No network drive mapping after joining Active Directory ?

We are migrating our NOS to Active Directory.

On a Windows XP SP3 workstation, we are able to join Domain.

However, when we log in as Domain User, it does accept Domain password 
but we only get local C drive (No Network Drive at all).  We have tried 
using different users (with administrative right) to log in but get the 
same result.

Your advice is sought.
0
Patrick
4/21/2010 10:38:31 AM
windows.server.active_director 902 articles. 0 followers. Follow

21 Replies
1835 Views

Similar Articles

[PageSpeed] 12

Howdie!

On 21.04.2010 12:38, Patrick wrote:
> We are migrating our NOS to Active Directory.
>
> On a Windows XP SP3 workstation, we are able to join Domain.
>
> However, when we log in as Domain User, it does accept Domain password
> but we only get local C drive (No Network Drive at all). We have tried
> using different users (with administrative right) to log in but get the
> same result.

So -- did you configure any kind of drive mapping in Windows or Group 
Policy? How's that configured in your current solution?

Maybe if you elaborated on that a little more, we could be able to help 
you configure it the way you want it.

Cheers,
Florian
0
Florian
4/21/2010 11:39:42 AM
We include those drive mappings in login script for different Groups in 
AD.

Different users are assigned to specific groups according to his / her role.

When we login as Domain User, the profile does created.

Please kindly advise which area of information should I add for your 
reference.

Thanks


On 21/04/2010 9:39 PM, Florian Frommherz [MVP] wrote:
> Howdie!
>
> On 21.04.2010 12:38, Patrick wrote:
>> We are migrating our NOS to Active Directory.
>>
>> On a Windows XP SP3 workstation, we are able to join Domain.
>>
>> However, when we log in as Domain User, it does accept Domain password
>> but we only get local C drive (No Network Drive at all). We have tried
>> using different users (with administrative right) to log in but get the
>> same result.
>
> So -- did you configure any kind of drive mapping in Windows or Group
> Policy? How's that configured in your current solution?
>
> Maybe if you elaborated on that a little more, we could be able to help
> you configure it the way you want it.
>
> Cheers,
> Florian

0
Patrick
4/21/2010 12:18:51 PM
By default there is no network drives mapped, this is all required to be 
done manually.  All AD will do for you is authenticate you to the domain. 
After that standard Windows services are available.  So if you want to to 
gain access to some network drive you will have to create a share and then 
map to it.  I have a hunch you are looking for a home drive for each user.

Check out the Logon scripts of Richard Mueller, this may guide you with some 
ideas
http://www.rlmueller.net/products.htm

How to assign a home folder to a user
http://support.microsoft.com/default.aspx/kb/816313?p=1
http://support.microsoft.com/kb/320043

-- 
Paul Bergson
MVP - Directory Services
MCITP - Enterprise Administrator
MCTS, MCT, MCSE, MCSA, MCP, Security +, BS CSci
2008, Vista, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewGroups.  This
posting is provided "AS IS" with no warranties and confers no rights.
"Patrick" <Patrick@discussions.microsoft.com> wrote in message 
news:eENLZ8T4KHA.3644@TK2MSFTNGP06.phx.gbl...
> We are migrating our NOS to Active Directory.
>
> On a Windows XP SP3 workstation, we are able to join Domain.
>
> However, when we log in as Domain User, it does accept Domain password but 
> we only get local C drive (No Network Drive at all).  We have tried using 
> different users (with administrative right) to log in but get the same 
> result.
>
> Your advice is sought. 


0
Paul
4/21/2010 12:25:59 PM
Dear Paul,

Thanks for your advice.

According to Network Support Officer, he has prepared the drive mappings.

What we feel surprise is that even the NSO login to that machine with 
his domain account, he also only gets the local C drive and no other 
drive mappings.

Would there any component missed out on the local workstation ?

Thanks again


On 21/04/2010 10:25 PM, Paul Bergson [MVP-DS] wrote:
> By default there is no network drives mapped, this is all required to be
> done manually.  All AD will do for you is authenticate you to the domain.
> After that standard Windows services are available.  So if you want to to
> gain access to some network drive you will have to create a share and then
> map to it.  I have a hunch you are looking for a home drive for each user.
>
> Check out the Logon scripts of Richard Mueller, this may guide you with some
> ideas
> http://www.rlmueller.net/products.htm
>
> How to assign a home folder to a user
> http://support.microsoft.com/default.aspx/kb/816313?p=1
> http://support.microsoft.com/kb/320043
>

0
Patrick
4/21/2010 12:48:23 PM
First thing I would suggest is you try and run the mapping once the user has 
logged on.  There is the possibility the logging on user doesn't have access 
to the location of where the scripts reside until after the user has logged 
on.  Best place to place a script is in sysvol/netlogon/new folder

-- 
Paul Bergson
MVP - Directory Services
MCITP - Enterprise Administrator
MCTS, MCT, MCSE, MCSA, MCP, Security +, BS CSci
2008, Vista, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewGroups.  This
posting is provided "AS IS" with no warranties and confers no rights.
"Patrick" <Patrick@discussions.microsoft.com> wrote in message 
news:uwAi9EV4KHA.1624@TK2MSFTNGP06.phx.gbl...
> Dear Paul,
>
> Thanks for your advice.
>
> According to Network Support Officer, he has prepared the drive mappings.
>
> What we feel surprise is that even the NSO login to that machine with his 
> domain account, he also only gets the local C drive and no other drive 
> mappings.
>
> Would there any component missed out on the local workstation ?
>
> Thanks again
>
>
> On 21/04/2010 10:25 PM, Paul Bergson [MVP-DS] wrote:
>> By default there is no network drives mapped, this is all required to be
>> done manually.  All AD will do for you is authenticate you to the domain.
>> After that standard Windows services are available.  So if you want to to
>> gain access to some network drive you will have to create a share and 
>> then
>> map to it.  I have a hunch you are looking for a home drive for each 
>> user.
>>
>> Check out the Logon scripts of Richard Mueller, this may guide you with 
>> some
>> ideas
>> http://www.rlmueller.net/products.htm
>>
>> How to assign a home folder to a user
>> http://support.microsoft.com/default.aspx/kb/816313?p=1
>> http://support.microsoft.com/kb/320043
>>
> 


0
Paul
4/21/2010 12:55:59 PM
Dear Paul,

I will try and get back to you.

Thanks again for your advice.


On 21/04/2010 10:55 PM, Paul Bergson [MVP-DS] wrote:
> First thing I would suggest is you try and run the mapping once the user has
> logged on.  There is the possibility the logging on user doesn't have access
> to the location of where the scripts reside until after the user has logged
> on.  Best place to place a script is in sysvol/netlogon/new folder
>

0
Patrick
4/21/2010 9:33:09 PM
On Thu, 22 Apr 2010 07:33:09 +1000, Patrick
<Patrick@discussions.microsoft.com> wrote:

>Dear Paul,
>
>I will try and get back to you.
>
>Thanks again for your advice.
>
>

Patrick,

I am curious. Was there a logon script created, or is there one now?
May I ask what type of logon script it is, such as is it a batch file
(*.bat), or a VP script (*.vbs), or an executable? 

Also, where is the logon script stored? Is is stored in
sysvol\domain.com\sysvol\scripts folder? Or was is specified in a
Group Policy Object (GPO)?

Or was it specified in the user's AD properties, Profile tab?

Thank you,
Ace

This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.

Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services

If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.
0
Ace
4/22/2010 4:06:56 AM
Yes, you are right.  I have confirmed that the Login Script is in Group 
Policy Object AS there is nothing in the sysvol\scripts folder.

Sorry for my misunderstanding.

In this way, the problem will be no drive mapping in Group Policy.

On the other hand, I am able to browse all volumes in the Domain Controller.

Thanking you in anticipation.


On 22/04/2010 2:06 PM, Ace Fekay [MVP - Directory Services, MCT] wrote:
> On Thu, 22 Apr 2010 07:33:09 +1000, Patrick
> <Patrick@discussions.microsoft.com>  wrote:
>
>> Dear Paul,
>>
>> I will try and get back to you.
>>
>> Thanks again for your advice.
>>
>>
>
> Patrick,
>
> I am curious. Was there a logon script created, or is there one now?
> May I ask what type of logon script it is, such as is it a batch file
> (*.bat), or a VP script (*.vbs), or an executable?
>
> Also, where is the logon script stored? Is is stored in
> sysvol\domain.com\sysvol\scripts folder? Or was is specified in a
> Group Policy Object (GPO)?
>
> Or was it specified in the user's AD properties, Profile tab?
>
> Thank you,
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.
>
> Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.
>
> Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008&  Exchange 2007, MCSE&  MCSA 2003/2000, MCSA Messaging 2003
> Microsoft Certified Trainer
> Microsoft MVP - Directory Services
>
> If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.

0
Patrick
4/22/2010 11:01:53 AM
Being in the GPO is in the sysvol so that is correct.

Am I confused, are you not running a logon script?  If you are look at the 
gpo setting "Run logon scripts synchronously".  This can help with 
everything not being ready when a script tries to map out a drive.
http://technet.microsoft.com/en-us/library/cc958585.aspx



-- 
Paul Bergson
MVP - Directory Services
MCITP - Enterprise Administrator
MCTS, MCT, MCSE, MCSA, MCP, Security +, BS CSci
2008, Vista, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewGroups.  This
posting is provided "AS IS" with no warranties and confers no rights.
"Patrick" <Patrick@discussions.microsoft.com> wrote in message 
news:e5jFIug4KHA.980@TK2MSFTNGP04.phx.gbl...
> Yes, you are right.  I have confirmed that the Login Script is in Group 
> Policy Object AS there is nothing in the sysvol\scripts folder.
>
> Sorry for my misunderstanding.
>
> In this way, the problem will be no drive mapping in Group Policy.
>
> On the other hand, I am able to browse all volumes in the Domain 
> Controller.
>
> Thanking you in anticipation.
>
>
> On 22/04/2010 2:06 PM, Ace Fekay [MVP - Directory Services, MCT] wrote:
>> On Thu, 22 Apr 2010 07:33:09 +1000, Patrick
>> <Patrick@discussions.microsoft.com>  wrote:
>>
>>> Dear Paul,
>>>
>>> I will try and get back to you.
>>>
>>> Thanks again for your advice.
>>>
>>>
>>
>> Patrick,
>>
>> I am curious. Was there a logon script created, or is there one now?
>> May I ask what type of logon script it is, such as is it a batch file
>> (*.bat), or a VP script (*.vbs), or an executable?
>>
>> Also, where is the logon script stored? Is is stored in
>> sysvol\domain.com\sysvol\scripts folder? Or was is specified in a
>> Group Policy Object (GPO)?
>>
>> Or was it specified in the user's AD properties, Profile tab?
>>
>> Thank you,
>> Ace
>>
>> This posting is provided "AS-IS" with no warranties or guarantees and 
>> confers no rights.
>>
>> Please reply back to the newsgroup or forum for collaboration benefit 
>> among responding engineers, and to help others benefit from your 
>> resolution.
>>
>> Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008&  Exchange 2007, MCSE& 
>> MCSA 2003/2000, MCSA Messaging 2003
>> Microsoft Certified Trainer
>> Microsoft MVP - Directory Services
>>
>> If you feel this is an urgent issue and require immediate assistance, 
>> please contact Microsoft PSS directly. Please check 
>> http://support.microsoft.com for regional support phone numbers.
> 


0
Paul
4/22/2010 12:09:45 PM
>> Patrick,
>>
>> I am curious. Was there a logon script created, or is there one now?
>> May I ask what type of logon script it is, such as is it a batch file
>> (*.bat), or a VP script (*.vbs), or an executable?
>>
>> Also, where is the logon script stored? Is is stored in
>> sysvol\domain.com\sysvol\scripts folder? Or was is specified in a
>> Group Policy Object (GPO)?
>>
>> Or was it specified in the user's AD properties, Profile tab?
>>
>> Thank you,
>> Ace
>>
>> This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.
>>
>> Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.
>>
>> Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008&  Exchange 2007, MCSE&  MCSA 2003/2000, MCSA Messaging 2003
>> Microsoft Certified Trainer
>> Microsoft MVP - Directory Services
>>
>> If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.

On Thu, 22 Apr 2010 21:01:53 +1000, Patrick
<Patrick@discussions.microsoft.com> wrote:

>Yes, you are right.  I have confirmed that the Login Script is in Group 
>Policy Object AS there is nothing in the sysvol\scripts folder.
>
>Sorry for my misunderstanding.
>
>In this way, the problem will be no drive mapping in Group Policy.
>
>On the other hand, I am able to browse all volumes in the Domain Controller.
>
>Thanking you in anticipation.
>
>

So it is in a GPO. Thank you for pointing that out. If you look in the
GPO where the script is specified, can you tell me the location of the
physical script file itself that is specified in the GPO?

Also, I assume that the GPO is on the OU where the user account
exists?


Ace
0
Ace
4/22/2010 4:58:02 PM
Dear all,

Many thanks for your advice.

I find that the login script (VBS file) is under "User Configuration --> 
Windows Settings --> Script --> Logon"

Besides, I have tried to log on other machines.  Drives are mapped OK 
for other machines.

Besides, when running gpresult, I find that the only difference is Local 
Policy is not run on GOOD machine and run on BAD one.  However, to my 
best knowledge, nothing has been set up in Local Group Policy.

GOOD

     Applied Group Policy Objects
     -----------------------------
         Workstations
         Default Domain Policy

     The following GPOs were not applied because they were filtered out
     -------------------------------------------------------------------
         Local Group Policy
             Filtering:  Not Applied (Empty)

BAD

     Applied Group Policy Objects
     -----------------------------
         Workstations
         Default Domain Policy
         Local Group Policy



On the other hand, we also find the following messae in Event Viewer and 
have applied UPHClean but the problem persists.

Event Type:	Warning
Event Source:	Userenv
Event Category:	None
Event ID:	1517
Date:		23/04/2010
Time:		2:04:10 PM
User:		NT AUTHORITY\SYSTEM
Computer:	WORKSTATION1
Description:
Windows saved user DomainName\UserName registry while an application or 
service was still using the registry during log off. The memory used by 
the user's registry has not been freed. The registry will be unloaded 
when it is no longer in use.

This is often caused by services running as a user account, try 
configuring the services to run in either the LocalService or 
NetworkService account.



Event Type:	Information
Event Source:	UPHClean
Event Category:	None
Event ID:	1401
Date:		23/04/2010
Time:		4:05:44 PM
User:		DomainName\UserName
Computer:	WORKSTATION1
Description:
The following handles in user profile hive DomainName\UserName
(S-1-5-21-3558745915-3620255497-2782363364-2817) have been remapped 
because they were preventing the profile from unloading successfully:

svchost.exe (360)
   HKCU\Software\Microsoft\Windows NT\CurrentVersion\Network\Location
Awareness (0x29c)


Your advice is sought.

Thanks again.
On 23/04/2010 2:58 AM, Ace Fekay [MVP - Directory Services, MCT] wrote:
>
>>> Patrick,
>>>
>>> I am curious. Was there a logon script created, or is there one now?
>>> May I ask what type of logon script it is, such as is it a batch file
>>> (*.bat), or a VP script (*.vbs), or an executable?
>>>
>>> Also, where is the logon script stored? Is is stored in
>>> sysvol\domain.com\sysvol\scripts folder? Or was is specified in a
>>> Group Policy Object (GPO)?
>>>
>>> Or was it specified in the user's AD properties, Profile tab?
>>>
>>> Thank you,
>>> Ace
>>>
>>> This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.
>>>
>>> Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.
>>>
>>> Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008&   Exchange 2007, MCSE&   MCSA 2003/2000, MCSA Messaging 2003
>>> Microsoft Certified Trainer
>>> Microsoft MVP - Directory Services
>>>
>>> If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.
>
> On Thu, 22 Apr 2010 21:01:53 +1000, Patrick
> <Patrick@discussions.microsoft.com>  wrote:
>
>> Yes, you are right.  I have confirmed that the Login Script is in Group
>> Policy Object AS there is nothing in the sysvol\scripts folder.
>>
>> Sorry for my misunderstanding.
>>
>> In this way, the problem will be no drive mapping in Group Policy.
>>
>> On the other hand, I am able to browse all volumes in the Domain Controller.
>>
>> Thanking you in anticipation.
>>
>>
>
> So it is in a GPO. Thank you for pointing that out. If you look in the
> GPO where the script is specified, can you tell me the location of the
> physical script file itself that is specified in the GPO?
>
> Also, I assume that the GPO is on the OU where the user account
> exists?
>
>
> Ace

0
Patrick
4/23/2010 8:56:28 AM
Try setting this in your default policy for both computer and user

http://technet.microsoft.com/en-us/library/cc958585.aspx

-- 
Paul Bergson
MVP - Directory Services
MCITP - Enterprise Administrator
MCTS, MCT, MCSE, MCSA, MCP, Security +, BS CSci
2008, Vista, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewGroups.  This
posting is provided "AS IS" with no warranties and confers no rights.
"Paul Bergson [MVP-DS]" <pbbergs@no-spam.msn.com> wrote in message 
news:ewDF$HV4KHA.5416@TK2MSFTNGP06.phx.gbl...
> First thing I would suggest is you try and run the mapping once the user 
> has logged on.  There is the possibility the logging on user doesn't have 
> access to the location of where the scripts reside until after the user 
> has logged on.  Best place to place a script is in sysvol/netlogon/new 
> folder
>
> -- 
> Paul Bergson
> MVP - Directory Services
> MCITP - Enterprise Administrator
> MCTS, MCT, MCSE, MCSA, MCP, Security +, BS CSci
> 2008, Vista, 2003, 2000 (Early Achiever), NT4
> Microsoft's Thrive IT Pro of the Month - June 2009
>
> http://www.pbbergs.com
>
> Please no e-mails, any questions should be posted in the NewGroups.  This
> posting is provided "AS IS" with no warranties and confers no rights.
> "Patrick" <Patrick@discussions.microsoft.com> wrote in message 
> news:uwAi9EV4KHA.1624@TK2MSFTNGP06.phx.gbl...
>> Dear Paul,
>>
>> Thanks for your advice.
>>
>> According to Network Support Officer, he has prepared the drive mappings.
>>
>> What we feel surprise is that even the NSO login to that machine with his 
>> domain account, he also only gets the local C drive and no other drive 
>> mappings.
>>
>> Would there any component missed out on the local workstation ?
>>
>> Thanks again
>>
>>
>> On 21/04/2010 10:25 PM, Paul Bergson [MVP-DS] wrote:
>>> By default there is no network drives mapped, this is all required to be
>>> done manually.  All AD will do for you is authenticate you to the 
>>> domain.
>>> After that standard Windows services are available.  So if you want to 
>>> to
>>> gain access to some network drive you will have to create a share and 
>>> then
>>> map to it.  I have a hunch you are looking for a home drive for each 
>>> user.
>>>
>>> Check out the Logon scripts of Richard Mueller, this may guide you with 
>>> some
>>> ideas
>>> http://www.rlmueller.net/products.htm
>>>
>>> How to assign a home folder to a user
>>> http://support.microsoft.com/default.aspx/kb/816313?p=1
>>> http://support.microsoft.com/kb/320043
>>>
>>
>
> 


0
Paul
4/23/2010 12:18:14 PM
THere are appears to be some inconsistencies. Is the good and bad
machines both in the same OU?

Try Paul's suggestion to see if it works in the Default Domain Policy.

Ace



On Fri, 23 Apr 2010 18:56:28 +1000, Patrick
<Patrick@discussions.microsoft.com> wrote:

>Dear all,
>
>Many thanks for your advice.
>
>I find that the login script (VBS file) is under "User Configuration --> 
>Windows Settings --> Script --> Logon"
>
>Besides, I have tried to log on other machines.  Drives are mapped OK 
>for other machines.
>
>Besides, when running gpresult, I find that the only difference is Local 
>Policy is not run on GOOD machine and run on BAD one.  However, to my 
>best knowledge, nothing has been set up in Local Group Policy.
>
>GOOD
>
>     Applied Group Policy Objects
>     -----------------------------
>         Workstations
>         Default Domain Policy
>
>     The following GPOs were not applied because they were filtered out
>     -------------------------------------------------------------------
>         Local Group Policy
>             Filtering:  Not Applied (Empty)
>
>BAD
>
>     Applied Group Policy Objects
>     -----------------------------
>         Workstations
>         Default Domain Policy
>         Local Group Policy
>
>
>
>On the other hand, we also find the following messae in Event Viewer and 
>have applied UPHClean but the problem persists.
>
>Event Type:	Warning
>Event Source:	Userenv
>Event Category:	None
>Event ID:	1517
>Date:		23/04/2010
>Time:		2:04:10 PM
>User:		NT AUTHORITY\SYSTEM
>Computer:	WORKSTATION1
>Description:
>Windows saved user DomainName\UserName registry while an application or 
>service was still using the registry during log off. The memory used by 
>the user's registry has not been freed. The registry will be unloaded 
>when it is no longer in use.
>
>This is often caused by services running as a user account, try 
>configuring the services to run in either the LocalService or 
>NetworkService account.
>
>
>
>Event Type:	Information
>Event Source:	UPHClean
>Event Category:	None
>Event ID:	1401
>Date:		23/04/2010
>Time:		4:05:44 PM
>User:		DomainName\UserName
>Computer:	WORKSTATION1
>Description:
>The following handles in user profile hive DomainName\UserName
>(S-1-5-21-3558745915-3620255497-2782363364-2817) have been remapped 
>because they were preventing the profile from unloading successfully:
>
>svchost.exe (360)
>   HKCU\Software\Microsoft\Windows NT\CurrentVersion\Network\Location
>Awareness (0x29c)
>
>
>Your advice is sought.
>
>Thanks again.
>On 23/04/2010 2:58 AM, Ace Fekay [MVP - Directory Services, MCT] wrote:
>>
>>>> Patrick,
>>>>
>>>> I am curious. Was there a logon script created, or is there one now?
>>>> May I ask what type of logon script it is, such as is it a batch file
>>>> (*.bat), or a VP script (*.vbs), or an executable?
>>>>
>>>> Also, where is the logon script stored? Is is stored in
>>>> sysvol\domain.com\sysvol\scripts folder? Or was is specified in a
>>>> Group Policy Object (GPO)?
>>>>
>>>> Or was it specified in the user's AD properties, Profile tab?
>>>>
>>>> Thank you,
>>>> Ace
>>>>
>>>> This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.
>>>>
>>>> Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.
>>>>
>>>> Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008&   Exchange 2007, MCSE&   MCSA 2003/2000, MCSA Messaging 2003
>>>> Microsoft Certified Trainer
>>>> Microsoft MVP - Directory Services
>>>>
>>>> If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.
>>
>> On Thu, 22 Apr 2010 21:01:53 +1000, Patrick
>> <Patrick@discussions.microsoft.com>  wrote:
>>
>>> Yes, you are right.  I have confirmed that the Login Script is in Group
>>> Policy Object AS there is nothing in the sysvol\scripts folder.
>>>
>>> Sorry for my misunderstanding.
>>>
>>> In this way, the problem will be no drive mapping in Group Policy.
>>>
>>> On the other hand, I am able to browse all volumes in the Domain Controller.
>>>
>>> Thanking you in anticipation.
>>>
>>>
>>
>> So it is in a GPO. Thank you for pointing that out. If you look in the
>> GPO where the script is specified, can you tell me the location of the
>> physical script file itself that is specified in the GPO?
>>
>> Also, I assume that the GPO is on the OU where the user account
>> exists?
>>
>>
>> Ace
0
Ace
4/24/2010 4:17:05 PM
Yes.

