none
The Group Policy Client Service failed the logon. Access is denied. RRS feed

  • General discussion

  • Dear SteadyState team,

    Firstly thank you for making such a great product available for free. I am very happy with the way it keeps the systems in my internet cafe secure. Unfortunately after installing a whole list of updates from windows, 2 out of 15 of my machines display the following message when trying to log in to a standard "cafe" user on boot:

    "The Group Policy Client Service failed the logon. Access is denied."

    One online help site suggested that it could be caused by someone manually renaming the user directory (however this should not be possible with WDP switched on which  it normally is). I had a look at the user directory anyway and discovered that there was a folder called cafe.MAN.V2. Is this a roaming profile? I don't know much about roaming profiles but am guessing that Steady State makes some use of them to apply restrictions. I normally wouldn't want a roaming profile because the computers are used by the general public and each computer is set to log in as the user "cafe" on boot.

    Any assistance would be greatly appreciated.

    The computers are running Windows Vista home premium 32bit.
    Thursday, September 17, 2009 3:48 PM

All replies

  • I've performed some tests and it looks like I have the same problem mentioned in these 2 posts even though my error message is slightly different:

    http://social.technet.microsoft.com/Forums/en/windowssteadystate/thread/f5a71a73-c764-4bd3-8f0b-1eb0955a234d
    http://social.technet.microsoft.com/Forums/en/windowssteadystate/thread/02a4af9e-7cb4-49de-9438-16b00cd04279

    What it boils down to is that whenever a user profile is marked as unlocked, it is not possible to boot into that login to make changes. I have tested this with all possible configurations of WDP. i.e.

    WDP = ON don't save changes
    WDP = ON save changes permanently
    WDP = OFF

    In all 3 cases when the profile is locked it is possible to boot into that user. When the profile is unlocked it is not possible to boot into that user and the error message displayed is:

    "The Group Policy Client Service failed the logon. Access is denied."


    So how do I make changes to that user's login if I can't unlock the profile?

    One strange thing is that all of my 15 computers are updated with Vista service pack 2, yet only 2 computers have this problem. I have tried unlocking the profile on some of the other 13 computers and can still boot into the user of that profile. All computers have virtually identical hardware and software configured. There is nothing special about the 2 computers that have this problem and the problem occurred after a recent bout of windows updates. So although updates seem to have played a role, it doesn't seem like this bug can be reproduced merely by installing a certain update. Could it be that some kind of race condition is occuring when the tedious process of updates and committing changes takes place?
    Tuesday, September 22, 2009 12:22 AM