none
Windows cannot copy file - Roaming profile problem just started on January! Event ID 1509 & 1504

    Question

  • Hi,

    My Environment is:

    Windows Server 2003 Standard domain & has a second 2008 domain controller on the network.

    There are 40 windows 7 clients on the network.

    Since 22nd Dec 2010 suddenly I am getting thse 02 event on allmost all client computers:

    Log Name:      Application
    Source:        Microsoft-Windows-User Profiles Service
    Date:          23/12/2010 17:05:50
    Event ID:      1504
    Task Category: None
    Level:         Error
    Keywords:     
    User:          OIA\hmoore
    Computer:      DESKTOP09V.oia.local
    Description:
    Windows Windows cannot update your roaming profile completely. Check previous events for more details.


    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
        <EventID>1504</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2010-12-23T17:05:50.006821100Z" />
        <EventRecordID>7418</EventRecordID>
        <Correlation />
        <Execution ProcessID="860" ThreadID="3076" />
        <Channel>Application</Channel>
        <Computer>DESKTOP09V.oia.local</Computer>
        <Security UserID="S-1-5-21-2911354414-1737097844-1967369931-1271" />
      </System>
      <EventData>
      </EventData>
    </Event>

    AND

    Log Name:      Application
    Source:        Microsoft-Windows-User Profiles General
    Date:          23/12/2010 17:05:49
    Event ID:      1509
    Task Category: None
    Level:         Warning
    Keywords:     
    User:          OIA\hmoore
    Computer:      DESKTOP09V.oia.local
    Description:
    Windows cannot copy file C:\Users\pell\AppData\Roaming\Microsoft\Windows\Cookies\Low\hmoore@atdmt[1].txt to location \\server01$NOCSC$\Profiles$\pell.V2\AppData\Roaming\Microsoft\Windows\Cookies\Low\hmoore@atdmt[1].txt. This error may be caused by network problems or insufficient security rights.

     DETAIL - Access is denied.

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-User Profiles General" Guid="{DB00DFB6-29F9-4A9C-9B3B-1F4F9E7D9770}" />
        <EventID>1509</EventID>
        <Version>0</Version>
        <Level>3</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2010-12-23T17:05:49.180021100Z" />
        <EventRecordID>7417</EventRecordID>
        <Correlation />
        <Execution ProcessID="860" ThreadID="1100" />
        <Channel>Application</Channel>
        <Computer>DESKTOP09V.oia.local</Computer>
        <Security UserID="S-1-5-21-2911354414-1737097844-1967369931-1271" />
      </System>
      <EventData Name="EVENT_COPYERROR">
        <Data Name="Source">C:\Users\USERname\AppData\Roaming\Microsoft\Windows\Cookies\Low\hmoore@atdmt[1].txt</Data>
        <Data Name="Target">\\server01$NOCSC$\Profiles$\pell.V2\AppData\Roaming\Microsoft\Windows\Cookies\Low\hmoore@atdmt[1].txt</Data>
        <Data Name="Error">Access is denied.
    </Data>
      </EventData>
    </Event>

    So when  user loggin off from the system they get that "You Roaming user profiles is not completely syncronized. Please see the event log for more details" Message.

    I can see 04 number of 1509  events. its talking about 04 files that cannot syncronize. (similar to the above cookie).

    Not sure any security updated has messed up the systems.

    Any idea?

    Many Thanks

     

     

    • Edited by Tikitiboo Tuesday, January 18, 2011 1:21 PM
    Friday, January 14, 2011 4:45 PM

Answers

All replies

  • Just to update something.

    Users were always able to login to their profile from any computer at the office.

    But now if they try to login to a different computer (A computer which they havent logged in before) its only loading to a temporary profile only. So User data is not sync to the local machine at all on that cases!

    THanks

     

    Friday, January 14, 2011 5:07 PM
  • Hi,

     

    According to the event errors, you can read the main error “Access is denied”.

     

    Based on the current situation, please correct the security settings for the Roaming User Profiles. For the detailed information, please refer to the following Microsoft TechNet article:

     

    Security Considerations when Configuring Roaming User Profiles

    http://technet.microsoft.com/en-us/library/cc737633(WS.10).aspx

     

    Regards,


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Monday, January 17, 2011 6:37 AM
    Moderator
  • Hi,

    Do you have any idea how this can be happen?

    Because this server been doing this job for more than 04 year without any problem. This just started Dec!

    I can see the following event on the server quite since last year April. Is that something related to this? 

    But This just started to happen last year Dec!

    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1058
    Date:  18/01/2011
    Time:  09:05:21
    User:  NT AUTHORITY\SYSTEM
    Computer: SERVER01
    Description:
    Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=oia,DC=local. The file must be present at the location <\\oia.local\sysvol\oia.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Configuration information could not be read from the domain controller, either because the machine is unavailable, or access has been denied. ). Group Policy processing aborted.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

     

    Many Thanks

     

     

    Tuesday, January 18, 2011 12:03 PM
  • Tuesday, January 18, 2011 1:18 PM
  • Hi,

     

    Based on the current situation, please perform the following steps to troubleshoot the issue:

     

    1.    Right click on the problematic gpt.ini file and click Permissions.

    2.    Switch to Security tab and click Edit.

    3.    Remove all the boxes under Deny and check the following items under Allow.

    l  Read & execute

    l  Read

    4.    Click OK twice to test the issue.

     

    For more information, please refer to the following Microsoft TechNet article:

     

    Event ID 1058 — Group Policy Preprocessing (Networking)

    http://technet.microsoft.com/en-us/library/cc727259(WS.10).aspx

     

    If the issue persists, would you please run the following command and post the output in your reply:

     

    Cacls %systemroot%\SYSVOL\sysvol\DomainName\Policies\{GUID}\gpt.ini

     

    Note: Please replace DomainName and GUID with the real DomainName and GUID.

     

    Regards,


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Thursday, January 20, 2011 9:36 AM
    Moderator
  • Hi,

    For which user/group shouold I need to edit the permission? And also I cant see any deny permissions for any user/group.

    One thing I noticed the problamatic gp file permission set to inherit from the parent folder.

    But not other gp files are are set tp inherit permission from parents folder.

    Do you think that make the different.

     

    Thanks

     

    Thursday, January 20, 2011 10:27 AM
  • Hi,

     

    Please verify the permissions for the Authenticated Users.

     

    Please make sure that the Authenticated Users group has the Read and Apply group policy permissions.

     

    It is normal for inheriting permissions from the parent folder.

     

    If the issue persists, please also check the above Microsoft TechNet article for fur more troubleshooting information.

     

    Regards,


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Tuesday, January 25, 2011 7:41 AM
    Moderator
  • This is cased by the Mcafee.

    You need to get a fix from Mcafee for this.

    http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/c3049278-98de-4490-81b0-069cb9b511ea

     

    Thanks

     

    • Marked as answer by Tikitiboo Friday, January 28, 2011 4:22 PM
    Friday, January 28, 2011 4:21 PM