I will try Pual's suggestion and get back to you.

Thanks again.


On 25/04/2010 2:17 AM, Ace Fekay [MVP - Directory Services, MCT] wrote:
> THere are appears to be some inconsistencies. Is the good and bad
> machines both in the same OU?
>
> Try Paul's suggestion to see if it works in the Default Domain Policy.
>
> Ace
>
>
>
> On Fri, 23 Apr 2010 18:56:28 +1000, Patrick
> <Patrick@discussions.microsoft.com>  wrote:
>
>> Dear all,
>>
>> Many thanks for your advice.
>>
>> I find that the login script (VBS file) is under "User Configuration -->
>> Windows Settings -->  Script -->  Logon"
>>
>> Besides, I have tried to log on other machines.  Drives are mapped OK
>> for other machines.
>>
>> Besides, when running gpresult, I find that the only difference is Local
>> Policy is not run on GOOD machine and run on BAD one.  However, to my
>> best knowledge, nothing has been set up in Local Group Policy.
>>
>> GOOD
>>
>>      Applied Group Policy Objects
>>      -----------------------------
>>          Workstations
>>          Default Domain Policy
>>
>>      The following GPOs were not applied because they were filtered out
>>      -------------------------------------------------------------------
>>          Local Group Policy
>>              Filtering:  Not Applied (Empty)
>>
>> BAD
>>
>>      Applied Group Policy Objects
>>      -----------------------------
>>          Workstations
>>          Default Domain Policy
>>          Local Group Policy
>>
>>
>>
>> On the other hand, we also find the following messae in Event Viewer and
>> have applied UPHClean but the problem persists.
>>
>> Event Type:	Warning
>> Event Source:	Userenv
>> Event Category:	None
>> Event ID:	1517
>> Date:		23/04/2010
>> Time:		2:04:10 PM
>> User:		NT AUTHORITY\SYSTEM
>> Computer:	WORKSTATION1
>> Description:
>> Windows saved user DomainName\UserName registry while an application or
>> service was still using the registry during log off. The memory used by
>> the user's registry has not been freed. The registry will be unloaded
>> when it is no longer in use.
>>
>> This is often caused by services running as a user account, try
>> configuring the services to run in either the LocalService or
>> NetworkService account.
>>
>>
>>
>> Event Type:	Information
>> Event Source:	UPHClean
>> Event Category:	None
>> Event ID:	1401
>> Date:		23/04/2010
>> Time:		4:05:44 PM
>> User:		DomainName\UserName
>> Computer:	WORKSTATION1
>> Description:
>> The following handles in user profile hive DomainName\UserName
>> (S-1-5-21-3558745915-3620255497-2782363364-2817) have been remapped
>> because they were preventing the profile from unloading successfully:
>>
>> svchost.exe (360)
>>    HKCU\Software\Microsoft\Windows NT\CurrentVersion\Network\Location
>> Awareness (0x29c)
>>
>>
>> Your advice is sought.
>>
>> Thanks again.
>> On 23/04/2010 2:58 AM, Ace Fekay [MVP - Directory Services, MCT] wrote:
>>>
>>>>> Patrick,
>>>>>
>>>>> I am curious. Was there a logon script created, or is there one now?
>>>>> May I ask what type of logon script it is, such as is it a batch file
>>>>> (*.bat), or a VP script (*.vbs), or an executable?
>>>>>
>>>>> Also, where is the logon script stored? Is is stored in
>>>>> sysvol\domain.com\sysvol\scripts folder? Or was is specified in a
>>>>> Group Policy Object (GPO)?
>>>>>
>>>>> Or was it specified in the user's AD properties, Profile tab?
>>>>>
>>>>> Thank you,
>>>>> Ace
>>>>>
>>>>> This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.
>>>>>
>>>>> Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.
>>>>>
>>>>> Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008&    Exchange 2007, MCSE&    MCSA 2003/2000, MCSA Messaging 2003
>>>>> Microsoft Certified Trainer
>>>>> Microsoft MVP - Directory Services
>>>>>
>>>>> If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.
>>>
>>> On Thu, 22 Apr 2010 21:01:53 +1000, Patrick
>>> <Patrick@discussions.microsoft.com>   wrote:
>>>
>>>> Yes, you are right.  I have confirmed that the Login Script is in Group
>>>> Policy Object AS there is nothing in the sysvol\scripts folder.
>>>>
>>>> Sorry for my misunderstanding.
>>>>
>>>> In this way, the problem will be no drive mapping in Group Policy.
>>>>
>>>> On the other hand, I am able to browse all volumes in the Domain Controller.
>>>>
>>>> Thanking you in anticipation.
>>>>
>>>>
>>>
>>> So it is in a GPO. Thank you for pointing that out. If you look in the
>>> GPO where the script is specified, can you tell me the location of the
>>> physical script file itself that is specified in the GPO?
>>>
>>> Also, I assume that the GPO is on the OU where the user account
>>> exists?
>>>
>>>
>>> Ace

0
Patrick
4/25/2010 5:10:41 AM
Ok.

Ace

On Sun, 25 Apr 2010 15:10:41 +1000, Patrick
<Patrick@discussions.microsoft.com> wrote:

>Yes.
>
>I will try Pual's suggestion and get back to you.
>
>Thanks again.
>
>
>On 25/04/2010 2:17 AM, Ace Fekay [MVP - Directory Services, MCT] wrote:
>> THere are appears to be some inconsistencies. Is the good and bad
>> machines both in the same OU?
>>
>> Try Paul's suggestion to see if it works in the Default Domain Policy.
>>
>> Ace
>>
>>
>>
>> On Fri, 23 Apr 2010 18:56:28 +1000, Patrick
>> <Patrick@discussions.microsoft.com>  wrote:
>>
>>> Dear all,
>>>
>>> Many thanks for your advice.
>>>
>>> I find that the login script (VBS file) is under "User Configuration -->
>>> Windows Settings -->  Script -->  Logon"
>>>
>>> Besides, I have tried to log on other machines.  Drives are mapped OK
>>> for other machines.
>>>
>>> Besides, when running gpresult, I find that the only difference is Local
>>> Policy is not run on GOOD machine and run on BAD one.  However, to my
>>> best knowledge, nothing has been set up in Local Group Policy.
>>>
>>> GOOD
>>>
>>>      Applied Group Policy Objects
>>>      -----------------------------
>>>          Workstations
>>>          Default Domain Policy
>>>
>>>      The following GPOs were not applied because they were filtered out
>>>      -------------------------------------------------------------------
>>>          Local Group Policy
>>>              Filtering:  Not Applied (Empty)
>>>
>>> BAD
>>>
>>>      Applied Group Policy Objects
>>>      -----------------------------
>>>          Workstations
>>>          Default Domain Policy
>>>          Local Group Policy
>>>
>>>
>>>
>>> On the other hand, we also find the following messae in Event Viewer and
>>> have applied UPHClean but the problem persists.
>>>
>>> Event Type:	Warning
>>> Event Source:	Userenv
>>> Event Category:	None
>>> Event ID:	1517
>>> Date:		23/04/2010
>>> Time:		2:04:10 PM
>>> User:		NT AUTHORITY\SYSTEM
>>> Computer:	WORKSTATION1
>>> Description:
>>> Windows saved user DomainName\UserName registry while an application or
>>> service was still using the registry during log off. The memory used by
>>> the user's registry has not been freed. The registry will be unloaded
>>> when it is no longer in use.
>>>
>>> This is often caused by services running as a user account, try
>>> configuring the services to run in either the LocalService or
>>> NetworkService account.
>>>
>>>
>>>
>>> Event Type:	Information
>>> Event Source:	UPHClean
>>> Event Category:	None
>>> Event ID:	1401
>>> Date:		23/04/2010
>>> Time:		4:05:44 PM
>>> User:		DomainName\UserName
>>> Computer:	WORKSTATION1
>>> Description:
>>> The following handles in user profile hive DomainName\UserName
>>> (S-1-5-21-3558745915-3620255497-2782363364-2817) have been remapped
>>> because they were preventing the profile from unloading successfully:
>>>
>>> svchost.exe (360)
>>>    HKCU\Software\Microsoft\Windows NT\CurrentVersion\Network\Location
>>> Awareness (0x29c)
>>>
>>>
>>> Your advice is sought.
>>>
>>> Thanks again.
>>> On 23/04/2010 2:58 AM, Ace Fekay [MVP - Directory Services, MCT] wrote:
>>>>
>>>>>> Patrick,
>>>>>>
>>>>>> I am curious. Was there a logon script created, or is there one now?
>>>>>> May I ask what type of logon script it is, such as is it a batch file
>>>>>> (*.bat), or a VP script (*.vbs), or an executable?
>>>>>>
>>>>>> Also, where is the logon script stored? Is is stored in
>>>>>> sysvol\domain.com\sysvol\scripts folder? Or was is specified in a
>>>>>> Group Policy Object (GPO)?
>>>>>>
>>>>>> Or was it specified in the user's AD properties, Profile tab?
>>>>>>
>>>>>> Thank you,
>>>>>> Ace
>>>>>>
>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.
>>>>>>
>>>>>> Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.
>>>>>>
>>>>>> Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008&    Exchange 2007, MCSE&    MCSA 2003/2000, MCSA Messaging 2003
>>>>>> Microsoft Certified Trainer
>>>>>> Microsoft MVP - Directory Services
>>>>>>
>>>>>> If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.
>>>>
>>>> On Thu, 22 Apr 2010 21:01:53 +1000, Patrick
>>>> <Patrick@discussions.microsoft.com>   wrote:
>>>>
>>>>> Yes, you are right.  I have confirmed that the Login Script is in Group
>>>>> Policy Object AS there is nothing in the sysvol\scripts folder.
>>>>>
>>>>> Sorry for my misunderstanding.
>>>>>
>>>>> In this way, the problem will be no drive mapping in Group Policy.
>>>>>
>>>>> On the other hand, I am able to browse all volumes in the Domain Controller.
>>>>>
>>>>> Thanking you in anticipation.
>>>>>
>>>>>
>>>>
>>>> So it is in a GPO. Thank you for pointing that out. If you look in the
>>>> GPO where the script is specified, can you tell me the location of the
>>>> physical script file itself that is specified in the GPO?
>>>>
>>>> Also, I assume that the GPO is on the OU where the user account
>>>> exists?
>>>>
>>>>
>>>> Ace
0
Ace
4/25/2010 8:43:53 PM
I have followed Paul's suggestion but still no network drive mapping. 
The BAD machine is running XP SP3 with 512MB and it has been very slow 
when invoking software (even MS Word / Excel).

On the other hand, I get the following message:

Event Type:	Warning
Event Source:	Winlogon
Event Category:	None
Event ID:	1217
Date:		27/04/2010
Time:		10:37:39 AM
User:		N/A
Computer:	FINANCE1
Description:
Execution of GPO scripts has timed out and have been terminated.

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.


Then I try to remove the workstation from the Active Directory and 
rejoin.  Still unable to get network drive mapping.

On the other hand, for the first time after rejoining, I get the 
following message (that doesn't appear when I log in again).  We don't 
use roaming profile in our site.

Event Type:	Warning
Event Source:	Folder Redirection
Event Category:	None
Event ID:	301
Date:		27/04/2010
Time:		3:08:19 PM
User:		DomainName\UserName
Computer:	FINANCE1
Description:
Folder redirection policy application has been delayed until the next 
logon because the group policy logon optimization is in effect.

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.

Thanking you in anticipation.

Patrick

On 26/04/2010 6:43 AM, Ace Fekay [MVP - Directory Services, MCT] wrote:
> Ok.
>
> Ace
>
> On Sun, 25 Apr 2010 15:10:41 +1000, Patrick
> <Patrick@discussions.microsoft.com>  wrote:
>
>> Yes.
>>
>> I will try Pual's suggestion and get back to you.
>>
>> Thanks again.
>>
>>
>> On 25/04/2010 2:17 AM, Ace Fekay [MVP - Directory Services, MCT] wrote:
>>> THere are appears to be some inconsistencies. Is the good and bad
>>> machines both in the same OU?
>>>
>>> Try Paul's suggestion to see if it works in the Default Domain Policy.
>>>
>>> Ace
>>>
>>>
>>>
>>> On Fri, 23 Apr 2010 18:56:28 +1000, Patrick
>>> <Patrick@discussions.microsoft.com>   wrote:
>>>
>>>> Dear all,
>>>>
>>>> Many thanks for your advice.
>>>>
>>>> I find that the login script (VBS file) is under "User Configuration -->
>>>> Windows Settings -->   Script -->   Logon"
>>>>
>>>> Besides, I have tried to log on other machines.  Drives are mapped OK
>>>> for other machines.
>>>>
>>>> Besides, when running gpresult, I find that the only difference is Local
>>>> Policy is not run on GOOD machine and run on BAD one.  However, to my
>>>> best knowledge, nothing has been set up in Local Group Policy.
>>>>
>>>> GOOD
>>>>
>>>>       Applied Group Policy Objects
>>>>       -----------------------------
>>>>           Workstations
>>>>           Default Domain Policy
>>>>
>>>>       The following GPOs were not applied because they were filtered out
>>>>       -------------------------------------------------------------------
>>>>           Local Group Policy
>>>>               Filtering:  Not Applied (Empty)
>>>>
>>>> BAD
>>>>
>>>>       Applied Group Policy Objects
>>>>       -----------------------------
>>>>           Workstations
>>>>           Default Domain Policy
>>>>           Local Group Policy
>>>>
>>>>
>>>>
>>>> On the other hand, we also find the following messae in Event Viewer and
>>>> have applied UPHClean but the problem persists.
>>>>
>>>> Event Type:	Warning
>>>> Event Source:	Userenv
>>>> Event Category:	None
>>>> Event ID:	1517
>>>> Date:		23/04/2010
>>>> Time:		2:04:10 PM
>>>> User:		NT AUTHORITY\SYSTEM
>>>> Computer:	WORKSTATION1
>>>> Description:
>>>> Windows saved user DomainName\UserName registry while an application or
>>>> service was still using the registry during log off. The memory used by
>>>> the user's registry has not been freed. The registry will be unloaded
>>>> when it is no longer in use.
>>>>
>>>> This is often caused by services running as a user account, try
>>>> configuring the services to run in either the LocalService or
>>>> NetworkService account.
>>>>
>>>>
>>>>
>>>> Event Type:	Information
>>>> Event Source:	UPHClean
>>>> Event Category:	None
>>>> Event ID:	1401
>>>> Date:		23/04/2010
>>>> Time:		4:05:44 PM
>>>> User:		DomainName\UserName
>>>> Computer:	WORKSTATION1
>>>> Description:
>>>> The following handles in user profile hive DomainName\UserName
>>>> (S-1-5-21-3558745915-3620255497-2782363364-2817) have been remapped
>>>> because they were preventing the profile from unloading successfully:
>>>>
>>>> svchost.exe (360)
>>>>     HKCU\Software\Microsoft\Windows NT\CurrentVersion\Network\Location
>>>> Awareness (0x29c)
>>>>
>>>>
>>>> Your advice is sought.
>>>>
>>>> Thanks again.
>>>> On 23/04/2010 2:58 AM, Ace Fekay [MVP - Directory Services, MCT] wrote:
>>>>>
>>>>>>> Patrick,
>>>>>>>
>>>>>>> I am curious. Was there a logon script created, or is there one now?
>>>>>>> May I ask what type of logon script it is, such as is it a batch file
>>>>>>> (*.bat), or a VP script (*.vbs), or an executable?
>>>>>>>
>>>>>>> Also, where is the logon script stored? Is is stored in
>>>>>>> sysvol\domain.com\sysvol\scripts folder? Or was is specified in a
>>>>>>> Group Policy Object (GPO)?
>>>>>>>
>>>>>>> Or was it specified in the user's AD properties, Profile tab?
>>>>>>>
>>>>>>> Thank you,
>>>>>>> Ace
>>>>>>>
>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.
>>>>>>>
>>>>>>> Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.
>>>>>>>
>>>>>>> Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008&     Exchange 2007, MCSE&     MCSA 2003/2000, MCSA Messaging 2003
>>>>>>> Microsoft Certified Trainer
>>>>>>> Microsoft MVP - Directory Services
>>>>>>>
>>>>>>> If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.
>>>>>
>>>>> On Thu, 22 Apr 2010 21:01:53 +1000, Patrick
>>>>> <Patrick@discussions.microsoft.com>    wrote:
>>>>>
>>>>>> Yes, you are right.  I have confirmed that the Login Script is in Group
>>>>>> Policy Object AS there is nothing in the sysvol\scripts folder.
>>>>>>
>>>>>> Sorry for my misunderstanding.
>>>>>>
>>>>>> In this way, the problem will be no drive mapping in Group Policy.
>>>>>>
>>>>>> On the other hand, I am able to browse all volumes in the Domain Controller.
>>>>>>
>>>>>> Thanking you in anticipation.
>>>>>>
>>>>>>
>>>>>
>>>>> So it is in a GPO. Thank you for pointing that out. If you look in the
>>>>> GPO where the script is specified, can you tell me the location of the
>>>>> physical script file itself that is specified in the GPO?
>>>>>
>>>>> Also, I assume that the GPO is on the OU where the user account
>>>>> exists?
>>>>>
>>>>>
>>>>> Ace

0
Patrick
4/27/2010 8:49:11 AM
Do you have the firewall on locally?  Could you be blocking icmp traffic? 
If the firewall is on, shutoff temp and see if that helps.

You can test to verify you have a secure channel with your dc, but I have to 
assume you do.
nltest /sc_query:domainname.com

Below are my standard recommendations for assisting in GPO troubleshooting:

Troubleshooting Group Policy

To turn on verbose logging (From http://support.microsoft.com/kb/221833)

Use Registry Editor to add or to modify the following registry entry:
Subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows 
NT\CurrentVersion\Winlogon
Entry: UserEnvDebugLevel
Type: REG_DWORD
Value data: 10002 (Hexadecimal)

UserEnvDebugLevel can have the following values:
NONE 0x00000000
NORMAL 0x00000001
VERBOSE 0x00000002
LOGFILE 0x00010000
DEBUGGER 0x00020000
The default value is NORMAL|LOGFILE (0x00010001).

To disable logging, select NONE (0x00000000).

If you set UserEnvDebugLevel to 0x00030002, the most verbose details are 
logged in the Userenv.log file.

Logging location
 C:\Windows\Debug\UserMode\gpsvc.log


Running gpupdate /force will immediately apply most policies but not all, 
some require a system reboot


Running GPResult /R from the command prompt will list out what was processed 
and what wasn't and why

