none
Prevent Temp user creation in windows

    Question

  • Windows creating temp profile every time when I login to the PC. The pc has more than one user. I am facing this problem in many Windows 10 and Server 2012 PC's. The temp profile creation is not found in every user. But, in most of the cases it is there.

    The Windows 10 is the free upgraded version. Initially, the case was less. Now recently the frequency of the error is increased.

    Sometimes this will be solved if I log off and log in again. But, after 2-3 days again this repeats.

    Installed Antivirus software: Symantec Endpoint Security, Norton Security and in some PCs Windows Defender.

    I have also tried by removing all the services from ‘Services.msc’. But, not solved. I was using Windows 8 and 8.1 as Desktop OS previously and same software and hardware were being used in that also. But, this error was not found before.

     

    Tried solutions:

    Searched in the internet about the error and found some solutions but none of them worked for me.

    1] Contacted Microsoft support and they tried doing disk cleanup of C drive. 2] Deleted the temp created folder and changed the temp profile created in the registry 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList' .

    3] Enabled the "Do not log users on with temporary profiles" in the group policy as mensioned in http://serverfault.com/questions/309692/disable-temporary-user-profile-on-workstations-in-a-windows-2008-env

    All the steps done above did not work instead when I did the 3<sup>rd</sup> solution I got error when logging in saying "User Profile Service failed the sign-in. User Profile cannot be loaded." Now when I search for this error I got the same result as above mentioned options in Google.

    Please help to solve this error and prevent from happening in the future.

    Update:

    When the OS creates the temp profile I can see 2 logs written in event viewer, which says:

    1] Windows has backed up this user profile. Windows will automatically try to use the backup profile the next time this user logs on.

    2] Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.



    Update 2:

    After disc clean in windows 10, the error stopped since from 2 days but don't know whether it is the correct solution.

    Below steps are done in Windows server 2012 r2.

    • We can rule out the antivirus, because tried by uninstalling antivirus but temp profile error still repeated.

    • Deleted one user and created new profile for him but after 2 days the error repeated.

    • Edited by IT researcher Thursday, March 2, 2017 12:31 PM more findings
    Saturday, February 25, 2017 7:47 AM

All replies

  • Windows creating temp profile every time when I login to the PC.

    It may be necessary to know if roaming profiles are involved?  I know that users are saying there are still problems with them.

    For example with that focus there would be this reference

    Roaming User Profile Lost and User Left with Temporary Profile
    (BING search for
        roaming profile temporary profile site:technet.microsoft.com
    )



    Robert Aldwinckle
    ---

    Saturday, February 25, 2017 3:36 PM
  • Hi IT researcher,

    Have you deployed any gpo related to the user profile before(folder redirection or roaming profile)? Did the issue occur with a local user profile? Did the issue occur randomly or regularly?

    Please check the symptom in a clean boot environment.
    How to perform a clean boot in Windows
    https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

    To troubleshoot this issue deeply, we could try the following command line to collect more information.
    Start the log:
    "logman -start profiletrace -p {eb7428f5-ab1f-4322-a4cc-1f1a9b2c5e98} 255 3 -ets"

    Stop the log:
    "logman -stop profiletrace -ets“

    Log location:
    profiletrace.etl will be located in the directory that logman -start was run

     If you have troubles in analyzing the log, please the log to OneDrive and paste the link here.

    Best regards


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, February 27, 2017 6:00 AM
    Moderator
  • Thank you for the reply.

    No, the system or the server do not have the folder redirection or roaming profile. User profile is local. But i only redirect the desktop folder to some other drive than C by changing the value in registry.

    Yes can do the logging with logman. will update once done.

    Monday, February 27, 2017 6:45 AM
  • Ran the logman profile trace but there is no error or warnings. There is only information entries i could find and which i don't know what it is. The log file can be found at the link https://www.dropbox.com/s/uwfxsgsxd5u1a62/profiletrace_pc3.zip?dl=0
    Monday, February 27, 2017 9:36 AM
  • Hi IT researcher,

    Have you performed a clean boot? What is the RAM size of your system?

    I noticed you have installed a lot applications on the machine, please check the size of your profile. According to my research, there is a possibility that the RAM is limited while the user profile is so big to load.

