere from 250MB to 800MB.

To find out what was bloating the NTUSER.DAT file, I rebooted the Application Server so no users were connected. Logged in with a user with a large NTUSER.DAT file and opened Regedit. Investigated the “HKEY_CURRENT_USER” key and exported HKEY_CURRENT_USER\Printers and HKEY_CURRENT_USER\Software. Looking at the size of the two exported files I noticed that HKEY_CURRENT_USER\Software was where the problem was as that file was 2GB in size. I began drilling further down specifically looking at printer manufacturers and issues with Universal Print Drivers. Exported each of the main printer companies HKEY_CURRENT_USER\Software\Hewlett-Packard , HKEY_CURRENT_USER\Software\Ricoh , HKEY_CURRENT_USER\Software\Konica Minolta , etc… I compared the file sizes of each and drilled down into each one individually to see which drivers were being loaded. Found several drivers that we no longer needed so I searched for a way to remove them from all the users NTUSER.DAT files.

I came across this link

https://www.experts-exchange.com/questions/27668833/Tool-for-Compacting-offline-registry.html

and Lester Clayton was able to write an application that did exactly that and you can download it from here

http://www.nsasp.net/CompactRegistryFile.zip

Next I made notes of all the drivers and items that I could clear out of the HKEY_CURRENT_USER registry (NTUSER.DAT).

Executed the removal by using the following commands

CompactRegistryFile.exe “C:\Profiles\USERNAME.V2\ntuser.dat” “software\KONICA MINOLTA\KONICA MINOLTA Universal PCL”

CompactRegistryFile.exe “C:\Profiles\USERNAME.V2\ntuser.dat” “software\KONICA MINOLTA\KONICA MINOLTA 554eSeriesPS”

CompactRegistryFile.exe “C:\Profiles\USERNAME.V2\ntuser.dat” “software\KONICA MINOLTA\KONICA MINOLTA C360SeriesPCL”

CompactRegistryFile.exe “C:\Profiles\USERNAME.V2\ntuser.dat” “software\KONICA MINOLTA\KONICA MINOLTA C360SeriesPS”

CompactRegistryFile.exe “C:\Profiles\USERNAME.V2\ntuser.dat” “software\KONICA MINOLTA\KONICA MINOLTA C364SeriesPCL”

CompactRegistryFile.exe “C:\Profiles\USERNAME.V2\ntuser.dat” “software\KONICA MINOLTA\KONICA MINOLTA C368SeriesPCL”

CompactRegistryFile.exe “C:\Profiles\USERNAME.V2\ntuser.dat” “software\KONICA MINOLTA\KONICA MINOLTA C652SeriesPCL”

 

Once that completed my NTUSER.DAT files were down to anywhere from 4MB to 26MB

Lastly I downloaded SYSInternals suite and ran the following commands to compress NTUSER.DAT even further

ru -h C:\Profiles\USERNAME.V2\ntuser.dat

Advertisements

Used this script to take ownership of profile folders and restore users access so it doesn’t break the roaming profile

takeown /F E:\Share\Profiles\USER /R /D Y
icacls “E:\Share\Profiles\USER” /reset /T
icacls “E:\Share\Profiles\USER” /grant:r “DOMAINNAME\Domain Admins”:(OI)(CI)F
icacls “E:\Share\Profiles\USER” /grant:r “System”:(OI)(CI)F
icacls “E:\Share\Profiles\USER” /grant:r “DomainName\User”:(OI)(CI)F
icacls “E:\Share\Profiles\USER” /setowner “DomainName\User” /T