-- 
Paul Bergson
MVP - Directory Services
MCITP - Enterprise Administrator
MCTS, MCT, MCSE, MCSA, MCP, Security +, BS CSci
2008, Vista, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewGroups.  This
posting is provided "AS IS" with no warranties and confers no rights.
"Patrick" <Patrick@discussions.microsoft.com> wrote in message 
news:%23fv1Ube5KHA.3292@TK2MSFTNGP06.phx.gbl...
>I have followed Paul's suggestion but still no network drive mapping. The 
>BAD machine is running XP SP3 with 512MB and it has been very slow when 
>invoking software (even MS Word / Excel).
>
> On the other hand, I get the following message:
>
> Event Type: Warning
> Event Source: Winlogon
> Event Category: None
> Event ID: 1217
> Date: 27/04/2010
> Time: 10:37:39 AM
> User: N/A
> Computer: FINANCE1
> Description:
> Execution of GPO scripts has timed out and have been terminated.
>
> For more information, see Help and Support Center at 
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Then I try to remove the workstation from the Active Directory and rejoin. 
> Still unable to get network drive mapping.
>
> On the other hand, for the first time after rejoining, I get the following 
> message (that doesn't appear when I log in again).  We don't use roaming 
> profile in our site.
>
> Event Type: Warning
> Event Source: Folder Redirection
> Event Category: None
> Event ID: 301
> Date: 27/04/2010
> Time: 3:08:19 PM
> User: DomainName\UserName
> Computer: FINANCE1
> Description:
> Folder redirection policy application has been delayed until the next 
> logon because the group policy logon optimization is in effect.
>
> For more information, see Help and Support Center at 
> http://go.microsoft.com/fwlink/events.asp.
>
> Thanking you in anticipation.
>
> Patrick
>
> On 26/04/2010 6:43 AM, Ace Fekay [MVP - Directory Services, MCT] wrote:
>> Ok.
>>
>> Ace
>>
>> On Sun, 25 Apr 2010 15:10:41 +1000, Patrick
>> <Patrick@discussions.microsoft.com>  wrote:
>>
>>> Yes.
>>>
>>> I will try Pual's suggestion and get back to you.
>>>
>>> Thanks again.
>>>
>>>
>>> On 25/04/2010 2:17 AM, Ace Fekay [MVP - Directory Services, MCT] wrote:
>>>> THere are appears to be some inconsistencies. Is the good and bad
>>>> machines both in the same OU?
>>>>
>>>> Try Paul's suggestion to see if it works in the Default Domain Policy.
>>>>
>>>> Ace
>>>>
>>>>
>>>>
>>>> On Fri, 23 Apr 2010 18:56:28 +1000, Patrick
>>>> <Patrick@discussions.microsoft.com>   wrote:
>>>>
>>>>> Dear all,
>>>>>
>>>>> Many thanks for your advice.
>>>>>
>>>>> I find that the login script (VBS file) is under "User 
>>>>> Configuration -->
>>>>> Windows Settings -->   Script -->   Logon"
>>>>>
>>>>> Besides, I have tried to log on other machines.  Drives are mapped OK
>>>>> for other machines.
>>>>>
>>>>> Besides, when running gpresult, I find that the only difference is 
>>>>> Local
>>>>> Policy is not run on GOOD machine and run on BAD one.  However, to my
>>>>> best knowledge, nothing has been set up in Local Group Policy.
>>>>>
>>>>> GOOD
>>>>>
>>>>>       Applied Group Policy Objects
>>>>>       -----------------------------
>>>>>           Workstations
>>>>>           Default Domain Policy
>>>>>
>>>>>       The following GPOs were not applied because they were filtered 
>>>>> out
>>>>>       -------------------------------------------------------------------
>>>>>           Local Group Policy
>>>>>               Filtering:  Not Applied (Empty)
>>>>>
>>>>> BAD
>>>>>
>>>>>       Applied Group Policy Objects
>>>>>       -----------------------------
>>>>>           Workstations
>>>>>           Default Domain Policy
>>>>>           Local Group Policy
>>>>>
>>>>>
>>>>>
>>>>> On the other hand, we also find the following messae in Event Viewer 
>>>>> and
>>>>> have applied UPHClean but the problem persists.
>>>>>
>>>>> Event Type: Warning
>>>>> Event Source: Userenv
>>>>> Event Category: None
>>>>> Event ID: 1517
>>>>> Date: 23/04/2010
>>>>> Time: 2:04:10 PM
>>>>> User: NT AUTHORITY\SYSTEM
>>>>> Computer: WORKSTATION1
>>>>> Description:
>>>>> Windows saved user DomainName\UserName registry while an application 
>>>>> or
>>>>> service was still using the registry during log off. The memory used 
>>>>> by
>>>>> the user's registry has not been freed. The registry will be unloaded
>>>>> when it is no longer in use.
>>>>>
>>>>> This is often caused by services running as a user account, try
>>>>> configuring the services to run in either the LocalService or
>>>>> NetworkService account.
>>>>>
>>>>>
>>>>>
>>>>> Event Type: Information
>>>>> Event Source: UPHClean
>>>>> Event Category: None
>>>>> Event ID: 1401
>>>>> Date: 23/04/2010
>>>>> Time: 4:05:44 PM
>>>>> User: DomainName\UserName
>>>>> Computer: WORKSTATION1
>>>>> Description:
>>>>> The following handles in user profile hive DomainName\UserName
>>>>> (S-1-5-21-3558745915-3620255497-2782363364-2817) have been remapped
>>>>> because they were preventing the profile from unloading successfully:
>>>>>
>>>>> svchost.exe (360)
>>>>>     HKCU\Software\Microsoft\Windows NT\CurrentVersion\Network\Location
>>>>> Awareness (0x29c)
>>>>>
>>>>>
>>>>> Your advice is sought.
>>>>>
>>>>> Thanks again.
>>>>> On 23/04/2010 2:58 AM, Ace Fekay [MVP - Directory Services, MCT] 
>>>>> wrote:
>>>>>>
>>>>>>>> Patrick,
>>>>>>>>
>>>>>>>> I am curious. Was there a logon script created, or is there one 
>>>>>>>> now?
>>>>>>>> May I ask what type of logon script it is, such as is it a batch 
>>>>>>>> file
>>>>>>>> (*.bat), or a VP script (*.vbs), or an executable?
>>>>>>>>
>>>>>>>> Also, where is the logon script stored? Is is stored in
>>>>>>>> sysvol\domain.com\sysvol\scripts folder? Or was is specified in a
>>>>>>>> Group Policy Object (GPO)?
>>>>>>>>
>>>>>>>> Or was it specified in the user's AD properties, Profile tab?
>>>>>>>>
>>>>>>>> Thank you,
>>>>>>>> Ace
>>>>>>>>
>>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees 
>>>>>>>> and confers no rights.
>>>>>>>>
>>>>>>>> Please reply back to the newsgroup or forum for collaboration 
>>>>>>>> benefit among responding engineers, and to help others benefit from 
>>>>>>>> your resolution.
>>>>>>>>
>>>>>>>> Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008&     Exchange 
>>>>>>>> 2007, MCSE&     MCSA 2003/2000, MCSA Messaging 2003
>>>>>>>> Microsoft Certified Trainer
>>>>>>>> Microsoft MVP - Directory Services
>>>>>>>>
>>>>>>>> If you feel this is an urgent issue and require immediate 
>>>>>>>> assistance, please contact Microsoft PSS directly. Please check 
>>>>>>>> http://support.microsoft.com for regional support phone numbers.
>>>>>>
>>>>>> On Thu, 22 Apr 2010 21:01:53 +1000, Patrick
>>>>>> <Patrick@discussions.microsoft.com>    wrote:
>>>>>>
>>>>>>> Yes, you are right.  I have confirmed that the Login Script is in 
>>>>>>> Group
>>>>>>> Policy Object AS there is nothing in the sysvol\scripts folder.
>>>>>>>
>>>>>>> Sorry for my misunderstanding.
>>>>>>>
>>>>>>> In this way, the problem will be no drive mapping in Group Policy.
>>>>>>>
>>>>>>> On the other hand, I am able to browse all volumes in the Domain 
>>>>>>> Controller.
>>>>>>>
>>>>>>> Thanking you in anticipation.
>>>>>>>
>>>>>>>
>>>>>>
>>>>>> So it is in a GPO. Thank you for pointing that out. If you look in 
>>>>>> the
>>>>>> GPO where the script is specified, can you tell me the location of 
>>>>>> the
>>>>>> physical script file itself that is specified in the GPO?
>>>>>>
>>>>>> Also, I assume that the GPO is on the OU where the user account
>>>>>> exists?
>>>>>>
>>>>>>
>>>>>> Ace
> 


0
Paul
4/27/2010 12:20:44 PM
Dear Paul,

Thanks for your advice.  I will try it today.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
I forgot to mention another thing I had done yesterday:

I grabbed the VBS file and run it interactively.  Drives are mapped 
successfully.

When I log off and log in again, it still keeps those drive mapping.

Then I disconnect them and restart the machine, the drive mappings are gone.

I don't know whether this information is helpful or not.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Thanks again.


On 27/04/2010 10:20 PM, Paul Bergson [MVP-DS] wrote:
> Do you have the firewall on locally?  Could you be blocking icmp traffic?
> If the firewall is on, shutoff temp and see if that helps.
>
> You can test to verify you have a secure channel with your dc, but I have to
> assume you do.
> nltest /sc_query:domainname.com
>
> Below are my standard recommendations for assisting in GPO troubleshooting:
>
> Troubleshooting Group Policy
>
> To turn on verbose logging (From http://support.microsoft.com/kb/221833)
>
> Use Registry Editor to add or to modify the following registry entry:
> Subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
> NT\CurrentVersion\Winlogon
> Entry: UserEnvDebugLevel
> Type: REG_DWORD
> Value data: 10002 (Hexadecimal)
>
> UserEnvDebugLevel can have the following values:
> NONE 0x00000000
> NORMAL 0x00000001
> VERBOSE 0x00000002
> LOGFILE 0x00010000
> DEBUGGER 0x00020000
> The default value is NORMAL|LOGFILE (0x00010001).
>
> To disable logging, select NONE (0x00000000).
>
> If you set UserEnvDebugLevel to 0x00030002, the most verbose details are
> logged in the Userenv.log file.
>
> Logging location
>   C:\Windows\Debug\UserMode\gpsvc.log
>
>
> Running gpupdate /force will immediately apply most policies but not all,
> some require a system reboot
>
>
> Running GPResult /R from the command prompt will list out what was processed
> and what wasn't and why
>

0
Patrick
4/27/2010 9:43:55 PM
Dear Paul,

1) I have already disabled Windows Firewall and other Firewall installed 
but still get the same result

2) I have found there was a secure connection to Domain Controller
C:\Documents and Settings\user1>nltest /sc_query:mycompany.com
Flags: 30 HAS_IP  HAS_TIMESERV
Trusted DC Name \\DomainC4.mycompany.com
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully


3) I have added gpresult /v result for your reference.  It did apply the 
user setting "HeadOffice" - where the VBS contains drive mapping

Microsoft (R) Windows (R) XP Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001

Created On 28/04/2010 at 12:59:48 PM



RSOP results for mycompany\user1 on FINANCE1 : Logging Mode
--------------------------------------------------------------

OS Type:                     Microsoft Windows XP Professional
OS Configuration:            Member Workstation
OS Version:                  5.1.2600
Domain Name:                 mycompany
Domain Type:                 Windows 2000
Site Name:                   mycompany
Roaming Profile:
Local Profile:               C:\Documents and Settings\user1
Connected over a slow link?: No


COMPUTER SETTINGS
------------------
     CN=FINANCE1,OU=HeadOffice,OU=Workstations,DC=mycompany,DC=com
     Last time Group Policy was applied: 28/04/2010 at 12:47:50 PM
     Group Policy was applied from:      DomainC3.mycompany.com
     Group Policy slow link threshold:   0 kbps

     Applied Group Policy Objects
     -----------------------------
         Workstations
         Default Domain Policy
         Local Group Policy

     The computer is a part of the following security groups:
     --------------------------------------------------------
         BUILTIN\Administrators
         Everyone
         BUILTIN\Users
         NT AUTHORITY\NETWORK
         NT AUTHORITY\Authenticated Users
         FINANCE1$
         Domain Computers

     Resultant Set Of Policies for Computer:
     ----------------------------------------

         Software Installations
         ----------------------
             N/A

         Startup Scripts
         ---------------
             GPO: Workstations
                 Name:         sessmgr.exe
                 Parameters:   -service
                 LastExecuted: 2:49:00 AM

         Shutdown Scripts
         ----------------
             GPO: Workstations
                 Name:         shutdown.bat
                 Parameters:
                 LastExecuted: 2:45:58 AM

         Account Policies
         ----------------
             GPO: Workstations
                 Policy:            MinimumPasswordAge
                 Computer Setting:  N/A

             GPO: Workstations
                 Policy:            PasswordHistorySize
                 Computer Setting:  N/A

             GPO: Workstations
                 Policy:            MinimumPasswordLength
                 Computer Setting:  N/A

             GPO: Default Domain Policy
                 Policy:            LockoutBadCount
                 Computer Setting:  N/A

             GPO: Workstations
                 Policy:            MaximumPasswordAge
                 Computer Setting:  900

         Audit Policy
         ------------
             N/A

         User Rights
         -----------
             GPO: Workstations
                 Policy:            LoadDriverPrivilege
                 Computer Setting:  Administrators
                                    mycompany\Domain Users

         Security Options
         ----------------
             GPO: Default Domain Policy
                 Policy:            RequireLogonToChangePassword
                 Computer Setting:  Not Enabled

             GPO: Workstations
                 Policy:            PasswordComplexity
                 Computer Setting:  Not Enabled

             GPO: Default Domain Policy
                 Policy:            ForceLogoffWhenHourExpire
                 Computer Setting:  Not Enabled

             GPO: Workstations
                 Policy:            ClearTextPassword
                 Computer Setting:  Not Enabled

         Event Log Settings
         ------------------
             N/A

         Restricted Groups
         -----------------
             GPO: Workstations
                 Groupname: mycompany\IT
                 Members:   N/A

             GPO: Workstations
                 Groupname: mycompany\Domain Admins
                 Members:   N/A

             GPO: Workstations
                 Groupname: mycompany\Domain Users
                 Members:   N/A

         System Services
         ---------------
             GPO: Workstations
                 ServiceName: W32Time
                 Startup:     Automatic

         Registry Settings
         -----------------
             GPO: Workstations
                 ObjectName: MACHINE

             GPO: Workstations
                 ObjectName: USERS

             GPO: Workstations
                 ObjectName: CLASSES_ROOT

         File System Settings
         --------------------
             GPO: Workstations
                 ObjectName: C:\Program Files

             GPO: Workstations
                 ObjectName: C:\TEMP

             GPO: Workstations
                 ObjectName: C:\WINDOWS

             GPO: Workstations
                 ObjectName: C:\

         Public Key Policies
         -------------------
             N/A

         Administrative Templates
         ------------------------
             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows\System
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows 
NT\Terminal Services
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows\Group 
Policy\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows\Group 
Policy\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows 
NT\Terminal Services\RAUnsolicit
                 State:   Enabled

             GPO: Default Domain Policy
                 Setting: 
Software\Microsoft\Windows\CurrentVersion\Policies\System
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Microsoft\Windows\CurrentVersion\Policies\System
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows\WindowsUpdate
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\RemoteDesktop
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows\Group 
Policy\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts\List
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows\WindowsUpdate
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts\List
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows\Installer
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\RemoteDesktop
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows\WindowsUpdate
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows 
NT\Terminal Services
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows 
NT\Terminal Services
                 State:   Enabled

             GPO: Workstations
                 Setting: Software\Policies\Microsoft\Windows 
NT\Terminal Services\RAUnsolicit
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts
                 State:   Enabled

             GPO: Workstations
                 Setting: 
Software\Policies\Microsoft\WindowsFirewall\DomainProfile
                 State:   Enabled


USER SETTINGS
--------------
     CN=user1,OU=HeadOffice,OU=mycompany,DC=mycompany,DC=com
     Last time Group Policy was applied: 28/04/2010 at 12:48:53 PM
     Group Policy was applied from:      DomainC3.mycompany.com
     Group Policy slow link threshold:   500 kbps

     Applied Group Policy Objects
     -----------------------------
         HeadOffice
         mycompany
         Default Domain Policy

     The following GPOs were not applied because they were filtered out
     -------------------------------------------------------------------
         Local Group Policy
             Filtering:  Not Applied (Empty)

     The user is a part of the following security groups:
     ----------------------------------------------------
         Domain Users
         Everyone
         Offer Remote Assistance Helpers
         BUILTIN\Power Users
         BUILTIN\Users
         BUILTIN\Administrators
         Remote Desktop Users
         NT AUTHORITY\INTERACTIVE
         NT AUTHORITY\Authenticated Users
         LOCAL
         Everyonemycompany
         EveryoneHeadOffice
         IT
         HeadOffice
         mycompany

     Resultant Set Of Policies for User:
     ------------------------------------

         Software Installations
         ----------------------
             N/A

         Public Key Policies
         -------------------
             N/A

         Administrative Templates
         ------------------------
             GPO: Default Domain Policy
                 Setting: 
Software\Microsoft\Windows\CurrentVersion\Policies\System
                 State:   Enabled

             GPO: mycompany
                 Setting: 
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
                 State:   Enabled

         Folder Redirection
         ------------------
             N/A


On 27/04/2010 10:20 PM, Paul Bergson [MVP-DS] wrote:
> Do you have the firewall on locally?  Could you be blocking icmp traffic?
> If the firewall is on, shutoff temp and see if that helps.
>
0
Patrick
4/28/2010 9:01:17 AM
Dear Paul,

4) I have enabled logging. I also observe that there is a DNS message 
but I have confirmed that the DNS IP addresses are exactly those on the 
Domain Controller.  Besides, I also confirmed that the workstation is 
already has a A record entry in the DNS Server.