    The following registry key could be used to improve the memory performance. We could modify the following registry keys then check the symptom again. Add it manually if it is not existed.
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management
    \PoolUsageMaximum

    Please backup the registry keys before we made any modifications.

    Here is a similar case for reference:
    Temp profiles for some users (Event 1508,1502,1515,1511)
    https://www.petri.com/forums/forum/microsoft-networking-services/terminal-services/54184-temp-profiles-for-some-users-event-1508-1502-1515-1511

    I noticed the issue won`t occur when we restarted the machine, please try to disable the "Fastboot" feature to force a cold boot every time then check the symptom again.

    NOTE: This response contains a reference to a third party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites.

    Best regards


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Wednesday, March 1, 2017 9:13 AM
    Moderator
  • The log i provided you is of server 2012 and it has 32 GB of RAM, initially it had 16GB RAM and the error was coming and i increased the RAM to 32 GB on 20th feb 2017 and still the error repeating now.
    Wednesday, March 1, 2017 12:54 PM
  • Updated the question
    Thursday, March 2, 2017 12:32 PM
  • information entries i could find and which i don't know what it is.

    Looks like we probably need to have some source Symbol files to match with these.  At first I thought there were just a few Event ids but this shows that there is a multitude:

    PS>Get-WinEvent -Path "C:\Downloads\logman profiletrace_pc3\profiletrace_pc3.evtx" | sort Id | Group Id | ft Count, Name -AutoSize

    too many to check if they get listed with  netsh  trace  show  providers  |  clip

    BTW I show a pipe to clip.exe  to let you Paste the output to somewhere that you could do Finds more easily with it.  You could do Finds with the Command Prompt's Edit menu's Find (Alt-Space, E, F)  but I think Pasting in a better tool would be preferred.  FWIW I doubt I have any of the GUID in my list.  Just these

    PS>netsh trace show providers | select-string "User Profile"

    {89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}  Microsoft-Windows-User Profiles Service
    {DB00DFB6-29F9-4A9C-9B3B-1F4F9E7D9770}  Microsoft-Windows-User Profiles General

    which aren't in your trace.

    Perhaps it would help to add those traces to interleave with the ones logman is generating?

    Heh.   logman  /query  providers   generates the same list!  Good to know.  But the one you were advised to create isn't there?  {eb7428f5-ab1f-4322-a4cc-1f1a9b2c5e98}  Where does it come from?

    FWIW this reminds me of the problems we are having trying to get anything readable out of Get-WindowsUpdate.log  for preview versions of Windows 10 builds.  I will be interested in seeing whatever is needed to make it useful.



    Robert Aldwinckle
    ---

    Thursday, March 2, 2017 7:32 PM
  • ok. The log i gave before was generated directly from running

    "logman -start profiletrace -p {eb7428f5-ab1f-4322-a4cc-1f1a9b2c5e98} 255 3 -ets"

    But now when i checked in 'netsh trace show providers' the above profile not found in the server. I will run the logman with the above mentioned 2 profile and update the log soon.

    In the mean time i checked server, In order to rule out the permission i just gave the full permission for C:\users folder to the 'User' group. But the temp profile was still creating. Strange thing i found that after the reboot of the server last night the temp profile of all the users created was auto corrected by windows when the users logged in this morning. But still need to check for 2 days whether the error still occur or not.

    And also i found the error in another windows 10 PC.

    Friday, March 3, 2017 11:08 AM
  • Hi IT researcher,

    How about the issue, is there anything to update?

    Best regards


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, March 6, 2017 9:24 AM
    Moderator
  • Yes there is still issue. The issue is occurring in windows 10 pc's now, But the problem is not regular. It occurs weekly once in any of one pc. Tried everything that i got from internet but still the problem exists.

    At this point i can say that i can role out -

    1] the permission : because if the error is due to permission then it should have occurred everyday whenever the user login.

    2] file corruption : i am able to re-login to the same user using the same file by doing the above mentioned changes in registry.

    So by looking above the event id 1508,1502,1515,1511 is not current in my case. Please find the issue. I am only getting this issue in windows 10 pcs now.

    Friday, March 24, 2017 10:27 AM