locked
Corruption of User Roaming Profile (Ntuser.dat) with Event Error 1542 RRS feed

  • Question

  • A number of my users are randomly corrupting their roaming profiles. There appears to be no set pattern and it can happen either following logoff or even when they are logged on.

    They all have Win7 SP1.

    I know how to reset and fix the corrupted profile, but I want to understand what the best course of action to establish the root cause of the corruption.

    There is a hot fix KB2918893 which claims to prevent the issue, however I have found profiles corrupting with or without that patch installed.

    There always appears to be some associated Application EventLog entries as follows:

    EventID 6001 - Warning - Microsoft-Windows-Winlogon - The winlogon notification subscriber <sens> failed a notification event

    EventID 6004 - Warning - Microsoft-Windows-Winlogon - The winlogon notification subscriber <GPClient> failed a critical notification event.

    EventID 6006 - Warning - Microsoft-Windows-Winlogon - The winlogon notification subscriber <profiles> took 78 second(s) to handle the notification event (logon)

    Many Thanks

    Many Thanks

     
    Wednesday, November 9, 2016 4:55 PM

All replies

  • Hi jerryke01,

    When did the issue start to occur? Did the issue only occur with the specific machines, specific users, all the machines or all the users?

    For a random issue, it is hard to troubleshoot it. Because it is hard to re-produce it. If it is available to reproduce it, we could use the following logman command line to collect more information to analyze the issue.
    Start the log:
    "logman -start profiletrace -p {eb7428f5-ab1f-4322-a4cc-1f1a9b2c5e98} 255 3 -ets"
    Stop the log:
    "logman -stop profiletrace -ets“
    Log location:
    profiletrace.etl will be located in the directory that logman -start was run


    Anyway, I found a similar case. We may try the solution in it(Dale Qiao`s reply).
    Event id 1542, User Profile Service and Missing Classes Root Key
    https://social.technet.microsoft.com/Forums/windows/en-US/e492a389-0f70-420b-9d1e-2a286beac698/event-id-1542-user-profile-service-and-missing-classes-root-key?forum=w7itproinstall

    Best regards


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, November 11, 2016 1:49 AM
  • Thanks for the reply, I will review and report back..
    Friday, November 11, 2016 2:57 PM
  • Hi,

    How about the issue, is there anything to update?

    Best regards


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, November 18, 2016 7:23 AM
  • Have been tied up in other areas, since I reported this issue. Still have the issue and will work though the previous post and update soon.
    Monday, December 5, 2016 10:47 AM
  • Still unable to ascertain what is causing the profile corruption. Have noticed that on each occasion the Ntuser.dat file reduces to 256KBs in size and upon loading in reg edit it is evident that a large number of the registry top level keys are missing.

    The only root keys that remain are Software and System. Each of these keys have virtually no data in. The only populated value is in Software - Windows NT - CurrentVersion - Winlogon - BuildNumber (Binary Value 0x000001kb1 (7601)).

    Any Ideas?

    Friday, January 13, 2017 12:17 PM
  • Hi jerryke01,

    Have you tried to capture the log file?

    If you have troubles in analyzing the log, please upload the log to OneDrive and paste the link here. We will try our best to analyze the issue for you.

    Best regards


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, January 16, 2017 9:44 AM
  • Capturing the log file will only be useful if the profile corruption event occurs, I don't want to enable the log capture on all my users.

    The profile corruption occurs on a very sporadic basis and has not yet effected the same user twice following a profile reset.

    I posted on here in the hope that somebody had experienced the very same issue before and had established the root cause.



    Monday, January 23, 2017 10:42 AM