USERENV(418.41c) 13:28:54:656 InitializePolicyProcessing: Initialised 
Machine Mutex/Events
USERENV(418.41c) 13:28:54:687 InitializePolicyProcessing: Initialised 
User Mutex/Events
USERENV(418.41c) 13:28:54:687 LibMain: Process Name: 
\??\C:\WINDOWS\system32\winlogon.exe
USERENV(418.41c) 13:28:59:546 Entering CUserProfile::Initialize ...
USERENV(418.41c) 13:28:59:546 CUserProfile::Initialize called by winlogon
USERENV(418.41c) 13:28:59:546 CUserProfile::Initialize: critical section 
initialized
USERENV(418.41c) 13:28:59:546 CSyncManager::Initialize: critical section 
initialized
USERENV(418.41c) 13:28:59:546 CUserProfile::Initialize: registry key 
Software\Microsoft\Windows NT\CurrentVersion\ProfileList opened
USERENV(418.41c) 13:28:59:546 CUserProfile::Initialize: Proccessing 
S-1-5-21-584252974-802680808-3957195257-500
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock 
<S-1-5-21-584252974-802680808-3957195257-500>
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock: New entry created
USERENV(418.41c) 13:28:59:546 CHashTable::HashAdd: 
S-1-5-21-584252974-802680808-3957195257-500 added in bucket 0
USERENV(418.41c) 13:28:59:546 CUserProfile::CleanupUserProfile: Enter 
critical section.
USERENV(418.41c) 13:28:59:546 CUserProfile::GetRefCountAndFlags: Ref 
count is 0, state is 00000100
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock 
<S-1-5-21-584252974-802680808-3957195257-500>
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock: Lock released
USERENV(418.41c) 13:28:59:546 CHashTable::HashDelete: 
S-1-5-21-584252974-802680808-3957195257-500 deleted
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock: Lock deleted
USERENV(418.41c) 13:28:59:546 CUserProfile::CleanupUserProfile: Leave 
critical section
USERENV(418.41c) 13:28:59:546 CUserProfile::Initialize: Proccessing 
S-1-5-21-584252974-802680808-3957195257-1018
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock 
<S-1-5-21-584252974-802680808-3957195257-1018>
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock: New entry created
USERENV(418.41c) 13:28:59:546 CHashTable::HashAdd: 
S-1-5-21-584252974-802680808-3957195257-1018 added in bucket 7
USERENV(418.41c) 13:28:59:546 CUserProfile::CleanupUserProfile: Enter 
critical section.
USERENV(418.41c) 13:28:59:546 CUserProfile::GetRefCountAndFlags: Ref 
count is 0, state is 00000100
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock 
<S-1-5-21-584252974-802680808-3957195257-1018>
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock: Lock released
USERENV(418.41c) 13:28:59:546 CHashTable::HashDelete: 
S-1-5-21-584252974-802680808-3957195257-1018 deleted
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock: Lock deleted
USERENV(418.41c) 13:28:59:546 CUserProfile::CleanupUserProfile: Leave 
critical section
USERENV(418.41c) 13:28:59:546 CUserProfile::Initialize: Proccessing 
S-1-5-21-584252974-802680808-3957195257-1015
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock 
<S-1-5-21-584252974-802680808-3957195257-1015>
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock: New entry created
USERENV(418.41c) 13:28:59:546 CHashTable::HashAdd: 
S-1-5-21-584252974-802680808-3957195257-1015 added in bucket 4
USERENV(418.41c) 13:28:59:546 CUserProfile::CleanupUserProfile: Enter 
critical section.
USERENV(418.41c) 13:28:59:546 CUserProfile::GetRefCountAndFlags: Ref 
count is 0, state is 00000000
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock 
<S-1-5-21-584252974-802680808-3957195257-1015>
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock: Lock released
USERENV(418.41c) 13:28:59:546 CHashTable::HashDelete: 
S-1-5-21-584252974-802680808-3957195257-1015 deleted
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock: Lock deleted
USERENV(418.41c) 13:28:59:546 CUserProfile::CleanupUserProfile: Leave 
critical section
USERENV(418.41c) 13:28:59:546 CUserProfile::Initialize: Proccessing 
S-1-5-21-584252974-802680808-3957195257-1013
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock 
<S-1-5-21-584252974-802680808-3957195257-1013>
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock: New entry created
USERENV(418.41c) 13:28:59:546 CHashTable::HashAdd: 
S-1-5-21-584252974-802680808-3957195257-1013 added in bucket 2
USERENV(418.41c) 13:28:59:546 CUserProfile::CleanupUserProfile: Enter 
critical section.
USERENV(418.41c) 13:28:59:546 CUserProfile::GetRefCountAndFlags: Ref 
count is 0, state is 00000000
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock 
<S-1-5-21-584252974-802680808-3957195257-1013>
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock: Lock released
USERENV(418.41c) 13:28:59:546 CHashTable::HashDelete: 
S-1-5-21-584252974-802680808-3957195257-1013 deleted
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock: Lock deleted
USERENV(418.41c) 13:28:59:546 CUserProfile::CleanupUserProfile: Leave 
critical section
USERENV(418.41c) 13:28:59:546 CUserProfile::Initialize: Proccessing 
S-1-5-21-584252974-802680808-3957195257-1011
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock 
<S-1-5-21-584252974-802680808-3957195257-1011>
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.41c) 13:28:59:546 CSyncManager::EnterLock: New entry created
USERENV(418.41c) 13:28:59:546 CHashTable::HashAdd: 
S-1-5-21-584252974-802680808-3957195257-1011 added in bucket 0
USERENV(418.41c) 13:28:59:546 CUserProfile::CleanupUserProfile: Enter 
critical section.
USERENV(418.41c) 13:28:59:546 CUserProfile::GetRefCountAndFlags: Ref 
count is 0, state is 00000100
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock 
<S-1-5-21-584252974-802680808-3957195257-1011>
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock: Lock released
USERENV(418.41c) 13:28:59:546 CHashTable::HashDelete: 
S-1-5-21-584252974-802680808-3957195257-1011 deleted
USERENV(418.41c) 13:28:59:546 CSyncManager::LeaveLock: Lock deleted
USERENV(418.41c) 13:28:59:546 CUserProfile::CleanupUserProfile: Leave 
critical section
USERENV(418.41c) 13:28:59:562 CUserProfile::Initialize: Proccessing 
S-1-5-21-3558745915-3620255497-2782363364-3180
USERENV(418.41c) 13:28:59:562 CSyncManager::EnterLock 
<S-1-5-21-3558745915-3620255497-2782363364-3180>
USERENV(418.41c) 13:28:59:562 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.41c) 13:28:59:562 CSyncManager::EnterLock: New entry created
USERENV(418.41c) 13:28:59:562 CHashTable::HashAdd: 
S-1-5-21-3558745915-3620255497-2782363364-3180 added in bucket 13
USERENV(418.41c) 13:28:59:562 CUserProfile::CleanupUserProfile: Enter 
critical section.
USERENV(418.41c) 13:28:59:562 CUserProfile::GetRefCountAndFlags: Ref 
count is 0, state is 00000304
USERENV(418.41c) 13:28:59:562 CSyncManager::LeaveLock 
<S-1-5-21-3558745915-3620255497-2782363364-3180>
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock: Lock released
USERENV(418.41c) 13:28:59:578 CHashTable::HashDelete: 
S-1-5-21-3558745915-3620255497-2782363364-3180 deleted
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock: Lock deleted
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Leave 
critical section
USERENV(418.41c) 13:28:59:578 CUserProfile::Initialize: Proccessing 
S-1-5-21-3558745915-3620255497-2782363364-2817
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock 
<S-1-5-21-3558745915-3620255497-2782363364-2817>
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock: New entry created
USERENV(418.41c) 13:28:59:578 CHashTable::HashAdd: 
S-1-5-21-3558745915-3620255497-2782363364-2817 added in bucket 19
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Enter 
critical section.
USERENV(418.41c) 13:28:59:578 CUserProfile::GetRefCountAndFlags: Ref 
count is 0, state is 00000100
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock 
<S-1-5-21-3558745915-3620255497-2782363364-2817>
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock: Lock released
USERENV(418.41c) 13:28:59:578 CHashTable::HashDelete: 
S-1-5-21-3558745915-3620255497-2782363364-2817 deleted
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock: Lock deleted
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Leave 
critical section
USERENV(418.41c) 13:28:59:578 CUserProfile::Initialize: Proccessing S-1-5-20
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock <S-1-5-20>
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock: New entry created
USERENV(418.41c) 13:28:59:578 CHashTable::HashAdd: S-1-5-20 added in 
bucket 4
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Enter 
critical section.
USERENV(418.41c) 13:28:59:578 CUserProfile::GetRefCountAndFlags: Ref 
count is 2, state is 00000000
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Ref 
Count is not 0
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock <S-1-5-20>
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock: Lock released
USERENV(418.41c) 13:28:59:578 CHashTable::HashDelete: S-1-5-20 deleted
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock: Lock deleted
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Leave 
critical section
USERENV(418.41c) 13:28:59:578 CUserProfile::Initialize: Proccessing S-1-5-19
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock <S-1-5-19>
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock: New entry created
USERENV(418.41c) 13:28:59:578 CHashTable::HashAdd: S-1-5-19 added in 
bucket 12
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Enter 
critical section.
USERENV(418.41c) 13:28:59:578 CUserProfile::GetRefCountAndFlags: Ref 
count is 1, state is 00000000
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Ref 
Count is not 0
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock <S-1-5-19>
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock: Lock released
USERENV(418.41c) 13:28:59:578 CHashTable::HashDelete: S-1-5-19 deleted
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock: Lock deleted
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Leave 
critical section
USERENV(418.41c) 13:28:59:578 CUserProfile::Initialize: Proccessing S-1-5-18
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock <S-1-5-18>
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.41c) 13:28:59:578 CSyncManager::EnterLock: New entry created
USERENV(418.41c) 13:28:59:578 CHashTable::HashAdd: S-1-5-18 added in 
bucket 11
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Enter 
critical section.
USERENV(418.41c) 13:28:59:578 CUserProfile::GetRefCountAndFlags: Ref 
count is 1, state is 00000000
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Ref 
Count is not 0
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock <S-1-5-18>
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock: Lock released
USERENV(418.41c) 13:28:59:578 CHashTable::HashDelete: S-1-5-18 deleted
USERENV(418.41c) 13:28:59:578 CSyncManager::LeaveLock: Lock deleted
USERENV(418.41c) 13:28:59:578 CUserProfile::CleanupUserProfile: Leave 
critical section
USERENV(418.41c) 13:28:59:609 CUserProfile::Initialize: 
RpcServerRegisterIfEx successful
USERENV(418.41c) 13:28:59:609 Exiting CUserProfile::Initialize, successful
USERENV(44c.450) 13:29:00:625 LibMain: Process Name: 
C:\WINDOWS\system32\services.exe
USERENV(458.45c) 13:29:01:312 LibMain: Process Name: 
C:\WINDOWS\system32\lsass.exe
USERENV(418.41c) 13:29:01:781 IsSyncForegroundPolicyRefresh: 
Asynchronous, Reason: NoNeedForSync
USERENV(540.544) 13:29:08:250 LibMain: Process Name: 
C:\WINDOWS\system32\svchost.exe
USERENV(44c.450) 13:29:08:687 LoadUserProfile: Yes, we can impersonate 
the user. Running as self
USERENV(44c.450) 13:29:08:687 
=========================================================
USERENV(44c.450) 13:29:08:687 LoadUserProfile: Entering, hToken = 
<0x2a4>, lpProfileInfo = 0x7fca8
USERENV(44c.450) 13:29:08:687 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(44c.450) 13:29:08:687 LoadUserProfile: lpProfileInfo->lpUserName 
= <NetworkService>
USERENV(44c.450) 13:29:08:687 LoadUserProfile: NULL central profile path
USERENV(44c.450) 13:29:08:687 LoadUserProfile: NULL default profile path
USERENV(44c.450) 13:29:08:687 LoadUserProfile: NULL server name
USERENV(44c.450) 13:29:08:687 GetInterface: Returning rpc binding handle
USERENV(418.57c) 13:29:08:687 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.57c) 13:29:08:687 DropClientContext: Got client token 
0000060C, sid = S-1-5-18
USERENV(418.57c) 13:29:08:687 MIDL_user_allocate enter
USERENV(418.57c) 13:29:08:687 DropClientContext: load profile object 
successfully made
USERENV(418.57c) 13:29:08:687 DropClientContext: Returning 0
USERENV(44c.450) 13:29:08:687 LoadUserProfile: Calling DropClientToken 
(as self) succeeded
USERENV(418.438) 13:29:08:687 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.438) 13:29:08:687 In LoadUserProfileP
USERENV(418.438) 13:29:08:687 LoadUserProfile: Running as client
USERENV(418.438) 13:29:08:687 
=========================================================
USERENV(418.438) 13:29:08:687 LoadUserProfile: Entering, hToken = 
<0x614>, lpProfileInfo = 0x1132048
USERENV(418.438) 13:29:08:687 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(418.438) 13:29:08:687 LoadUserProfile: lpProfileInfo->lpUserName 
= <NetworkService>
USERENV(418.438) 13:29:08:687 LoadUserProfile: NULL central profile path
USERENV(418.438) 13:29:08:687 LoadUserProfile: NULL default profile path
USERENV(418.438) 13:29:08:687 LoadUserProfile: NULL server name
USERENV(418.438) 13:29:08:687 LoadUserProfile: User sid: S-1-5-20
USERENV(418.438) 13:29:08:687 CSyncManager::EnterLock <S-1-5-20>
USERENV(418.438) 13:29:08:687 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.438) 13:29:08:687 CSyncManager::EnterLock: New entry created
USERENV(418.438) 13:29:08:687 CHashTable::HashAdd: S-1-5-20 added in 
bucket 4
USERENV(418.438) 13:29:08:687 LoadUserProfile: Wait succeeded. In 
critical section.
USERENV(418.438) 13:29:08:703 RestoreUserProfile:  Entering
USERENV(418.438) 13:29:08:703 IsCentralProfileReachable:  Entering
USERENV(418.438) 13:29:08:703 IsCentralProfileReachable:  Null path. Leaving
USERENV(418.438) 13:29:08:703 RestoreUserProfile:  Profile path = <>
USERENV(418.438) 13:29:08:703 ExtractProfileFromBackup:  A profile 
already exists
USERENV(418.438) 13:29:08:703 PatchNewProfileIfRequred: A profile 
already exists with the current sid, exitting
USERENV(418.438) 13:29:08:703 CreateLocalProfileKey:  Not setting 
additional Security
USERENV(418.438) 13:29:08:703 GetExistingLocalProfileImage:  Found entry 
in profile list for existing local profile
USERENV(418.438) 13:29:08:703 GetExistingLocalProfileImage:  Local 
profile image filename = <%SystemDrive%\Documents and 
Settings\NetworkService>
USERENV(418.438) 13:29:08:703 GetExistingLocalProfileImage:  Expanded 
local profile image filename = <C:\Documents and Settings\NetworkService>
USERENV(418.438) 13:29:08:765 GetExistingLocalProfileImage:  No local 
mandatory profile.  Error = 2
USERENV(418.438) 13:29:08:765 GetExistingLocalProfileImage:  Found local 
profile image file ok <C:\Documents and Settings\NetworkService\ntuser.dat>
USERENV(418.438) 13:29:08:765 GetExistingLocalProfileImage:  Failed to 
query low profile unload time with error 2
USERENV(418.438) 13:29:08:765 Local Existing Profile Image is reachable
USERENV(418.438) 13:29:08:765 Local profile name is <C:\Documents and 
Settings\NetworkService>
USERENV(418.438) 13:29:08:765 RestoreUserProfile:  No central profile. 
Attempting to load local profile.
USERENV(418.438) 13:29:08:796 MyRegLoadKey: Returning 00000000
USERENV(418.438) 13:29:08:843 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(418.438) 13:29:08:843 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.438) 13:29:08:953 MyRegLoadKey: Returning 00000000
USERENV(418.438) 13:29:08:953 CreateClassHive: existing user classes 
hive found
USERENV(418.438) 13:29:08:953 RestoreUserProfile:  About to Leave. Final 
Information follows:
USERENV(418.438) 13:29:08:953 Profile was successfully loaded.
USERENV(418.438) 13:29:08:953 lpProfile->lpRoamingProfile = <>
USERENV(418.438) 13:29:08:953 lpProfile->lpLocalProfile = <C:\Documents 
and Settings\NetworkService>
USERENV(418.438) 13:29:08:953 lpProfile->dwInternalFlags = 0x0
USERENV(418.438) 13:29:08:953 RestoreUserProfile:  Leaving.
USERENV(418.438) 13:29:09:218 UpgradeProfile: Entering
USERENV(418.438) 13:29:09:218 UpgradeProfile: Build numbers match
USERENV(418.438) 13:29:09:218 UpgradeProfile: Leaving Successfully
USERENV(418.438) 13:29:09:359 GetProfileType:  Profile already loaded.
USERENV(418.438) 13:29:09:359 LoadProfileInfo:  Failed to query central 
profile with error 2
USERENV(418.438) 13:29:09:375 GetProfileType: ProfileFlags is 0
USERENV(418.438) 13:29:09:500 Profile Ref Count is 1
USERENV(418.438) 13:29:09:500 LoadUserProfile: Leaving critical Section.
USERENV(418.438) 13:29:09:500 CSyncManager::LeaveLock <S-1-5-20>
USERENV(418.438) 13:29:09:500 CSyncManager::LeaveLock: Lock released
USERENV(418.438) 13:29:09:500 CHashTable::HashDelete: S-1-5-20 deleted
USERENV(418.438) 13:29:09:500 CSyncManager::LeaveLock: Lock deleted
USERENV(418.438) 13:29:09:500 LoadUserProfile: Impersonated user: 
00000614, 00000620
USERENV(458.4a8) 13:29:09:515 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(458.4a8) 13:29:09:515 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(458.4a8) 13:29:09:515 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(458.4a8) 13:29:09:515 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.438) 13:29:09:546 LoadUserProfile: Reverted to user: 00000000
USERENV(418.438) 13:29:09:546 LoadUserProfile: Reverted back to user 
<00000000>
USERENV(418.438) 13:29:09:546 LoadUserProfile: Leaving with a value of 1.
USERENV(418.438) 13:29:09:546 
=========================================================
USERENV(418.438) 13:29:09:546 LoadUserProfileI: returning 0
USERENV(44c.450) 13:29:09:546 LoadUserProfile: Running as self
USERENV(44c.450) 13:29:09:546 LoadUserProfile: Calling LoadUserProfileI 
(as user) succeeded
USERENV(44c.450) 13:29:09:546 LoadUserProfile:  Returning success. Final 
Information follows:
USERENV(44c.450) 13:29:09:546 lpProfileInfo->UserName = <NetworkService>
USERENV(44c.450) 13:29:09:546 lpProfileInfo->lpProfilePath = <>
USERENV(44c.450) 13:29:09:546 lpProfileInfo->dwFlags = 0x9
USERENV(418.57c) 13:29:09:546 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.57c) 13:29:09:546 ReleaseClientContext: Releasing context
USERENV(418.57c) 13:29:09:546 ReleaseClientContext_s: Releasing context
USERENV(418.57c) 13:29:09:546 MIDL_user_free enter
USERENV(44c.450) 13:29:09:546 ReleaseInterface: Releasing rpc binding handle
USERENV(44c.450) 13:29:09:546 LoadUserProfile: Returning TRUE. hProfile 
= <0x334>
USERENV(44c.450) 13:29:09:546 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(44c.450) 13:29:09:546 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(584.588) 13:29:09:609 LibMain: Process Name: 
C:\WINDOWS\system32\svchost.exe
USERENV(600.604) 13:29:10:484 LibMain: Process Name:  C:\Program 
Files\Windows Defender\MsMpEng.exe
USERENV(628.62c) 13:29:10:578 LibMain: Process Name: 
C:\WINDOWS\System32\svchost.exe
USERENV(418.41c) 13:29:10:765 IsSyncForegroundPolicyRefresh: 
Asynchronous, Reason: NoNeedForSync
USERENV(44c.450) 13:29:11:171 LoadUserProfile: Yes, we can impersonate 
the user. Running as self
USERENV(44c.450) 13:29:11:171 
=========================================================
USERENV(44c.450) 13:29:11:171 LoadUserProfile: Entering, hToken = 
<0x374>, lpProfileInfo = 0x7fca8
USERENV(44c.450) 13:29:11:171 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(44c.450) 13:29:11:171 LoadUserProfile: lpProfileInfo->lpUserName 
= <NetworkService>
USERENV(44c.450) 13:29:11:171 LoadUserProfile: NULL central profile path
USERENV(44c.450) 13:29:11:171 LoadUserProfile: NULL default profile path
USERENV(44c.450) 13:29:11:171 LoadUserProfile: NULL server name
USERENV(44c.450) 13:29:11:171 GetInterface: Returning rpc binding handle
USERENV(418.65c) 13:29:11:187 IsSyncForegroundPolicyRefresh: 
Asynchronous, Reason: NoNeedForSync
USERENV(418.438) 13:29:11:187 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.438) 13:29:11:187 DropClientContext: Got client token 
00000684, sid = S-1-5-18
USERENV(418.438) 13:29:11:187 MIDL_user_allocate enter
USERENV(418.438) 13:29:11:187 DropClientContext: load profile object 
successfully made
USERENV(418.438) 13:29:11:187 DropClientContext: Returning 0
USERENV(44c.450) 13:29:11:187 LoadUserProfile: Calling DropClientToken 
(as self) succeeded
USERENV(418.57c) 13:29:11:187 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.57c) 13:29:11:187 In LoadUserProfileP
USERENV(418.57c) 13:29:11:187 LoadUserProfile: Running as client
USERENV(418.57c) 13:29:11:187 
=========================================================
USERENV(418.57c) 13:29:11:187 LoadUserProfile: Entering, hToken = 
<0x688>, lpProfileInfo = 0x8a010
USERENV(418.57c) 13:29:11:187 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(418.57c) 13:29:11:187 LoadUserProfile: lpProfileInfo->lpUserName 
= <NetworkService>
USERENV(418.57c) 13:29:11:187 LoadUserProfile: NULL central profile path
USERENV(418.57c) 13:29:11:187 LoadUserProfile: NULL default profile path
USERENV(418.57c) 13:29:11:187 LoadUserProfile: NULL server name
USERENV(418.57c) 13:29:11:187 LoadUserProfile: User sid: S-1-5-20
USERENV(418.57c) 13:29:11:187 CSyncManager::EnterLock <S-1-5-20>
USERENV(418.57c) 13:29:11:187 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.57c) 13:29:11:187 CSyncManager::EnterLock: New entry created
USERENV(418.57c) 13:29:11:187 CHashTable::HashAdd: S-1-5-20 added in 
bucket 4
USERENV(418.57c) 13:29:11:187 LoadUserProfile: Wait succeeded. In 
critical section.
USERENV(418.57c) 13:29:11:203 TestIfUserProfileLoaded:  Profile already 
loaded.
USERENV(418.57c) 13:29:11:203 Profile Ref Count is 2
USERENV(418.57c) 13:29:11:203 LoadUserProfile: Leaving critical Section.
USERENV(418.57c) 13:29:11:203 CSyncManager::LeaveLock <S-1-5-20>
USERENV(418.57c) 13:29:11:203 CSyncManager::LeaveLock: Lock released
USERENV(418.57c) 13:29:11:203 CHashTable::HashDelete: S-1-5-20 deleted
USERENV(418.57c) 13:29:11:203 CSyncManager::LeaveLock: Lock deleted
USERENV(418.57c) 13:29:11:203 LoadUserProfile: Impersonated user: 
00000688, 00000690
USERENV(418.57c) 13:29:11:203 LoadUserProfile: Reverted to user: 00000000
USERENV(418.57c) 13:29:11:203 LoadUserProfile: Reverted back to user 
<00000000>
USERENV(418.57c) 13:29:11:203 LoadUserProfile: Leaving with a value of 1.
USERENV(418.57c) 13:29:11:203 
=========================================================
USERENV(418.57c) 13:29:11:203 LoadUserProfileI: returning 0
USERENV(44c.450) 13:29:11:203 LoadUserProfile: Running as self
USERENV(44c.450) 13:29:11:203 LoadUserProfile: Calling LoadUserProfileI 
(as user) succeeded
USERENV(44c.450) 13:29:11:203 LoadUserProfile:  Returning success. Final 
Information follows:
USERENV(44c.450) 13:29:11:203 lpProfileInfo->UserName = <NetworkService>
USERENV(44c.450) 13:29:11:203 lpProfileInfo->lpProfilePath = <>
USERENV(44c.450) 13:29:11:203 lpProfileInfo->dwFlags = 0x9
USERENV(418.438) 13:29:11:203 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.438) 13:29:11:203 ReleaseClientContext: Releasing context
USERENV(418.438) 13:29:11:203 ReleaseClientContext_s: Releasing context
USERENV(418.438) 13:29:11:203 MIDL_user_free enter
USERENV(44c.450) 13:29:11:203 ReleaseInterface: Releasing rpc binding handle
USERENV(44c.450) 13:29:11:203 LoadUserProfile: Returning TRUE. hProfile 
= <0x38c>
USERENV(44c.450) 13:29:11:203 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(44c.450) 13:29:11:203 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(6ac.6b0) 13:29:11:218 LibMain: Process Name: 
C:\WINDOWS\system32\svchost.exe
USERENV(44c.450) 13:29:11:218 LoadUserProfile: Yes, we can impersonate 
the user. Running as self
USERENV(44c.450) 13:29:11:218 
=========================================================
USERENV(44c.450) 13:29:11:218 LoadUserProfile: Entering, hToken = 
<0x3a0>, lpProfileInfo = 0x7fca8
USERENV(44c.450) 13:29:11:218 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(44c.450) 13:29:11:218 LoadUserProfile: lpProfileInfo->lpUserName 
= <LocalService>
USERENV(44c.450) 13:29:11:218 LoadUserProfile: NULL central profile path
USERENV(44c.450) 13:29:11:218 LoadUserProfile: NULL default profile path
USERENV(44c.450) 13:29:11:218 LoadUserProfile: NULL server name
USERENV(44c.450) 13:29:11:218 GetInterface: Returning rpc binding handle
USERENV(418.57c) 13:29:11:218 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.57c) 13:29:11:234 DropClientContext: Got client token 
00000688, sid = S-1-5-18
USERENV(418.57c) 13:29:11:234 MIDL_user_allocate enter
USERENV(418.57c) 13:29:11:234 DropClientContext: load profile object 
successfully made
USERENV(418.57c) 13:29:11:234 DropClientContext: Returning 0
USERENV(44c.450) 13:29:11:234 LoadUserProfile: Calling DropClientToken 
(as self) succeeded
USERENV(418.438) 13:29:11:234 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.438) 13:29:11:234 In LoadUserProfileP
USERENV(418.438) 13:29:11:234 LoadUserProfile: Running as client
USERENV(418.438) 13:29:11:234 
=========================================================
USERENV(418.438) 13:29:11:234 LoadUserProfile: Entering, hToken = 
<0x684>, lpProfileInfo = 0x113ac90
USERENV(418.438) 13:29:11:234 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(418.438) 13:29:11:234 LoadUserProfile: lpProfileInfo->lpUserName 
= <LocalService>
USERENV(418.438) 13:29:11:234 LoadUserProfile: NULL central profile path
USERENV(418.438) 13:29:11:234 LoadUserProfile: NULL default profile path
USERENV(418.438) 13:29:11:234 LoadUserProfile: NULL server name
USERENV(418.438) 13:29:11:234 LoadUserProfile: User sid: S-1-5-19
USERENV(418.438) 13:29:11:234 CSyncManager::EnterLock <S-1-5-19>
USERENV(418.438) 13:29:11:234 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.438) 13:29:11:234 CSyncManager::EnterLock: New entry created
USERENV(418.438) 13:29:11:234 CHashTable::HashAdd: S-1-5-19 added in 
bucket 12
USERENV(418.438) 13:29:11:234 LoadUserProfile: Wait succeeded. In 
critical section.
USERENV(418.438) 13:29:11:234 RestoreUserProfile:  Entering
USERENV(418.438) 13:29:11:234 IsCentralProfileReachable:  Entering
USERENV(418.438) 13:29:11:234 IsCentralProfileReachable:  Null path. Leaving
USERENV(418.438) 13:29:11:234 RestoreUserProfile:  Profile path = <>
USERENV(418.438) 13:29:11:234 ExtractProfileFromBackup:  A profile 
already exists
USERENV(418.438) 13:29:11:234 PatchNewProfileIfRequred: A profile 
already exists with the current sid, exitting
USERENV(418.438) 13:29:11:234 CreateLocalProfileKey:  Not setting 
additional Security
USERENV(418.438) 13:29:11:234 GetExistingLocalProfileImage:  Found entry 
in profile list for existing local profile
USERENV(418.438) 13:29:11:234 GetExistingLocalProfileImage:  Local 
profile image filename = <%SystemDrive%\Documents and Settings\LocalService>
USERENV(418.438) 13:29:11:234 GetExistingLocalProfileImage:  Expanded 
local profile image filename = <C:\Documents and Settings\LocalService>
USERENV(600.620) 13:29:11:234 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.438) 13:29:11:250 GetExistingLocalProfileImage:  No local 
mandatory profile.  Error = 2
USERENV(418.438) 13:29:11:250 GetExistingLocalProfileImage:  Found local 
profile image file ok <C:\Documents and Settings\LocalService\ntuser.dat>
USERENV(418.438) 13:29:11:250 GetExistingLocalProfileImage:  Failed to 
query low profile unload time with error 2
USERENV(418.438) 13:29:11:250 Local Existing Profile Image is reachable
USERENV(418.438) 13:29:11:250 Local profile name is <C:\Documents and 
Settings\LocalService>
USERENV(418.438) 13:29:11:250 RestoreUserProfile:  No central profile. 
Attempting to load local profile.
USERENV(418.438) 13:29:11:375 MyRegLoadKey: Returning 00000000
USERENV(418.438) 13:29:11:640 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(418.438) 13:29:11:656 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.438) 13:29:11:968 MyRegLoadKey: Returning 00000000
USERENV(418.438) 13:29:11:968 CreateClassHive: existing user classes 
hive found
USERENV(418.438) 13:29:12:000 RestoreUserProfile:  About to Leave. Final 
Information follows:
USERENV(418.438) 13:29:12:015 Profile was successfully loaded.
USERENV(418.438) 13:29:12:015 lpProfile->lpRoamingProfile = <>
USERENV(418.438) 13:29:12:015 lpProfile->lpLocalProfile = <C:\Documents 
and Settings\LocalService>
USERENV(418.438) 13:29:12:046 lpProfile->dwInternalFlags = 0x0
USERENV(418.438) 13:29:12:046 RestoreUserProfile:  Leaving.
USERENV(418.438) 13:29:12:250 UpgradeProfile: Entering
USERENV(418.438) 13:29:12:250 UpgradeProfile: Build numbers match
USERENV(418.438) 13:29:12:250 UpgradeProfile: Leaving Successfully
USERENV(418.438) 13:29:12:250 GetProfileType:  Profile already loaded.
USERENV(418.438) 13:29:12:250 LoadProfileInfo:  Failed to query central 
profile with error 2
USERENV(418.438) 13:29:12:250 GetProfileType: ProfileFlags is 0
USERENV(418.438) 13:29:13:140 Profile Ref Count is 1
USERENV(418.438) 13:29:13:140 LoadUserProfile: Leaving critical Section.
USERENV(418.438) 13:29:13:140 CSyncManager::LeaveLock <S-1-5-19>
USERENV(418.438) 13:29:13:140 CSyncManager::LeaveLock: Lock released
USERENV(418.438) 13:29:13:140 CHashTable::HashDelete: S-1-5-19 deleted
USERENV(418.438) 13:29:13:140 CSyncManager::LeaveLock: Lock deleted
USERENV(418.438) 13:29:13:140 LoadUserProfile: Impersonated user: 
00000684, 000006f4
USERENV(458.4c8) 13:29:13:140 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(458.4c8) 13:29:13:140 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(458.4c8) 13:29:13:218 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(458.4c8) 13:29:13:218 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.438) 13:29:13:359 LoadUserProfile: Reverted to user: 00000000
USERENV(418.438) 13:29:13:359 LoadUserProfile: Reverted back to user 
<00000000>
USERENV(418.438) 13:29:13:359 LoadUserProfile: Leaving with a value of 1.
USERENV(418.438) 13:29:13:359 
=========================================================
USERENV(418.438) 13:29:13:359 LoadUserProfileI: returning 0
USERENV(44c.450) 13:29:13:359 LoadUserProfile: Running as self
USERENV(44c.450) 13:29:13:359 LoadUserProfile: Calling LoadUserProfileI 
(as user) succeeded
USERENV(44c.450) 13:29:13:359 LoadUserProfile:  Returning success. Final 
Information follows:
USERENV(44c.450) 13:29:13:359 lpProfileInfo->UserName = <LocalService>
USERENV(44c.450) 13:29:13:359 lpProfileInfo->lpProfilePath = <>
USERENV(44c.450) 13:29:13:406 lpProfileInfo->dwFlags = 0x9
USERENV(418.57c) 13:29:13:406 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.57c) 13:29:13:406 ReleaseClientContext: Releasing context
USERENV(418.57c) 13:29:13:406 ReleaseClientContext_s: Releasing context
USERENV(418.57c) 13:29:13:406 MIDL_user_free enter
USERENV(44c.450) 13:29:13:437 ReleaseInterface: Releasing rpc binding handle
USERENV(44c.450) 13:29:13:437 LoadUserProfile: Returning TRUE. hProfile 
= <0x370>
USERENV(44c.450) 13:29:13:609 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(44c.450) 13:29:13:625 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(760.764) 13:29:13:640 LibMain: Process Name: 
C:\WINDOWS\system32\svchost.exe
USERENV(e8.ec) 13:29:19:203 LibMain: Process Name: 
C:\WINDOWS\system32\spoolsv.exe
USERENV(44c.450) 13:29:19:281 LoadUserProfile: Yes, we can impersonate 
the user. Running as self
USERENV(44c.450) 13:29:19:281 
=========================================================
USERENV(44c.450) 13:29:19:281 LoadUserProfile: Entering, hToken = 
<0x3c8>, lpProfileInfo = 0x7fca8
USERENV(44c.450) 13:29:19:281 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(44c.450) 13:29:19:281 LoadUserProfile: lpProfileInfo->lpUserName 
= <LocalService>
USERENV(44c.450) 13:29:19:281 LoadUserProfile: NULL central profile path
USERENV(44c.450) 13:29:19:281 LoadUserProfile: NULL default profile path
USERENV(44c.450) 13:29:19:281 LoadUserProfile: NULL server name
USERENV(44c.450) 13:29:19:281 GetInterface: Returning rpc binding handle
USERENV(418.438) 13:29:19:296 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.438) 13:29:19:296 DropClientContext: Got client token 
000007D4, sid = S-1-5-18
USERENV(418.438) 13:29:19:296 MIDL_user_allocate enter
USERENV(418.438) 13:29:19:296 DropClientContext: load profile object 
successfully made
USERENV(418.438) 13:29:19:296 DropClientContext: Returning 0
USERENV(44c.450) 13:29:19:296 LoadUserProfile: Calling DropClientToken 
(as self) succeeded
USERENV(418.57c) 13:29:19:296 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.57c) 13:29:19:296 In LoadUserProfileP
USERENV(418.57c) 13:29:19:296 LoadUserProfile: Running as client
USERENV(418.57c) 13:29:19:296 
=========================================================
USERENV(418.57c) 13:29:19:296 LoadUserProfile: Entering, hToken = 
<0x7a4>, lpProfileInfo = 0x1150b40
USERENV(418.57c) 13:29:19:296 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(418.57c) 13:29:19:296 LoadUserProfile: lpProfileInfo->lpUserName 
= <LocalService>
USERENV(418.57c) 13:29:19:296 LoadUserProfile: NULL central profile path
USERENV(418.57c) 13:29:19:296 LoadUserProfile: NULL default profile path
USERENV(418.57c) 13:29:19:296 LoadUserProfile: NULL server name
USERENV(418.57c) 13:29:19:296 LoadUserProfile: User sid: S-1-5-19
USERENV(418.57c) 13:29:19:296 CSyncManager::EnterLock <S-1-5-19>
USERENV(418.57c) 13:29:19:296 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.57c) 13:29:19:296 CSyncManager::EnterLock: New entry created
USERENV(418.57c) 13:29:19:296 CHashTable::HashAdd: S-1-5-19 added in 
bucket 12
USERENV(418.57c) 13:29:19:296 LoadUserProfile: Wait succeeded. In 
critical section.
USERENV(418.57c) 13:29:19:296 TestIfUserProfileLoaded:  Profile already 
loaded.
USERENV(418.57c) 13:29:19:296 Profile Ref Count is 2
USERENV(418.57c) 13:29:19:296 LoadUserProfile: Leaving critical Section.
USERENV(418.57c) 13:29:19:296 CSyncManager::LeaveLock <S-1-5-19>
USERENV(418.57c) 13:29:19:296 CSyncManager::LeaveLock: Lock released
USERENV(418.57c) 13:29:19:296 CHashTable::HashDelete: S-1-5-19 deleted
USERENV(418.57c) 13:29:19:296 CSyncManager::LeaveLock: Lock deleted
USERENV(418.57c) 13:29:19:296 LoadUserProfile: Impersonated user: 
000007a4, 000007b0
USERENV(418.57c) 13:29:19:296 LoadUserProfile: Reverted to user: 00000000
USERENV(418.57c) 13:29:19:296 LoadUserProfile: Reverted back to user 
<00000000>
USERENV(418.57c) 13:29:19:296 LoadUserProfile: Leaving with a value of 1.
USERENV(418.57c) 13:29:19:296 
=========================================================
USERENV(418.57c) 13:29:19:296 LoadUserProfileI: returning 0
USERENV(44c.450) 13:29:19:296 LoadUserProfile: Running as self
USERENV(44c.450) 13:29:19:296 LoadUserProfile: Calling LoadUserProfileI 
(as user) succeeded
USERENV(44c.450) 13:29:19:296 LoadUserProfile:  Returning success. Final 
Information follows:
USERENV(44c.450) 13:29:19:296 lpProfileInfo->UserName = <LocalService>
USERENV(44c.450) 13:29:19:296 lpProfileInfo->lpProfilePath = <>
USERENV(44c.450) 13:29:19:296 lpProfileInfo->dwFlags = 0x9
USERENV(418.438) 13:29:19:296 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.438) 13:29:19:296 ReleaseClientContext: Releasing context
USERENV(418.438) 13:29:19:296 ReleaseClientContext_s: Releasing context
USERENV(418.438) 13:29:19:296 MIDL_user_free enter
USERENV(44c.450) 13:29:19:296 ReleaseInterface: Releasing rpc binding handle
USERENV(44c.450) 13:29:19:296 LoadUserProfile: Returning TRUE. hProfile 
= <0x3c0>
USERENV(44c.450) 13:29:19:296 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(44c.450) 13:29:19:296 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(11c.120) 13:29:19:390 LibMain: Process Name: 
C:\WINDOWS\System32\SCardSvr.exe
USERENV(44c.450) 13:29:19:828 LoadUserProfile: Yes, we can impersonate 
the user. Running as self
USERENV(44c.450) 13:29:19:828 
=========================================================
USERENV(44c.450) 13:29:19:828 LoadUserProfile: Entering, hToken = 
<0x3e0>, lpProfileInfo = 0x7fca8
USERENV(44c.450) 13:29:19:828 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(44c.450) 13:29:19:828 LoadUserProfile: lpProfileInfo->lpUserName 
= <LocalService>
USERENV(44c.450) 13:29:19:828 LoadUserProfile: NULL central profile path
USERENV(44c.450) 13:29:19:828 LoadUserProfile: NULL default profile path
USERENV(44c.450) 13:29:19:828 LoadUserProfile: NULL server name
USERENV(44c.450) 13:29:19:828 GetInterface: Returning rpc binding handle
USERENV(418.57c) 13:29:19:828 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.57c) 13:29:19:828 DropClientContext: Got client token 
000007B4, sid = S-1-5-18
USERENV(418.57c) 13:29:19:828 MIDL_user_allocate enter
USERENV(418.57c) 13:29:19:828 DropClientContext: load profile object 
successfully made
USERENV(418.57c) 13:29:19:828 DropClientContext: Returning 0
USERENV(44c.450) 13:29:19:843 LoadUserProfile: Calling DropClientToken 
(as self) succeeded
USERENV(418.438) 13:29:19:843 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.438) 13:29:19:843 In LoadUserProfileP
USERENV(418.438) 13:29:19:843 LoadUserProfile: Running as client
USERENV(418.438) 13:29:19:843 
=========================================================
USERENV(418.438) 13:29:19:843 LoadUserProfile: Entering, hToken = 
<0x7a0>, lpProfileInfo = 0x115d4d8
USERENV(418.438) 13:29:19:843 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(418.438) 13:29:19:843 LoadUserProfile: lpProfileInfo->lpUserName 
= <LocalService>
USERENV(418.438) 13:29:19:843 LoadUserProfile: NULL central profile path
USERENV(418.438) 13:29:19:843 LoadUserProfile: NULL default profile path
USERENV(418.438) 13:29:19:843 LoadUserProfile: NULL server name
USERENV(418.438) 13:29:19:843 LoadUserProfile: User sid: S-1-5-19
USERENV(418.438) 13:29:19:843 CSyncManager::EnterLock <S-1-5-19>
USERENV(418.438) 13:29:19:843 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.438) 13:29:19:843 CSyncManager::EnterLock: New entry created
USERENV(418.438) 13:29:19:843 CHashTable::HashAdd: S-1-5-19 added in 
bucket 12
USERENV(418.438) 13:29:19:843 LoadUserProfile: Wait succeeded. In 
critical section.
USERENV(418.438) 13:29:19:843 TestIfUserProfileLoaded:  Profile already 
loaded.
USERENV(418.438) 13:29:19:843 Profile Ref Count is 3
USERENV(418.438) 13:29:19:843 LoadUserProfile: Leaving critical Section.
USERENV(418.438) 13:29:19:843 CSyncManager::LeaveLock <S-1-5-19>
USERENV(418.438) 13:29:19:843 CSyncManager::LeaveLock: Lock released
USERENV(418.438) 13:29:19:843 CHashTable::HashDelete: S-1-5-19 deleted
USERENV(418.438) 13:29:19:843 CSyncManager::LeaveLock: Lock deleted
USERENV(418.438) 13:29:19:843 LoadUserProfile: Impersonated user: 
000007a0, 00000780
USERENV(418.438) 13:29:19:843 LoadUserProfile: Reverted to user: 00000000
USERENV(418.438) 13:29:19:843 LoadUserProfile: Reverted back to user 
<00000000>
USERENV(418.438) 13:29:19:843 LoadUserProfile: Leaving with a value of 1.
USERENV(418.438) 13:29:19:843 
=========================================================
USERENV(418.438) 13:29:19:843 LoadUserProfileI: returning 0
USERENV(44c.450) 13:29:19:843 LoadUserProfile: Running as self
USERENV(44c.450) 13:29:19:843 LoadUserProfile: Calling LoadUserProfileI 
(as user) succeeded
USERENV(44c.450) 13:29:19:843 LoadUserProfile:  Returning success. Final 
Information follows:
USERENV(44c.450) 13:29:19:843 lpProfileInfo->UserName = <LocalService>
USERENV(44c.450) 13:29:19:843 lpProfileInfo->lpProfilePath = <>
USERENV(44c.450) 13:29:19:843 lpProfileInfo->dwFlags = 0x9
USERENV(418.57c) 13:29:19:843 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.57c) 13:29:19:843 ReleaseClientContext: Releasing context
USERENV(418.57c) 13:29:19:843 ReleaseClientContext_s: Releasing context
USERENV(418.57c) 13:29:19:843 MIDL_user_free enter
USERENV(44c.450) 13:29:19:843 ReleaseInterface: Releasing rpc binding handle
USERENV(44c.450) 13:29:19:843 LoadUserProfile: Returning TRUE. hProfile 
= <0x3dc>
USERENV(44c.450) 13:29:19:843 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(44c.450) 13:29:19:843 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(15c.160) 13:29:19:890 LibMain: Process Name: 
C:\WINDOWS\system32\svchost.exe
USERENV(418.65c) 13:29:21:640 ApplyGroupPolicy: Entering. Flags = f
USERENV(418.65c) 13:29:21:640 ProcessGPOs:
USERENV(418.65c) 13:29:21:640 ProcessGPOs:
USERENV(418.65c) 13:29:21:640 ProcessGPOs:  Starting computer Group 
Policy (Async forground) processing...
USERENV(418.65c) 13:29:21:640 ProcessGPOs:
USERENV(418.65c) 13:29:21:640 ProcessGPOs:
USERENV(418.65c) 13:29:21:640 EnterCriticalPolicySectionEx: Entering 
with timeout 600000 and flags 0x0
USERENV(418.65c) 13:29:21:640 EnterCriticalPolicySectionEx: Machine 
critical section has been claimed.  Handle = 0x760
USERENV(418.65c) 13:29:21:640 EnterCriticalPolicySectionEx: Leaving 
successfully.
USERENV(418.65c) 13:29:21:640 ProcessGPOs:  Machine role is 2.
USERENV(418.65c) 13:29:21:890 IsSlowLink: Slow link transfer rate is 0. 
  Always download policy.
USERENV(254.258) 13:29:22:875 LibMain: Process Name: 
C:\WINDOWS\System32\svchost.exe
USERENV(2f4.2f8) 13:29:33:546 LibMain: Process Name:  C:\Program 
Files\Trend Micro\OfficeScan Client\ntrtscan.exe
USERENV(260.298) 13:29:35:562 LibMain: Process Name:  C:\Program 
Files\iolo\common\lib\ioloServiceManager.exe
USERENV(760.60c) 13:29:37:593 ImpersonateUser: Failed to impersonate 
user with 5.
USERENV(760.60c) 13:29:37:593 GetUserNameAndDomain Failed to impersonate 
user
USERENV(760.60c) 13:29:37:593 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(760.60c) 13:29:37:593 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(2f4.350) 13:29:39:296 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.720) 13:29:41:703 IsSyncForegroundPolicyRefresh: 
Synchronous, Reason: ForcedSyncRefresh
USERENV(418.41c) 13:29:41:953 LoadUserProfile: Yes, we can impersonate 
the user. Running as self
USERENV(418.41c) 13:29:41:953 
=========================================================
USERENV(418.41c) 13:29:41:953 LoadUserProfile: Entering, hToken = 
<0x7ec>, lpProfileInfo = 0x6e3e0
USERENV(418.41c) 13:29:41:953 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x0>
USERENV(418.41c) 13:29:41:953 LoadUserProfile: lpProfileInfo->lpUserName 
= <user1>
USERENV(418.41c) 13:29:41:953 LoadUserProfile: NULL central profile path
USERENV(418.41c) 13:29:42:000 LoadUserProfile: 
lpProfileInfo->lpDefaultPath = <\\DomainC4\netlogon\Default User>
USERENV(418.41c) 13:29:42:062 LoadUserProfile: NULL server name
USERENV(418.41c) 13:29:42:062 LoadUserProfile: In console winlogon process
USERENV(418.41c) 13:29:42:062 In LoadUserProfileP
USERENV(418.41c) 13:29:42:062 
=========================================================
USERENV(418.41c) 13:29:42:062 LoadUserProfile: Entering, hToken = 
<0x7ec>, lpProfileInfo = 0x6e3e0
USERENV(418.41c) 13:29:42:062 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x0>
USERENV(418.41c) 13:29:42:062 LoadUserProfile: lpProfileInfo->lpUserName 
= <user1>
USERENV(418.41c) 13:29:42:062 LoadUserProfile: NULL central profile path
USERENV(418.41c) 13:29:42:062 LoadUserProfile: 
lpProfileInfo->lpDefaultPath = <\\DomainC4\netlogon\Default User>
USERENV(418.41c) 13:29:42:062 LoadUserProfile: NULL server name
USERENV(418.41c) 13:29:42:062 LoadUserProfile: User sid: 
S-1-5-21-3558745915-3620255497-2782363364-2817
USERENV(418.41c) 13:29:42:062 CSyncManager::EnterLock 
<S-1-5-21-3558745915-3620255497-2782363364-2817>
USERENV(418.41c) 13:29:42:062 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.41c) 13:29:42:062 CSyncManager::EnterLock: New entry created
USERENV(418.41c) 13:29:42:062 CHashTable::HashAdd: 
S-1-5-21-3558745915-3620255497-2782363364-2817 added in bucket 19
USERENV(418.41c) 13:29:42:062 LoadUserProfile: Wait succeeded. In 
critical section.
USERENV(418.41c) 13:29:42:062 RestoreUserProfile:  Entering
USERENV(418.41c) 13:29:42:062 RestoreUserProfile:  User is a Admin
USERENV(418.41c) 13:29:42:062 IsCentralProfileReachable:  Entering
USERENV(418.41c) 13:29:42:062 IsCentralProfileReachable:  Null path. Leaving
USERENV(418.41c) 13:29:42:078 RestoreUserProfile:  Profile path = <>
USERENV(418.41c) 13:29:42:078 ExtractProfileFromBackup:  A profile 
already exists
USERENV(418.41c) 13:29:42:078 PatchNewProfileIfRequred: A profile 
already exists with the current sid, exitting
USERENV(418.41c) 13:29:42:078 CreateLocalProfileKey:  Not setting 
additional Security
USERENV(418.41c) 13:29:42:078 GetExistingLocalProfileImage:  Found entry 
in profile list for existing local profile
USERENV(418.41c) 13:29:42:078 GetExistingLocalProfileImage:  Local 
profile image filename = <%SystemDrive%\Documents and Settings\user1>
USERENV(418.41c) 13:29:42:078 GetExistingLocalProfileImage:  Expanded 
local profile image filename = <C:\Documents and Settings\user1>
USERENV(418.41c) 13:29:42:078 GetExistingLocalProfileImage:  No local 
mandatory profile.  Error = 2
USERENV(418.41c) 13:29:42:078 GetExistingLocalProfileImage:  Found local 
profile image file ok <C:\Documents and Settings\user1\ntuser.dat>
USERENV(418.41c) 13:29:42:078 GetExistingLocalProfileImage:  Failed to 
query low profile unload time with error 2
USERENV(418.41c) 13:29:42:078 Local Existing Profile Image is reachable
USERENV(418.41c) 13:29:42:078 Local profile name is <C:\Documents and 
Settings\user1>
USERENV(418.41c) 13:29:42:078 RestoreUserProfile:  No central profile. 
Attempting to load local profile.
USERENV(418.41c) 13:29:42:390 MyRegLoadKey: Returning 00000000
USERENV(418.41c) 13:29:42:390 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.41c) 13:29:42:828 MyRegLoadKey: Returning 00000000
USERENV(418.41c) 13:29:42:828 CreateClassHive: existing user classes 
hive found
USERENV(418.41c) 13:29:42:828 RestoreUserProfile:  About to Leave. Final 
Information follows:
USERENV(418.41c) 13:29:42:828 Profile was successfully loaded.
USERENV(418.41c) 13:29:42:828 lpProfile->lpRoamingProfile = <>
USERENV(418.41c) 13:29:42:828 lpProfile->lpLocalProfile = <C:\Documents 
and Settings\user1>
USERENV(418.41c) 13:29:42:828 lpProfile->dwInternalFlags = 0x100
USERENV(418.41c) 13:29:42:828 RestoreUserProfile:  Leaving.
USERENV(418.41c) 13:29:42:875 UpgradeProfile: Entering
USERENV(418.41c) 13:29:42:875 UpgradeProfile: Build numbers match
USERENV(418.41c) 13:29:42:875 UpgradeProfile: Leaving Successfully
USERENV(418.41c) 13:29:42:875 GetProfileType:  Profile already loaded.
USERENV(418.41c) 13:29:42:875 LoadProfileInfo:  Failed to query central 
profile with error 2
USERENV(418.41c) 13:29:42:875 GetProfileType: ProfileFlags is 0
USERENV(418.41c) 13:29:43:203 Profile Ref Count is 1
USERENV(418.41c) 13:29:43:203 LoadUserProfile: Leaving critical Section.
USERENV(418.41c) 13:29:43:203 CSyncManager::LeaveLock 
<S-1-5-21-3558745915-3620255497-2782363364-2817>
USERENV(418.41c) 13:29:43:203 CSyncManager::LeaveLock: Lock released
USERENV(418.41c) 13:29:43:203 CHashTable::HashDelete: 
S-1-5-21-3558745915-3620255497-2782363364-2817 deleted
USERENV(418.41c) 13:29:43:203 CSyncManager::LeaveLock: Lock deleted
USERENV(418.41c) 13:29:43:203 LoadUserProfile: Impersonated user: 
000007ec, 00000000
USERENV(458.4a8) 13:29:43:218 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(458.4a8) 13:29:43:359 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.41c) 13:29:43:500 LoadUserProfile: Reverted to user: 00000000
USERENV(418.41c) 13:29:43:500 LoadUserProfile: Leaving with a value of 1.
USERENV(418.41c) 13:29:43:500 
=========================================================
USERENV(418.41c) 13:29:43:500 LoadUserProfile: LoadUserProfileP succeeded
USERENV(418.41c) 13:29:43:500 LoadUserProfile:  Returning success. Final 
Information follows:
USERENV(418.41c) 13:29:43:500 lpProfileInfo->UserName = <user1>
USERENV(418.41c) 13:29:43:500 lpProfileInfo->lpProfilePath = <>
USERENV(418.41c) 13:29:43:500 lpProfileInfo->dwFlags = 0x0
USERENV(418.41c) 13:29:43:500 LoadUserProfile: Returning TRUE. hProfile 
= <0x810>
USERENV(418.41c) 13:29:43:515 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.41c) 13:29:44:281 IsSyncForegroundPolicyRefresh: 
Synchronous, Reason: ForcedSyncRefresh
USERENV(418.774) 13:29:44:281 IsSyncForegroundPolicyRefresh: 
Synchronous, Reason: ForcedSyncRefresh
USERENV(790.784) 13:29:46:781 LibMain: Process Name: 
C:\WINDOWS\system32\wuauclt.exe
USERENV(44c.450) 13:29:47:453 LoadUserProfile: Yes, we can impersonate 
the user. Running as self
USERENV(44c.450) 13:29:47:453 
=========================================================
USERENV(44c.450) 13:29:47:484 LoadUserProfile: Entering, hToken = 
<0x484>, lpProfileInfo = 0x7fca8
USERENV(44c.450) 13:29:47:546 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(44c.450) 13:29:47:578 LoadUserProfile: lpProfileInfo->lpUserName 
= <NetworkService>
USERENV(44c.450) 13:29:47:609 LoadUserProfile: NULL central profile path
USERENV(44c.450) 13:29:47:640 LoadUserProfile: NULL default profile path
USERENV(44c.450) 13:29:47:671 LoadUserProfile: NULL server name
USERENV(44c.450) 13:29:47:703 GetInterface: Returning rpc binding handle
USERENV(418.438) 13:29:47:765 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.438) 13:29:47:765 DropClientContext: Got client token 
0000038C, sid = S-1-5-18
USERENV(418.438) 13:29:47:765 MIDL_user_allocate enter
USERENV(418.438) 13:29:47:765 DropClientContext: load profile object 
successfully made
USERENV(418.438) 13:29:47:765 DropClientContext: Returning 0
USERENV(44c.450) 13:29:47:765 LoadUserProfile: Calling DropClientToken 
(as self) succeeded
USERENV(418.57c) 13:29:47:796 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.57c) 13:29:47:796 In LoadUserProfileP
USERENV(418.57c) 13:29:47:796 LoadUserProfile: Running as client
USERENV(418.57c) 13:29:47:796 
=========================================================
USERENV(418.57c) 13:29:47:796 LoadUserProfile: Entering, hToken = 
<0x390>, lpProfileInfo = 0x1133af0
USERENV(418.57c) 13:29:47:796 LoadUserProfile: lpProfileInfo->dwFlags = 
<0x9>
USERENV(418.57c) 13:29:47:796 LoadUserProfile: lpProfileInfo->lpUserName 
= <NetworkService>
USERENV(418.57c) 13:29:47:796 LoadUserProfile: NULL central profile path
USERENV(418.57c) 13:29:47:796 LoadUserProfile: NULL default profile path
USERENV(418.57c) 13:29:47:796 LoadUserProfile: NULL server name
USERENV(418.57c) 13:29:47:796 LoadUserProfile: User sid: S-1-5-20
USERENV(418.57c) 13:29:47:796 CSyncManager::EnterLock <S-1-5-20>
USERENV(418.57c) 13:29:47:796 CSyncManager::EnterLock: No existing entry 
found
USERENV(418.57c) 13:29:47:796 CSyncManager::EnterLock: New entry created
USERENV(418.57c) 13:29:47:796 CHashTable::HashAdd: S-1-5-20 added in 
bucket 4
USERENV(418.57c) 13:29:47:796 LoadUserProfile: Wait succeeded. In 
critical section.
USERENV(418.57c) 13:29:47:796 TestIfUserProfileLoaded:  Profile already 
loaded.
USERENV(418.57c) 13:29:47:796 Profile Ref Count is 3
USERENV(418.57c) 13:29:47:796 LoadUserProfile: Leaving critical Section.
USERENV(418.57c) 13:29:47:796 CSyncManager::LeaveLock <S-1-5-20>
USERENV(418.57c) 13:29:47:796 CSyncManager::LeaveLock: Lock released
USERENV(418.57c) 13:29:47:796 CHashTable::HashDelete: S-1-5-20 deleted
USERENV(418.57c) 13:29:47:796 CSyncManager::LeaveLock: Lock deleted
USERENV(418.57c) 13:29:47:796 LoadUserProfile: Impersonated user: 
00000390, 000007e8
USERENV(418.57c) 13:29:47:796 LoadUserProfile: Reverted to user: 00000000
USERENV(418.57c) 13:29:47:796 LoadUserProfile: Reverted back to user 
<00000000>
USERENV(418.57c) 13:29:47:796 LoadUserProfile: Leaving with a value of 1.
USERENV(418.57c) 13:29:47:796 
=========================================================
USERENV(418.57c) 13:29:47:796 LoadUserProfileI: returning 0
USERENV(44c.450) 13:29:47:796 LoadUserProfile: Running as self
USERENV(44c.450) 13:29:47:828 LoadUserProfile: Calling LoadUserProfileI 
(as user) succeeded
USERENV(44c.450) 13:29:47:859 LoadUserProfile:  Returning success. Final 
Information follows:
USERENV(44c.450) 13:29:47:890 lpProfileInfo->UserName = <NetworkService>
USERENV(44c.450) 13:29:47:890 lpProfileInfo->lpProfilePath = <>
USERENV(44c.450) 13:29:47:890 lpProfileInfo->dwFlags = 0x9
USERENV(418.438) 13:29:47:890 IProfileSecurityCallBack: client 
authenticated.
USERENV(418.438) 13:29:47:890 ReleaseClientContext: Releasing context
USERENV(418.438) 13:29:47:890 ReleaseClientContext_s: Releasing context
USERENV(418.438) 13:29:47:890 MIDL_user_free enter
USERENV(44c.450) 13:29:47:890 ReleaseInterface: Releasing rpc binding handle
USERENV(44c.450) 13:29:47:890 LoadUserProfile: Returning TRUE. hProfile 
= <0x490>
USERENV(44c.450) 13:29:47:890 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(44c.450) 13:29:47:890 ProcessAutoexec: Cannot process autoexec.bat.
0
Patrick
4/28/2010 9:03:04 AM
Dear Paul,

5) Continue ...

USERENV(c0.cc) 13:29:49:968 LibMain: Process Name:  C:\Program 
Files\Windows Media Player\WMPNetwk.exe
USERENV(418.65c) 13:30:12:656 ProcessGPOs: network name is mycompany.com
USERENV(418.65c) 13:30:16:218 ProcessGPOs:  User name is: 
CN=FINANCE1,OU=HeadOffice,OU=Workstations,DC=mycompany,DC=com, Domain 
name is:  mycompany
USERENV(418.65c) 13:30:16:218 ProcessGPOs: Domain controller is: 
\\DomainC4.mycompany.com  Domain DN is mycompany.com
USERENV(418.65c) 13:30:16:218 ReadGPExtensions: Rsop entry point not 
found for gptext.dll.
USERENV(418.65c) 13:30:16:218 ReadGPExtensions: Rsop entry point not 
found for dskquota.dll.
USERENV(418.65c) 13:30:16:218 ReadGPExtensions: Rsop entry point not 
found for gptext.dll.
USERENV(418.65c) 13:30:16:281 ReadGPExtensions: Rsop entry point not 
found for C:\WINDOWS\system32\iedkcs32.dll.
USERENV(418.65c) 13:30:16:281 ReadGPExtensions: Rsop entry point not 
found for C:\WINDOWS\system32\iedkcs32.dll.
USERENV(418.65c) 13:30:16:281 ReadGPExtensions: Rsop entry point not 
found for scecli.dll.
USERENV(418.65c) 13:30:16:281 ReadGPExtensions: Rsop entry point not 
found for C:\WINDOWS\System32\cscui.dll.
USERENV(418.65c) 13:30:16:281 ReadGPExtensions: Rsop entry point not 
found for C:\WINDOWS\system32\iedkcs32.dll.
USERENV(418.65c) 13:30:16:281 ReadGPExtensions: Rsop entry point not 
found for gptext.dll.
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {35378EAC-683F-11D2-A89A-00C04FBBCFA2}
USERENV(418.65c) 13:30:16:281 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {0E28E245-9368-4853-AD84-6DA3BA35BB75}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {17D89FEC-5C44-4972-B12D-241CAEF74509}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {1A6364EB-776B-4120-ADE1-B63A406A76B5}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {25537BA6-77A8-11D2-9B6C-0000F8080861}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {3610eda5-77ef-11d2-8dc5-00c04fa31a66}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {426031c0-0b47-4852-b0ca-ac3d37bfcb39}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {42B5FAAE-6536-11d2-AE5A-0000F87571E3}
USERENV(418.65c) 13:30:16:281 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {5794DAFD-BE60-433f-88A2-1A31939AC01F}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {6232C319-91AC-4931-9385-E70C2B099F0E}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {7150F9BF-48AD-4da4-A49C-29EF4A8369BA}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {728EE579-943C-4519-9EF7-AB56765798ED}
USERENV(418.65c) 13:30:16:281 ReadExtStatus: Reading Previous Status for 
extension {74EE6C03-5363-4554-B161-627540339CAB}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {7B849a69-220F-451E-B3FE-2CB811AF94AE}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {827D319E-6EAC-11D2-A4EA-00C04F79F83A}
USERENV(418.65c) 13:30:16:296 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {91FBB303-0CD5-4055-BF42-E512A681B325}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {A3F3E39B-5D83-4940-B954-28315B82F0A8}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {AADCED64-746C-4633-A97C-D61349046527}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {B087BE9D-ED37-454f-AF9C-04291E351182}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}
USERENV(418.65c) 13:30:16:296 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {B587E2B1-4D59-4e7e-AED9-22B9DF11D053}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {C631DF4C-088F-4156-B058-4375F0853CD8}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {c6dc5466-785a-11d2-84d0-00c04fb169f7}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {e437bc1c-aa7d-11d2-a382-00c04f991e27}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {E47248BA-94CC-49c4-BBB5-9EB7F05183D0}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {E4F48E54-F38D-4884-BFB9-D4D2E5729C18}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {E5094040-C46C-4115-B030-04FB2E545B00}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {E62688F0-25FD-4c90-BFF5-F508B9D2E31F}
USERENV(418.65c) 13:30:16:296 ReadExtStatus: Reading Previous Status for 
extension {F9C77450-3A41-477E-9310-9ACD617BD9E3}
USERENV(418.65c) 13:30:16:296 ProcessGPOs: Calling GetGPOInfo for normal 
policy mode
USERENV(418.65c) 13:30:16:328 GetGPOInfo:  ********************************
USERENV(418.65c) 13:30:16:328 GetGPOInfo:  Entering...
USERENV(418.65c) 13:30:16:546 GetGPOInfo:  Server connection established.
USERENV(418.65c) 13:30:16:593 GetGPOInfo:  Bound successfully.
USERENV(418.65c) 13:30:16:656 SearchDSObject:  Searching 
<OU=HeadOffice,OU=Workstations,DC=mycompany,DC=com>
USERENV(418.65c) 13:30:16:656 SearchDSObject:  No GPO(s) for this object.
USERENV(418.65c) 13:30:16:656 SearchDSObject:  Searching 
<OU=Workstations,DC=mycompany,DC=com>
USERENV(418.65c) 13:30:16:656 SearchDSObject:  Found GPO(s): 
<[LDAP://CN={614546A6-25E6-416D-8A5D-B8A56FB3A986},CN=Policies,CN=System,DC=mycompany,DC=com;0]>
USERENV(418.65c) 13:30:16:656 ProcessGPO:  ==============================
USERENV(418.65c) 13:30:16:656 ProcessGPO:  Deferring search for 
<LDAP://CN={614546A6-25E6-416D-8A5D-B8A56FB3A986},CN=Policies,CN=System,DC=mycompany,DC=com>
USERENV(418.65c) 13:30:16:656 SearchDSObject:  Searching 
<DC=mycompany,DC=com>
USERENV(418.65c) 13:30:16:656 SearchDSObject:  Found GPO(s): 
<[LDAP://CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mycompany,DC=com;0]>
USERENV(418.65c) 13:30:16:656 ProcessGPO:  ==============================
USERENV(418.65c) 13:30:16:656 ProcessGPO:  Deferring search for 
<LDAP://CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mycompany,DC=com>
USERENV(418.65c) 13:30:16:671 SearchDSObject:  Searching 
<CN=mycompany,CN=Sites,CN=Configuration,DC=mycompany,DC=com>
USERENV(418.65c) 13:30:16:671 SearchDSObject:  No GPO(s) for this object.
USERENV(418.65c) 13:30:16:703 EvaluateDeferredGPOs:  Searching for GPOs 
in cn=policies,cn=system,DC=mycompany,DC=com
USERENV(418.65c) 13:30:16:718 ProcessGPO:  ==============================
USERENV(418.65c) 13:30:16:718 ProcessGPO:  Searching 
<CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mycompany,DC=com>
USERENV(418.65c) 13:30:16:718 ProcessGPO:  Machine has access to this GPO.
USERENV(418.65c) 13:30:16:718 ProcessGPO:  GPO passes the filter check.
USERENV(418.65c) 13:30:16:718 ProcessGPO:  Found functionality version 
of:  2
USERENV(418.65c) 13:30:16:718 ProcessGPO:  Found file system path of: 
<\\mycompany.com\sysvol\mycompany.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}>
USERENV(418.65c) 13:30:17:484 ProcessGPO:  Found common name of: 
<{31B2F340-016D-11D2-945F-00C04FB984F9}>
USERENV(418.65c) 13:30:17:484 ProcessGPO:  Found display name of: 
<Default Domain Policy>
USERENV(418.65c) 13:30:17:484 ProcessGPO:  Found machine version of: GPC 
is 54, GPT is 54
USERENV(418.65c) 13:30:17:484 ProcessGPO:  Found flags of:  0
USERENV(418.65c) 13:30:17:484 ProcessGPO:  Found extensions: 
[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957D-509E-11D1-A7CC-0000F87571E3}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]
USERENV(418.65c) 13:30:17:484 ProcessGPO:  ==============================
USERENV(418.65c) 13:30:17:484 ProcessGPO:  ==============================
USERENV(418.65c) 13:30:17:484 ProcessGPO:  Searching 
<CN={614546A6-25E6-416D-8A5D-B8A56FB3A986},CN=Policies,CN=System,DC=mycompany,DC=com>
USERENV(418.65c) 13:30:17:484 ProcessGPO:  Machine has access to this GPO.
USERENV(418.65c) 13:30:17:484 ProcessGPO:  GPO passes the filter check.
USERENV(418.65c) 13:30:17:500 ProcessGPO:  Found functionality version 
of:  2
USERENV(418.65c) 13:30:17:500 ProcessGPO:  Found file system path of: 
<\\mycompany.com\SysVol\mycompany.com\Policies\{614546A6-25E6-416D-8A5D-B8A56FB3A986}>
USERENV(418.65c) 13:30:17:515 ProcessGPO:  Found common name of: 
<{614546A6-25E6-416D-8A5D-B8A56FB3A986}>
USERENV(418.65c) 13:30:17:515 ProcessGPO:  Found display name of: 
<Workstations>
USERENV(418.65c) 13:30:17:515 ProcessGPO:  Found machine version of: GPC 
is 189, GPT is 189
USERENV(418.65c) 13:30:17:515 ProcessGPO:  Found flags of:  0
USERENV(418.65c) 13:30:17:515 ProcessGPO:  Found extensions: 
[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957D-509E-11D1-A7CC-0000F87571E3}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B6664F-4972-11D1-A7CA-0000F87571E3}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}]
USERENV(418.65c) 13:30:17:515 ProcessGPO:  ==============================
USERENV(418.65c) 13:30:17:609 GetGPOInfo:  Leaving with 1
USERENV(418.65c) 13:30:17:609 GetGPOInfo:  ********************************
USERENV(418.65c) 13:30:17:890 ProcessGPOs: Logging Data for Target 
<FINANCE1>.
USERENV(418.65c) 13:30:18:156 ProcessGPOs: OpenThreadToken failed with 
error 1008, assuming thread is not impersonating
USERENV(418.65c) 13:30:18:156 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:156 ProcessGPOs: Processing extension Registry
USERENV(418.65c) 13:30:18:156 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.65c) 13:30:18:156 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:156 CheckGPOs: No GPO changes and no security 
group membership change and extension Registry has NoGPOChanges set.
USERENV(418.65c) 13:30:18:156 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:156 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:156 ProcessGPOs: Processing extension Wireless
USERENV(418.65c) 13:30:18:156 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:156 CheckGPOs: No GPO changes but couldn't 
read extension Wireless's status or policy time.
USERENV(418.65c) 13:30:18:156 ProcessGPOs: Extension Wireless skipped 
because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:156 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:156 ProcessGPOs: Processing extension Group 
Policy Environment
USERENV(418.65c) 13:30:18:156 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:156 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Environment's status or policy time.
USERENV(418.65c) 13:30:18:156 ProcessGPOs: Extension Group Policy 
Environment skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:156 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:156 ProcessGPOs: Processing extension Group 
Policy Local Users and Groups
USERENV(418.65c) 13:30:18:156 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:156 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Local Users and Groups's status or policy time.
USERENV(418.65c) 13:30:18:156 ProcessGPOs: Extension Group Policy Local 
Users and Groups skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.65c) 13:30:18:156 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:156 ProcessGPOs: Processing extension Group 
Policy Device Settings
USERENV(418.65c) 13:30:18:156 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:156 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Device Settings's status or policy time.
USERENV(418.65c) 13:30:18:156 ProcessGPOs: Extension Group Policy Device 
Settings skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Processing extension Folder 
Redirection
USERENV(418.65c) 13:30:18:171 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:171 CheckGPOs: No GPO changes but couldn't 
read extension Folder Redirection's status or policy time.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Extension Folder Redirection 
skipped with flags 0x1000f.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Processing extension 
Microsoft Disk Quota
USERENV(418.65c) 13:30:18:171 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:171 CheckGPOs: No GPO changes but couldn't 
read extension Microsoft Disk Quota's status or policy time.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Extension Microsoft Disk 
Quota skipped with flags 0x1000f.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Processing extension Group 
Policy Network Options
USERENV(418.65c) 13:30:18:171 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:171 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Network Options's status or policy time.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Extension Group Policy 
Network Options skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Processing extension QoS 
Packet Scheduler
USERENV(418.65c) 13:30:18:171 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:171 CheckGPOs: No GPO changes but couldn't 
read extension QoS Packet Scheduler's status or policy time.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Extension QoS Packet 
Scheduler skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Processing extension Scripts
USERENV(418.65c) 13:30:18:171 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.65c) 13:30:18:171 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:171 CheckGPOs: No GPO changes and no security 
group membership change and extension Scripts has NoGPOChanges set.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:171 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Processing extension Internet 
Explorer Zonemapping
USERENV(418.65c) 13:30:18:171 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:171 CheckGPOs: No GPO changes but couldn't 
read extension Internet Explorer Zonemapping's status or policy time.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Extension Internet Explorer 
Zonemapping skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Processing extension Group 
Policy Drive Maps
USERENV(418.65c) 13:30:18:171 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:171 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Drive Maps's status or policy time.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: Extension Group Policy Drive 
Maps skipped with flags 0x1000f.
USERENV(418.65c) 13:30:18:171 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:187 ProcessGPOs: Processing extension Group 
Policy Folders
USERENV(418.65c) 13:30:18:187 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:234 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Folders's status or policy time.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Extension Group Policy 
Folders skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Processing extension Group 
Policy Network Shares
USERENV(418.65c) 13:30:18:234 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:234 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Network Shares's status or policy time.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Extension Group Policy 
Network Shares skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Processing extension Group 
Policy Files
USERENV(418.65c) 13:30:18:234 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:234 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Files's status or policy time.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Extension Group Policy Files 
skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Processing extension Group 
Policy Data Sources
USERENV(418.65c) 13:30:18:234 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:234 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Data Sources's status or policy time.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Extension Group Policy Data 
Sources skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Processing extension Group 
Policy Ini Files
USERENV(418.65c) 13:30:18:234 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:234 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Ini Files's status or policy time.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Extension Group Policy Ini 
Files skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Processing extension Internet 
Explorer User Accelerators
USERENV(418.65c) 13:30:18:234 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:234 CheckGPOs: No GPO changes but couldn't 
read extension Internet Explorer User Accelerators's status or policy time.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Extension Internet Explorer 
User Accelerators skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.65c) 13:30:18:234 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:234 ProcessGPOs: Processing extension Security
USERENV(418.65c) 13:30:18:234 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.65c) 13:30:18:250 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:250 CheckGPOs: No GPO changes and no security 
group membership change and extension Security has NoGPOChanges set.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:250 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Processing extension Group 
Policy Services
USERENV(418.65c) 13:30:18:250 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:250 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Services's status or policy time.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Extension Group Policy 
Services skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Processing extension Internet 
Explorer Branding
USERENV(418.65c) 13:30:18:250 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:250 CheckGPOs: No GPO changes but couldn't 
read extension Internet Explorer Branding's status or policy time.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Extension Internet Explorer 
Branding skipped with flags 0x1000f.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Processing extension Group 
Policy Folder Options
USERENV(418.65c) 13:30:18:250 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:250 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Folder Options's status or policy time.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Extension Group Policy Folder 
Options skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Processing extension Group 
Policy Scheduled Tasks
USERENV(418.65c) 13:30:18:250 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:250 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Scheduled Tasks's status or policy time.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Extension Group Policy 
Scheduled Tasks skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Processing extension Group 
Policy Registry
USERENV(418.65c) 13:30:18:250 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:250 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Registry's status or policy time.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Extension Group Policy 
Registry skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Processing extension EFS recovery
USERENV(418.65c) 13:30:18:250 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.65c) 13:30:18:250 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:250 CheckGPOs: No GPO changes and no security 
group membership change and extension EFS recovery has NoGPOChanges set.
USERENV(418.65c) 13:30:18:250 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:250 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:250 ProcessGPOs: Processing extension 802.3 
Group Policy
USERENV(418.65c) 13:30:18:250 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:250 CheckGPOs: No GPO changes but couldn't 
read extension 802.3 Group Policy's status or policy time.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Extension 802.3 Group Policy 
skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Processing extension Group 
Policy Printers
USERENV(418.65c) 13:30:18:265 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:265 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Printers's status or policy time.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Extension Group Policy 
Printers skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Processing extension Group 
Policy Shortcuts
USERENV(418.65c) 13:30:18:265 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:265 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Shortcuts's status or policy time.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Extension Group Policy 
Shortcuts skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Processing extension 
Microsoft Offline Files
USERENV(418.65c) 13:30:18:265 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:265 CheckGPOs: No GPO changes but couldn't 
read extension Microsoft Offline Files's status or policy time.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Extension Microsoft Offline 
Files skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Processing extension Software 
Installation
USERENV(418.65c) 13:30:18:265 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:265 CheckGPOs: No GPO changes but couldn't 
read extension Software Installation's status or policy time.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Extension Software 
Installation skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Processing extension Internet 
Explorer Machine Accelerators
USERENV(418.65c) 13:30:18:265 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:265 CheckGPOs: No GPO changes but couldn't 
read extension Internet Explorer Machine Accelerators's status or policy 
time.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Extension Internet Explorer 
Machine Accelerators skipped because both deleted and changed GPO lists 
are empty.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Processing extension IP Security
USERENV(418.65c) 13:30:18:265 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:265 CheckGPOs: No GPO changes but couldn't 
read extension IP Security's status or policy time.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Extension IP Security skipped 
because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Processing extension Group 
Policy Internet Settings
USERENV(418.65c) 13:30:18:265 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:265 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Internet Settings's status or policy time.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: Extension Group Policy 
Internet Settings skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.65c) 13:30:18:265 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:281 ProcessGPOs: Processing extension Group 
Policy Start Menu Settings
USERENV(418.65c) 13:30:18:281 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:281 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Start Menu Settings's status or policy time.
USERENV(418.65c) 13:30:18:281 ProcessGPOs: Extension Group Policy Start 
Menu Settings skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:281 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:281 ProcessGPOs: Processing extension Group 
Policy Regional Options
USERENV(418.65c) 13:30:18:281 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:281 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Regional Options's status or policy time.
USERENV(418.65c) 13:30:18:281 ProcessGPOs: Extension Group Policy 
Regional Options skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.65c) 13:30:18:281 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:281 ProcessGPOs: Processing extension Group 
Policy Power Options
USERENV(418.65c) 13:30:18:281 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:281 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Power Options's status or policy time.
USERENV(418.65c) 13:30:18:281 ProcessGPOs: Extension Group Policy Power 
Options skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:281 ProcessGPOs: -----------------------
USERENV(418.65c) 13:30:18:281 ProcessGPOs: Processing extension Group 
Policy Applications
USERENV(418.65c) 13:30:18:281 CompareGPOLists:  The lists are the same.
USERENV(418.65c) 13:30:18:281 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Applications's status or policy time.
USERENV(418.65c) 13:30:18:281 ProcessGPOs: Extension Group Policy 
Applications skipped because both deleted and changed GPO lists are empty.
USERENV(418.65c) 13:30:18:281 SetFgRefreshInfo: Previous Machine Fg 
policy Asynchronous, Reason: NoNeedForSync.
USERENV(418.65c) 13:30:18:281 ProcessGPOs: No WMI logging done in this 
policy cycle.
USERENV(418.65c) 13:30:18:375 LeaveCriticalPolicySection: Critical 
section 0x760 has been released.
USERENV(418.65c) 13:30:18:375 ProcessGPOs: Computer Group Policy has 
been applied.
USERENV(418.65c) 13:30:18:375 ProcessGPOs: Leaving with 1.
USERENV(418.65c) 13:30:18:375 ApplyGroupPolicy: Leaving successfully.
USERENV(418.858) 13:30:18:375 GPOThread:  Next refresh will happen in 
103 minutes
USERENV(418.774) 13:30:18:578 ApplyGroupPolicy: Entering. Flags = 6
USERENV(418.774) 13:30:18:578 ProcessGPOs:
USERENV(418.774) 13:30:18:578 ProcessGPOs:
USERENV(418.774) 13:30:18:578 ProcessGPOs: Starting user Group Policy 
(Background) processing...
USERENV(418.774) 13:30:18:578 ProcessGPOs:
USERENV(418.774) 13:30:18:578 ProcessGPOs:
USERENV(418.774) 13:30:18:578 EnterCriticalPolicySectionEx: Entering 
with timeout 600000 and flags 0x0
USERENV(418.774) 13:30:18:578 EnterCriticalPolicySectionEx: User 
critical section has been claimed.  Handle = 0x82c
USERENV(418.774) 13:30:18:578 EnterCriticalPolicySectionEx: Leaving 
successfully.
USERENV(418.774) 13:30:18:578 ProcessGPOs:  Machine role is 2.
USERENV(418.774) 13:30:18:578 PingComputer: PingBufferSize set as 2048
USERENV(860.868) 13:30:18:703 LibMain: Process Name: 
C:\WINDOWS\system32\userinit.exe
USERENV(418.774) 13:30:18:812 PingComputer: Adapter speed 1000000000 bps
USERENV(418.774) 13:30:18:812 PingComputer:  First time:  2
USERENV(418.774) 13:30:18:812 PingComputer:  Fast link.  Exiting.
USERENV(418.774) 13:30:19:140 ProcessGPOs:  User name is: 
CN=user1,OU=HeadOffice,OU=mycompany,DC=mycompany,DC=com, Domain name is: 
  mycompany
USERENV(418.774) 13:30:19:140 ProcessGPOs: Domain controller is: 
\\DomainC4.mycompany.com  Domain DN is mycompany.com
USERENV(418.774) 13:30:19:312 ReadGPExtensions: Rsop entry point not 
found for gptext.dll.
USERENV(418.774) 13:30:19:312 ReadGPExtensions: Rsop entry point not 
found for dskquota.dll.
USERENV(418.774) 13:30:19:312 ReadGPExtensions: Rsop entry point not 
found for gptext.dll.
USERENV(418.774) 13:30:19:328 ReadGPExtensions: Rsop entry point not 
found for C:\WINDOWS\system32\iedkcs32.dll.
USERENV(418.774) 13:30:19:328 ReadGPExtensions: Rsop entry point not 
found for C:\WINDOWS\system32\iedkcs32.dll.
USERENV(418.774) 13:30:19:328 ReadGPExtensions: Rsop entry point not 
found for scecli.dll.
USERENV(418.774) 13:30:19:328 ReadGPExtensions: Rsop entry point not 
found for C:\WINDOWS\System32\cscui.dll.
USERENV(418.774) 13:30:19:328 ReadGPExtensions: Rsop entry point not 
found for C:\WINDOWS\system32\iedkcs32.dll.
USERENV(418.774) 13:30:19:328 ReadGPExtensions: Rsop entry point not 
found for gptext.dll.
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {35378EAC-683F-11D2-A89A-00C04FBBCFA2}
USERENV(418.774) 13:30:19:375 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {0E28E245-9368-4853-AD84-6DA3BA35BB75}
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {17D89FEC-5C44-4972-B12D-241CAEF74509}
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {1A6364EB-776B-4120-ADE1-B63A406A76B5}
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {25537BA6-77A8-11D2-9B6C-0000F8080861}
USERENV(418.774) 13:30:19:375 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {3610eda5-77ef-11d2-8dc5-00c04fa31a66}
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {426031c0-0b47-4852-b0ca-ac3d37bfcb39}
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {42B5FAAE-6536-11d2-AE5A-0000F87571E3}
USERENV(418.774) 13:30:19:375 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}
USERENV(418.774) 13:30:19:375 ReadExtStatus: Reading Previous Status for 
extension {5794DAFD-BE60-433f-88A2-1A31939AC01F}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {6232C319-91AC-4931-9385-E70C2B099F0E}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {7150F9BF-48AD-4da4-A49C-29EF4A8369BA}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {728EE579-943C-4519-9EF7-AB56765798ED}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {74EE6C03-5363-4554-B161-627540339CAB}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {7B849a69-220F-451E-B3FE-2CB811AF94AE}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {827D319E-6EAC-11D2-A4EA-00C04F79F83A}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {91FBB303-0CD5-4055-BF42-E512A681B325}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}
USERENV(418.774) 13:30:19:390 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {A3F3E39B-5D83-4940-B954-28315B82F0A8}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {AADCED64-746C-4633-A97C-D61349046527}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {B087BE9D-ED37-454f-AF9C-04291E351182}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {B587E2B1-4D59-4e7e-AED9-22B9DF11D053}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {C631DF4C-088F-4156-B058-4375F0853CD8}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {c6dc5466-785a-11d2-84d0-00c04fb169f7}
USERENV(418.774) 13:30:19:390 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {e437bc1c-aa7d-11d2-a382-00c04f991e27}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {E47248BA-94CC-49c4-BBB5-9EB7F05183D0}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {E4F48E54-F38D-4884-BFB9-D4D2E5729C18}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {E5094040-C46C-4115-B030-04FB2E545B00}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {E62688F0-25FD-4c90-BFF5-F508B9D2E31F}
USERENV(418.774) 13:30:19:390 ReadExtStatus: Reading Previous Status for 
extension {F9C77450-3A41-477E-9310-9ACD617BD9E3}
USERENV(418.774) 13:30:19:390 ProcessGPOs: Calling GetGPOInfo for normal 
policy mode
USERENV(418.774) 13:30:19:390 GetGPOInfo:  ********************************
USERENV(418.774) 13:30:19:390 GetGPOInfo:  Entering...
USERENV(418.774) 13:30:19:390 GetGPOInfo:  Server connection established.
USERENV(418.774) 13:30:19:421 GetGPOInfo:  Bound successfully.
USERENV(418.774) 13:30:19:421 SearchDSObject:  Searching 
<OU=HeadOffice,OU=mycompany,DC=mycompany,DC=com>
USERENV(418.774) 13:30:19:437 SearchDSObject:  Found GPO(s): 
<[LDAP://CN={1FC858B6-0F09-42AD-B7C7-082F429121CA},CN=Policies,CN=System,DC=mycompany,DC=com;0]>
USERENV(418.774) 13:30:19:437 ProcessGPO:  ==============================
USERENV(418.774) 13:30:19:437 ProcessGPO:  Deferring search for 
<LDAP://CN={1FC858B6-0F09-42AD-B7C7-082F429121CA},CN=Policies,CN=System,DC=mycompany,DC=com>
USERENV(418.774) 13:30:19:437 SearchDSObject:  Searching 
<OU=mycompany,DC=mycompany,DC=com>
USERENV(418.774) 13:30:19:437 SearchDSObject:  Found GPO(s): 
<[LDAP://CN={6D7BEC14-4BF7-4F9B-BAF2-1D4D5B0CF038},CN=Policies,CN=System,DC=mycompany,DC=com;0]>
USERENV(418.774) 13:30:19:437 ProcessGPO:  ==============================
USERENV(418.774) 13:30:19:437 ProcessGPO:  Deferring search for 
<LDAP://CN={6D7BEC14-4BF7-4F9B-BAF2-1D4D5B0CF038},CN=Policies,CN=System,DC=mycompany,DC=com>
USERENV(418.774) 13:30:19:437 SearchDSObject:  Searching 
<DC=mycompany,DC=com>
USERENV(418.774) 13:30:19:437 SearchDSObject:  Found GPO(s): 
<[LDAP://CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mycompany,DC=com;0]>
USERENV(418.774) 13:30:19:437 ProcessGPO:  ==============================
USERENV(418.774) 13:30:19:437 ProcessGPO:  Deferring search for 
<LDAP://CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mycompany,DC=com>
USERENV(418.774) 13:30:19:453 SearchDSObject:  Searching 
<CN=mycompany,CN=Sites,CN=Configuration,DC=mycompany,DC=com>
USERENV(418.774) 13:30:19:453 SearchDSObject:  No GPO(s) for this object.
USERENV(418.774) 13:30:19:453 EvaluateDeferredGPOs:  Searching for GPOs 
in cn=policies,cn=system,DC=mycompany,DC=com
USERENV(418.774) 13:30:19:468 ProcessGPO:  ==============================
USERENV(418.774) 13:30:19:468 ProcessGPO:  Searching 
<CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mycompany,DC=com>
USERENV(418.774) 13:30:19:468 ProcessGPO:  User has access to this GPO.
USERENV(418.774) 13:30:19:468 ProcessGPO:  GPO passes the filter check.
USERENV(418.774) 13:30:19:468 ProcessGPO:  Found functionality version 
of:  2
USERENV(418.774) 13:30:19:468 ProcessGPO:  Found file system path of: 
<\\mycompany.com\sysvol\mycompany.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}>
USERENV(418.774) 13:30:19:515 ProcessGPO:  Found common name of: 
<{31B2F340-016D-11D2-945F-00C04FB984F9}>
USERENV(418.774) 13:30:19:515 ProcessGPO:  Found display name of: 
<Default Domain Policy>
USERENV(418.774) 13:30:19:515 ProcessGPO:  Found user version of:  GPC 
is 2, GPT is 2
USERENV(418.774) 13:30:19:515 ProcessGPO:  Found flags of:  0
USERENV(418.774) 13:30:19:515 ProcessGPO:  Found extensions: 
[{3060E8D0-7020-11D2-842D-00C04FA372D4}{3060E8CE-7020-11D2-842D-00C04FA372D4}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}]
USERENV(418.774) 13:30:19:515 ProcessGPO:  ==============================
USERENV(418.774) 13:30:19:515 ProcessGPO:  ==============================
USERENV(418.774) 13:30:19:515 ProcessGPO:  Searching 
<CN={6D7BEC14-4BF7-4F9B-BAF2-1D4D5B0CF038},CN=Policies,CN=System,DC=mycompany,DC=com>
USERENV(418.774) 13:30:19:515 ProcessGPO:  User has access to this GPO.
USERENV(418.774) 13:30:19:515 FilterCheck:  Found WMI Filter id of:  < >
USERENV(418.774) 13:30:19:515 ProcessGPO:  GPO passes the filter check.
USERENV(418.774) 13:30:19:515 ProcessGPO:  Found functionality version 
of:  2
USERENV(418.774) 13:30:19:515 ProcessGPO:  Found file system path of: 
<\\mycompany.com\SysVol\mycompany.com\Policies\{6D7BEC14-4BF7-4F9B-BAF2-1D4D5B0CF038}>
USERENV(418.774) 13:30:19:531 ProcessGPO:  Found common name of: 
<{6D7BEC14-4BF7-4F9B-BAF2-1D4D5B0CF038}>
USERENV(418.774) 13:30:19:531 ProcessGPO:  Found display name of: 
<mycompany>
USERENV(418.774) 13:30:19:531 ProcessGPO:  Found user version of:  GPC 
is 93, GPT is 93
USERENV(418.774) 13:30:19:531 ProcessGPO:  Found flags of:  0
USERENV(418.774) 13:30:19:531 ProcessGPO:  Found extensions: 
[{25537BA6-77A8-11D2-9B6C-0000F8080861}{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}{53D6AB1D-2488-11D1-A28C-00C04FB94F17}][{A2E30F80-D7DE-11D2-BBDE-00C04F86AE3B}{FC715823-C5FB-11D1-9EEF-00A0C90347FF}][{C6DC5466-785A-11D2-84D0-00C04FB169F7}{BACF5C8A-A3C7-11D1-A760-00C04FB9603F}]
USERENV(418.774) 13:30:19:531 ProcessGPO:  ==============================
USERENV(418.774) 13:30:19:546 ProcessGPO:  ==============================
USERENV(418.774) 13:30:19:546 ProcessGPO:  Searching 
<CN={1FC858B6-0F09-42AD-B7C7-082F429121CA},CN=Policies,CN=System,DC=mycompany,DC=com>
USERENV(418.774) 13:30:19:546 ProcessGPO:  User has access to this GPO.
USERENV(418.774) 13:30:19:546 ProcessGPO:  GPO passes the filter check.
USERENV(418.774) 13:30:19:546 ProcessGPO:  Found functionality version 
of:  2
USERENV(418.774) 13:30:19:546 ProcessGPO:  Found file system path of: 
<\\mycompany.com\SysVol\mycompany.com\Policies\{1FC858B6-0F09-42AD-B7C7-082F429121CA}>
USERENV(418.774) 13:30:19:562 ProcessGPO:  Found common name of: 
<{1FC858B6-0F09-42AD-B7C7-082F429121CA}>
USERENV(418.774) 13:30:19:562 ProcessGPO:  Found display name of: 
<HeadOffice>
USERENV(418.774) 13:30:19:562 ProcessGPO:  Found user version of:  GPC 
is 16, GPT is 16
USERENV(418.774) 13:30:19:562 ProcessGPO:  Found flags of:  0
USERENV(418.774) 13:30:19:562 ProcessGPO:  Found extensions: 
[{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}]
USERENV(418.774) 13:30:19:562 ProcessGPO:  ==============================
USERENV(418.774) 13:30:19:562 GetGPOInfo:  GPO Local Group Policy 
doesn't contain any data since the version number is 0.  It will be skipped.
USERENV(418.774) 13:30:19:562 GetGPOInfo:  Leaving with 1
USERENV(418.774) 13:30:19:562 GetGPOInfo:  ********************************
USERENV(418.774) 13:30:19:562 ProcessGPOs: Logging Data for Target <user1>.
USERENV(418.774) 13:30:19:578 ProcessGPOs: OpenThreadToken failed with 
error 1008, assuming thread is not impersonating
USERENV(418.774) 13:30:19:578 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:19:578 ProcessGPOs: Processing extension Registry
USERENV(418.774) 13:30:19:578 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.774) 13:30:19:578 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:19:578 CheckGPOs: No GPO changes and no security 
group membership change and extension Registry has NoGPOChanges set.
USERENV(418.774) 13:30:19:578 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:19:578 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:19:578 ProcessGPOs: Processing extension Wireless
USERENV(418.774) 13:30:19:578 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:19:578 CheckGPOs: No GPO changes but couldn't 
read extension Wireless's status or policy time.
USERENV(418.774) 13:30:19:578 ProcessGPOs: Extension Wireless skipped 
with flags 0x6.
USERENV(418.774) 13:30:19:578 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:19:578 ProcessGPOs: Processing extension Group 
Policy Environment
USERENV(418.774) 13:30:19:578 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:19:578 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:19:578 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Environment's status or policy time.
USERENV(418.774) 13:30:19:578 ProcessGPOs: Extension Group Policy 
Environment skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:19:578 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:19:578 ProcessGPOs: Processing extension Group 
Policy Local Users and Groups
USERENV(418.774) 13:30:19:578 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:19:578 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:19:578 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Local Users and Groups's status or policy time.
USERENV(418.774) 13:30:19:578 ProcessGPOs: Extension Group Policy Local 
Users and Groups skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.774) 13:30:19:578 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:19:578 ProcessGPOs: Processing extension Group 
Policy Device Settings
USERENV(418.774) 13:30:19:578 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:19:578 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:19:578 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Device Settings's status or policy time.
USERENV(418.774) 13:30:19:578 ProcessGPOs: Extension Group Policy Device 
Settings skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:19:578 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:19:578 ProcessGPOs: Processing extension Folder 
Redirection
USERENV(418.774) 13:30:19:578 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.774) 13:30:19:578 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:19:578 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:19:593 CheckGPOs: No GPO changes but called in 
force refresh flag or extension Folder Redirection needs to run force 
refresh in foreground processing
USERENV(418.774) 13:30:19:593 ProcessGPOList: Entering for extension 
Folder Redirection
USERENV(418.774) 13:30:19:593 UserPolicyCallback: Setting status UI to 
Applying Folder Redirection policy...
USERENV(418.774) 13:30:19:625 ProcessGPOList: Passing in the force 
refresh flag to Extension Folder Redirection
USERENV(418.774) 13:30:19:625 GetWbemServices: CoCreateInstance succeeded
USERENV(418.774) 13:30:20:609 ConnectToNameSpace: ConnectServer returned 0x0
USERENV(418.774) 13:30:21:640 LogExtSessionStatus: Successfully logged 
Extension Session data
USERENV(418.774) 13:30:22:125 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:22:125 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:22:328 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:22:328 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:22:343 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:22:343 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:22:343 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:22:359 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:22:359 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(85c.864) 13:30:22:953 LibMain: Process Name: 
C:\WINDOWS\system32\userinit.exe
USERENV(418.774) 13:30:24:484 UserPolicyCallback: Setting status UI to 
Applying your personal settings...
USERENV(418.774) 13:30:24:484 ProcessGPOList: Extension Folder 
Redirection returned 0x0.
USERENV(418.774) 13:30:24:484 ProcessGPOList: Extension Folder 
Redirection was able to log data. RsopStatus = 0x0, dwRet = 0, Clearing 
the dirty bit
USERENV(418.774) 13:30:24:781 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:24:781 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:24:781 ProcessGPOs: Processing extension 
Microsoft Disk Quota
USERENV(418.774) 13:30:24:781 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:24:781 CheckGPOs: No GPO changes but couldn't 
read extension Microsoft Disk Quota's status or policy time.
USERENV(418.774) 13:30:24:781 ProcessGPOs: Extension Microsoft Disk 
Quota skipped with flags 0x6.
USERENV(418.774) 13:30:24:781 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:24:781 ProcessGPOs: Processing extension Group 
Policy Network Options
USERENV(418.774) 13:30:24:781 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:24:781 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:24:781 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Network Options's status or policy time.
USERENV(418.774) 13:30:24:781 ProcessGPOs: Extension Group Policy 
Network Options skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.774) 13:30:24:796 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:24:796 ProcessGPOs: Processing extension QoS 
Packet Scheduler
USERENV(418.774) 13:30:24:796 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:24:796 CheckGPOs: No GPO changes but couldn't 
read extension QoS Packet Scheduler's status or policy time.
USERENV(418.774) 13:30:24:796 ProcessGPOs: Extension QoS Packet 
Scheduler skipped with flags 0x6.
USERENV(418.774) 13:30:24:796 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:24:796 ProcessGPOs: Processing extension Scripts
USERENV(418.774) 13:30:24:796 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.774) 13:30:24:796 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:24:796 CheckGPOs: No GPO changes but called in 
force refresh flag or extension Scripts needs to run force refresh in 
foreground processing
USERENV(418.774) 13:30:24:796 ProcessGPOList: Entering for extension Scripts
USERENV(418.774) 13:30:24:796 UserPolicyCallback: Setting status UI to 
Applying Scripts policy...
USERENV(418.774) 13:30:24:796 ProcessGPOList: Passing in the force 
refresh flag to Extension Scripts
USERENV(418.774) 13:30:24:890 LogExtSessionStatus: Successfully logged 
Extension Session data
USERENV(418.774) 13:30:25:078 ProcessGPOList: Extension Scripts returned 
0x0.
USERENV(418.774) 13:30:25:078 ProcessGPOList: Extension Scripts was able 
to log data. RsopStatus = 0x0, dwRet = 0, Clearing the dirty bit
USERENV(418.774) 13:30:25:078 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:078 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:078 ProcessGPOs: Processing extension Internet 
Explorer Zonemapping
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CheckGPOs: No GPO changes but couldn't 
read extension Internet Explorer Zonemapping's status or policy time.
USERENV(418.774) 13:30:25:093 ProcessGPOs: Extension Internet Explorer 
Zonemapping skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:25:093 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:093 ProcessGPOs: Processing extension Group 
Policy Drive Maps
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Drive Maps's status or policy time.
USERENV(418.774) 13:30:25:093 ProcessGPOs: Extension Group Policy Drive 
Maps skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:25:093 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:093 ProcessGPOs: Processing extension Group 
Policy Folders
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Folders's status or policy time.
USERENV(418.774) 13:30:25:093 ProcessGPOs: Extension Group Policy 
Folders skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:25:093 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:093 ProcessGPOs: Processing extension Group 
Policy Network Shares
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Network Shares's status or policy time.
USERENV(418.774) 13:30:25:093 ProcessGPOs: Extension Group Policy 
Network Shares skipped with flags 0x6.
USERENV(418.774) 13:30:25:093 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:093 ProcessGPOs: Processing extension Group 
Policy Files
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Files's status or policy time.
USERENV(418.774) 13:30:25:093 ProcessGPOs: Extension Group Policy Files 
skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:25:093 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:093 ProcessGPOs: Processing extension Group 
Policy Data Sources
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Data Sources's status or policy time.
USERENV(418.774) 13:30:25:093 ProcessGPOs: Extension Group Policy Data 
Sources skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:25:093 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:093 ProcessGPOs: Processing extension Group 
Policy Ini Files
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:093 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Ini Files's status or policy time.
USERENV(418.774) 13:30:25:093 ProcessGPOs: Extension Group Policy Ini 
Files skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:25:109 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:109 ProcessGPOs: Processing extension Internet 
Explorer User Accelerators
USERENV(418.774) 13:30:25:109 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:109 CheckGPOs: No GPO changes but couldn't 
read extension Internet Explorer User Accelerators's status or policy time.
USERENV(418.774) 13:30:25:109 ProcessGPOs: Extension Internet Explorer 
User Accelerators skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.774) 13:30:25:109 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:109 ProcessGPOs: Processing extension Security
USERENV(418.774) 13:30:25:109 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:109 CheckGPOs: No GPO changes but couldn't 
read extension Security's status or policy time.
USERENV(418.774) 13:30:25:109 ProcessGPOs: Extension Security skipped 
with flags 0x6.
USERENV(418.774) 13:30:25:109 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:109 ProcessGPOs: Processing extension Group 
Policy Services
USERENV(418.774) 13:30:25:109 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:109 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Services's status or policy time.
USERENV(418.774) 13:30:25:109 ProcessGPOs: Extension Group Policy 
Services skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:25:109 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:25:109 ProcessGPOs: Processing extension Internet 
Explorer Branding
USERENV(418.774) 13:30:25:109 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.774) 13:30:25:109 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:25:109 CheckGPOs: No GPO changes but called in 
force refresh flag or extension Internet Explorer Branding needs to run 
force refresh in foreground processing
USERENV(418.774) 13:30:25:109 ProcessGPOList: Entering for extension 
Internet Explorer Branding
USERENV(418.774) 13:30:25:109 UserPolicyCallback: Setting status UI to 
Applying Internet Explorer Branding policy...
USERENV(418.774) 13:30:25:109 ProcessGPOList: Passing in the force 
refresh flag to Extension Internet Explorer Branding
USERENV(418.774) 13:30:25:156 LogExtSessionStatus: Successfully logged 
Extension Session data
USERENV(418.774) 13:30:26:171 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(860.868) 13:30:26:281 GetProfileType:  Profile already loaded.
USERENV(860.868) 13:30:26:281 LoadProfileInfo:  Failed to query central 
profile with error 2
USERENV(860.868) 13:30:26:281 GetProfileType: ProfileFlags is 0
USERENV(8f0.8f4) 13:30:28:562 LibMain: Process Name: 
C:\WINDOWS\system32\sessmgr.exe
USERENV(418.774) 13:30:28:671 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:29:718 ImpersonateUser: Failed to impersonate 
user with 5.
USERENV(418.774) 13:30:29:718 GetUserNameAndDomain Failed to impersonate 
user
USERENV(418.774) 13:30:29:718 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(418.774) 13:30:29:718 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(628.920) 13:30:30:718 GetProfileType:  Profile already loaded.
USERENV(628.920) 13:30:30:718 LoadProfileInfo:  Failed to query central 
profile with error 2
USERENV(628.920) 13:30:30:718 GetProfileType: ProfileFlags is 0
USERENV(418.774) 13:30:33:984 ImpersonateUser: Failed to impersonate 
user with 5.
USERENV(418.774) 13:30:33:984 GetUserNameAndDomain Failed to impersonate 
user
USERENV(418.774) 13:30:33:984 GetUserDNSDomainName:  Domain name is NT 
Authority.  No DNS domain name available.
USERENV(418.774) 13:30:33:984 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:34:234 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:34:296 UserPolicyCallback: Setting status UI to 
Applying your personal settings...
USERENV(418.774) 13:30:34:296 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.774) 13:30:35:046 UserPolicyCallback: Setting status UI to 
Applying your personal settings...
USERENV(418.774) 13:30:35:046 ProcessGPOList: Extension Internet 
Explorer Branding returned 0x0.
USERENV(418.774) 13:30:35:046 ProcessGPOList: Extension Internet 
Explorer Branding was able to log data. RsopStatus = 0x0, dwRet = 0, 
Clearing the dirty bit
USERENV(418.774) 13:30:35:062 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:35:062 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:35:062 ProcessGPOs: Processing extension Group 
Policy Folder Options
USERENV(418.774) 13:30:35:062 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:062 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:062 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Folder Options's status or policy time.
USERENV(418.774) 13:30:35:062 ProcessGPOs: Extension Group Policy Folder 
Options skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:35:062 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:35:062 ProcessGPOs: Processing extension Group 
Policy Scheduled Tasks
USERENV(418.774) 13:30:35:062 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:062 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:062 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Scheduled Tasks's status or policy time.
USERENV(418.774) 13:30:35:062 ProcessGPOs: Extension Group Policy 
Scheduled Tasks skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.774) 13:30:35:062 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:35:062 ProcessGPOs: Processing extension Group 
Policy Registry
USERENV(418.774) 13:30:35:062 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:062 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:062 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Registry's status or policy time.
USERENV(418.774) 13:30:35:062 ProcessGPOs: Extension Group Policy 
Registry skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:35:062 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:35:062 ProcessGPOs: Processing extension EFS recovery
USERENV(418.774) 13:30:35:062 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:062 CheckGPOs: No GPO changes but couldn't 
read extension EFS recovery's status or policy time.
USERENV(418.774) 13:30:35:062 ProcessGPOs: Extension EFS recovery 
skipped with flags 0x6.
USERENV(418.774) 13:30:35:078 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:35:078 ProcessGPOs: Processing extension 802.3 
Group Policy
USERENV(418.774) 13:30:35:078 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:078 CheckGPOs: No GPO changes but couldn't 
read extension 802.3 Group Policy's status or policy time.
USERENV(418.774) 13:30:35:078 ProcessGPOs: Extension 802.3 Group Policy 
skipped with flags 0x6.
USERENV(418.774) 13:30:35:078 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:35:078 ProcessGPOs: Processing extension Group 
Policy Printers
USERENV(418.774) 13:30:35:078 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:078 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:078 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Printers's status or policy time.
USERENV(418.774) 13:30:35:078 ProcessGPOs: Extension Group Policy 
Printers skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:35:078 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:35:078 ProcessGPOs: Processing extension Group 
Policy Shortcuts
USERENV(418.774) 13:30:35:078 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:078 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:078 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Shortcuts's status or policy time.
USERENV(418.774) 13:30:35:078 ProcessGPOs: Extension Group Policy 
Shortcuts skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:35:078 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:35:078 ProcessGPOs: Processing extension 
Microsoft Offline Files
USERENV(418.774) 13:30:35:078 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:078 CheckGPOs: No GPO changes but couldn't 
read extension Microsoft Offline Files's status or policy time.
USERENV(418.774) 13:30:35:078 ProcessGPOs: Extension Microsoft Offline 
Files skipped with flags 0x6.
USERENV(418.774) 13:30:35:078 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:35:078 ProcessGPOs: Processing extension Software 
Installation
USERENV(418.774) 13:30:35:078 ReadStatus: Read Extension's Previous 
status successfully.
USERENV(418.774) 13:30:35:078 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:078 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:35:078 CheckGPOs: No GPO changes but called in 
force refresh flag or extension Software Installation needs to run force 
refresh in foreground processing
USERENV(418.774) 13:30:35:078 ProcessGPOList: Entering for extension 
Software Installation
USERENV(418.774) 13:30:35:078 UserPolicyCallback: Setting status UI to 
Applying Software Installation policy...
USERENV(418.774) 13:30:35:078 ProcessGPOList: Passing in the force 
refresh flag to Extension Software Installation
USERENV(418.774) 13:30:35:140 LogExtSessionStatus: Successfully logged 
Extension Session data
USERENV(418.774) 13:30:35:437 UserPolicyCallback: Setting status UI to 
Applying software installation settings...
USERENV(418.774) 13:30:36:000 UserPolicyCallback: Setting status UI to 
Applying your personal settings...
USERENV(418.774) 13:30:36:046 ProcessGPOList: Extension Software 
Installation returned 0x0.
USERENV(418.774) 13:30:36:046 ProcessGPOList: Extension Software 
Installation was able to log data. RsopStatus = 0x0, dwRet = 0, Clearing 
the dirty bit
USERENV(418.774) 13:30:36:125 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:36:125 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:36:125 ProcessGPOs: Processing extension Internet 
Explorer Machine Accelerators
USERENV(418.774) 13:30:36:125 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:125 CheckGPOs: No GPO changes but couldn't 
read extension Internet Explorer Machine Accelerators's status or policy 
time.
USERENV(418.774) 13:30:36:125 ProcessGPOs: Extension Internet Explorer 
Machine Accelerators skipped because both deleted and changed GPO lists 
are empty.
USERENV(418.774) 13:30:36:125 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:36:125 ProcessGPOs: Processing extension IP Security
USERENV(418.774) 13:30:36:125 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:125 CheckGPOs: No GPO changes but couldn't 
read extension IP Security's status or policy time.
USERENV(418.774) 13:30:36:125 ProcessGPOs: Extension IP Security skipped 
with flags 0x6.
USERENV(418.774) 13:30:36:125 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:36:125 ProcessGPOs: Processing extension Group 
Policy Internet Settings
USERENV(418.774) 13:30:36:125 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:125 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:125 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Internet Settings's status or policy time.
USERENV(418.774) 13:30:36:125 ProcessGPOs: Extension Group Policy 
Internet Settings skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.774) 13:30:36:125 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:36:125 ProcessGPOs: Processing extension Group 
Policy Start Menu Settings
USERENV(418.774) 13:30:36:125 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:125 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:125 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Start Menu Settings's status or policy time.
USERENV(418.774) 13:30:36:125 ProcessGPOs: Extension Group Policy Start 
Menu Settings skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:36:125 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:36:125 ProcessGPOs: Processing extension Group 
Policy Regional Options
USERENV(418.774) 13:30:36:125 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:125 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:125 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Regional Options's status or policy time.
USERENV(418.774) 13:30:36:125 ProcessGPOs: Extension Group Policy 
Regional Options skipped because both deleted and changed GPO lists are 
empty.
USERENV(418.774) 13:30:36:125 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:36:125 ProcessGPOs: Processing extension Group 
Policy Power Options
USERENV(418.774) 13:30:36:125 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:125 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:140 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Power Options's status or policy time.
USERENV(418.774) 13:30:36:140 ProcessGPOs: Extension Group Policy Power 
Options skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:36:140 ProcessGPOs: -----------------------
USERENV(418.774) 13:30:36:140 ProcessGPOs: Processing extension Group 
Policy Applications
USERENV(418.774) 13:30:36:140 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:140 CompareGPOLists:  The lists are the same.
USERENV(418.774) 13:30:36:140 CheckGPOs: No GPO changes but couldn't 
read extension Group Policy Applications's status or policy time.
USERENV(418.774) 13:30:36:140 ProcessGPOs: Extension Group Policy 
Applications skipped because both deleted and changed GPO lists are empty.
USERENV(418.774) 13:30:36:140 SetFgRefreshInfo: Previous User Fg policy 
Synchronous, Reason: ForcedSyncRefresh.
USERENV(418.774) 13:30:36:140 SetFgRefreshInfo: Next User Fg policy 
Asynchronous, Reason: NoNeedForSync.
USERENV(418.774) 13:30:36:250 LeaveCriticalPolicySection: Critical 
section 0x82c has been released.
USERENV(418.774) 13:30:36:250 ProcessGPOs: User Group Policy has been 
applied.
USERENV(418.774) 13:30:36:250 ProcessGPOs: Leaving with 1.
USERENV(418.774) 13:30:36:250 ApplyGroupPolicy: Leaving successfully.
USERENV(418.9d4) 13:30:36:312 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.658) 13:30:36:531 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.9c0) 13:30:37:203 PolicyChangedThread: Calling UpdateUser 
with 0.
USERENV(418.9c4) 13:30:37:203 GPOThread:  Next refresh will happen in 91 
minutes
USERENV(a34.a38) 13:30:37:765 LibMain: Process Name: 
C:\WINDOWS\system32\userinit.exe
USERENV(418.41c) 13:30:39:703 IsSyncForegroundPolicyRefresh: 
Asynchronous, Reason: NoNeedForSync
USERENV(418.a9c) 13:30:39:703 IsSyncForegroundPolicyRefresh: 
Asynchronous, Reason: NoNeedForSync
USERENV(418.a9c) 13:30:39:703 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(aac.ab0) 13:30:39:890 LibMain: Process Name: 
C:\WINDOWS\system32\userinit.exe
USERENV(ae0.ae4) 13:30:40:359 LibMain: Process Name: 
C:\WINDOWS\system32\userinit.exe
USERENV(aac.ab0) 13:30:42:140 GetProfileType:  Profile already loaded.
USERENV(aac.ab0) 13:30:42:140 GetProfileType: ProfileFlags is 0
USERENV(af8.afc) 13:30:42:843 LibMain: Process Name: 
C:\WINDOWS\system32\WgaTray.exe
USERENV(af8.afc) 13:30:42:859 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(af8.afc) 13:30:42:953 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(b38.b3c) 13:30:43:203 LibMain: Process Name: 
C:\WINDOWS\system32\NOTEPAD.EXE
USERENV(458.478) 13:30:43:328 ImpersonateUser: Failed to impersonate 
user with 5.
USERENV(458.478) 13:30:43:328 GetUserNameAndDomain Failed to impersonate 
user
USERENV(458.478) 13:30:43:328 ImpersonateUser: Failed to impersonate 
user with 5.
USERENV(458.478) 13:30:43:328 GetUserDNSDomainName: Failed to 
impersonate user
USERENV(458.478) 13:30:43:328 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(bb8.bbc) 13:30:45:125 LibMain: Process Name: 
C:\WINDOWS\system32\wbem\wmiprvse.exe
USERENV(ba0.ba4) 13:30:46:890 LibMain: Process Name: C:\WINDOWS\Explorer.EXE
USERENV(2f4.8e0) 13:30:47:296 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(2f4.8e0) 13:30:48:484 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.9c0) 13:30:52:687 PolicyChangedThread: UpdateUser failed with 6.
USERENV(418.9c0) 13:30:52:968 PolicyChangedThread: Broadcast message for 0.
USERENV(2f4.8e0) 13:31:05:281 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(2f4.8e0) 13:31:05:359 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(418.9c0) 13:31:11:515 PolicyChangedThread: Leaving
USERENV(ba0.d6c) 13:31:11:734 GetProfileType:  Profile already loaded.
USERENV(ba0.d6c) 13:31:11:734 GetProfileType: ProfileFlags is 0
USERENV(ba0.d6c) 13:31:11:937 GetProfileType:  Profile already loaded.
USERENV(ba0.d6c) 13:31:11:937 GetProfileType: ProfileFlags is 0
USERENV(ba0.ba4) 13:31:12:781 GetProfileType:  Profile already loaded.
USERENV(ba0.ba4) 13:31:12:781 GetProfileType: ProfileFlags is 0
USERENV(ba0.df8) 13:31:25:484 ImpersonateUser: Failed to impersonate 
user with 5.
USERENV(ba0.df8) 13:31:25:484 GetUserNameAndDomain Failed to impersonate 
user
USERENV(ba0.df8) 13:31:25:609 ImpersonateUser: Failed to impersonate 
user with 5.
USERENV(ba0.df8) 13:31:25:656 GetUserDNSDomainName: Failed to 
impersonate user
USERENV(ba0.df8) 13:31:25:718 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(2f4.350) 13:31:26:265 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(2f4.350) 13:31:26:375 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(2f4.350) 13:31:26:375 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(ba0.df8) 13:31:26:656 ImpersonateUser: Failed to impersonate 
user with 5.
USERENV(ba0.df8) 13:31:26:656 GetUserNameAndDomain Failed to impersonate 
user
USERENV(ba0.df8) 13:31:26:656 ImpersonateUser: Failed to impersonate 
user with 5.
USERENV(ba0.df8) 13:31:26:656 GetUserDNSDomainName: Failed to 
impersonate user
USERENV(ba0.df8) 13:31:26:656 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(628.b8) 13:32:00:250 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(628.c48) 13:32:23:453 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(f98.f9c) 13:32:31:875 LibMain: Process Name: 
C:\WINDOWS\system32\imapi.exe
USERENV(418.9f4) 13:32:36:562 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(164.180) 13:32:38:421 LibMain: Process Name: 
C:\WINDOWS\system32\userinit.exe
USERENV(ef4.ef8) 13:32:52:671 LibMain: Process Name: 
C:\WINDOWS\system32\msfeedssync.exe
USERENV(628.110) 13:32:53:312 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(aa4.abc) 13:33:15:734 LibMain: Process Name:  C:\WINDOWS\regedit.exe
USERENV(b04.b08) 13:33:17:140 LibMain: Process Name: 
C:\WINDOWS\system32\wbem\wmiprvse.exe
USERENV(9b8.d28) 13:33:21:578 LibMain: Process Name:  C:\Program 
Files\Trend Micro\BM\TMBMSRV.exe
USERENV(9b8.d28) 13:33:22:000 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(15c.d14) 13:33:26:390 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(9b8.834) 13:33:31:328 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(828.cbc) 13:33:33:687 LibMain: Process Name:  C:\Program 
Files\Windows Defender\MSASCui.exe
USERENV(15c.d14) 13:33:41:375 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(998.bac) 13:33:50:265 LibMain: Process Name:  C:\Program 
Files\Trend Micro\OfficeScan Client\pccntmon.exe
USERENV(628.110) 13:34:24:687 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(8d0.878) 13:36:28:390 LibMain: Process Name: 
C:\WINDOWS\system32\NOTEPAD.EXE
USERENV(e2c.e38) 13:36:35:265 LibMain: Process Name: 
C:\WINDOWS\system32\NOTEPAD.EXE


On 27/04/2010 10:20 PM, Paul Bergson [MVP-DS] wrote:
> Do you have the firewall on locally?  Could you be blocking icmp traffic?
> If the firewall is on, shutoff temp and see if that helps.
>
> You can test to verify you have a secure channel with your dc, but I have to
> assume you do.
> nltest /sc_query:domainname.com
>
> Below are my standard recommendations for assisting in GPO troubleshooting:
>
> Troubleshooting Group Policy
>
> To turn on verbose logging (From http://support.microsoft.com/kb/221833)
>
> Use Registry Editor to add or to modify the following registry entry:
> Subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
> NT\CurrentVersion\Winlogon
> Entry: UserEnvDebugLevel
> Type: REG_DWORD
> Value data: 10002 (Hexadecimal)
>
> UserEnvDebugLevel can have the following values:
> NONE 0x00000000
> NORMAL 0x00000001
> VERBOSE 0x00000002
> LOGFILE 0x00010000
> DEBUGGER 0x00020000
> The default value is NORMAL|LOGFILE (0x00010001).
>
> To disable logging, select NONE (0x00000000).
>
> If you set UserEnvDebugLevel to 0x00030002, the most verbose details are
> logged in the Userenv.log file.
>
> Logging location
>   C:\Windows\Debug\UserMode\gpsvc.log
>
>
> Running gpupdate /force will immediately apply most policies but not all,
> some require a system reboot
>
>
> Running GPResult /R from the command prompt will list out what was processed
> and what wasn't and why
>

0
Patrick
4/28/2010 9:03:25 AM
Reply:

Similar Artilces:

Maximum file limit to Root directory of NOR Flash
Hello, I am developing a driver for a NOR Flash of size 16MB. The driver successfully loads in Windows and I can view the disk as a drive. I have a problem, though, I cannot copy more than 256 files to the ROOT DIRECTORY of the Flash Disk. e.g., 256 text files. Whether I use a source text file size of 10 bytes or 1 kb to 10 kb does not matter, after copying the 256th file, it refuses to copy any more files and issue the warning "Cannot copy "xxx.txt". There is not enough free disk space." However, I can create a subdirectory and there I could copy greate...

joining up files to one database
i got a few files i want to join to gether to make one file, so when i click it, all the tabs are at the bottom of the page? hope you understand that cheers for the help Shed, You'll need to do a Move (Edit, Move or Copy Worksheet) to move each sheet (or a copy of) into a common workbook. Then save that. No magic button. Shortcut: Right click a worksheet tab -- Move or copy worksheet is there too. Or you can tile (Window, Arrange) the two workbooks (get them both on the screen simultaneously), and drag the tab from one workbook to the other. Hold the control to copy instead of m...

Computer is driving me crazy
I have had numerous BSOD over the last couple weeks. I have tried disk check, memory diagnostic, system restore, driver updates, etc. Last night, I decided I would try updating to Windows 7 in case there was some compatibility issue, and it wouldn't allow it because it stated SP 1 was not installed. Windows update states that it has installed successfully, but the system information doesn't show it as being installed. When I go to refresh my system update and check for new updates, it comes up with an error. Does anyone have any ideas? I have attached some recent memory d...

sharing sub directory contact lists
I have a problem where if a make a new contact list under the default conacts and share the list and give permissions for a user to access it, when the user tries to open the list using outlook, open another users data, I get a message saying the oject cannot be found. If I share the default contact list and try and access it it works fine. This is the same for inboxs as well does anyone know why this is and can I fix it? Jake In news:3D1F7F26-CD1A-4BAB-B9D1-501C9394E307@microsoft.com, Jake <Jake@discussions.microsoft.com> typed: > I have a problem where if a make a new cont...

RMS Mapping
------------------------------------- Hi everyone. I am a single store owner and i have been using quickbooks 2003 for my accounting. I recently bought another system for the back office and wish to upgrade to QB 2009. After uninstalling QB 2003 from the first computer and installing QB 2009 on the new computer, i discovered that RMS manager still maintained the mapping to the old system. Infact it is greyed out not allowing me to create a new mapping. Please how do i correct this. Thanks. ##-----------------------------------------------## Newsgroup Access Courtesy http://...

MS CRM Redeployment Wizard
When importing the mapping xml files an error occurred: "An error occurred during mapping the computer accounts - the mapping failed" 09/16/2005 02:32:40 This computer's DN = CN=SERVER1,OU=Domain Controllers,DC=ClientORG,DC=local, GUID = {17427c3d-fe59-46d3-b28f-6c1d7ec4aa28}, SID = S-1-5-21-2811433622-801027495-562083374-1007 09/16/2005 02:32:40 ERROR: attempt to reuse name CN=SERVER1,OU=Domain Controllers,DC=ClientORG,DC=local 09/16/2005 02:32:40 Exception of type System.Exception was thrown. 09/16/2005 02:32:40 SDTransform 09/16/2005 02:32:40 An error occurred during the...

Hard drive in another PC
My PC is going out and I wonder if the hard drive with the operating system will work in my other computer? The one going out is an HP with 512 RAM and the other is a Compact (older model) with about 200 RAM. -- milkman "milkman2283" <milkman2283@yahoo.com> wrote in message news:147B8F98-092A-4EB9-9D2C-04FC670CAB6D@microsoft.com... > My PC is going out and I wonder if the hard drive with the operating > system > will work in my other computer? The one going out is an HP with 512 RAM > and > the other is a Compact (older model) with about 200 R...

ne peu activer l'imprimante, cause, spouler not running
Comment faire pour activer le spouler? Using Winow XP Please find a french newsgroup for your problem because we don't deal with French frogs here! hth jpbrouard@hotmail.com wrote: > > Comment faire pour activer le spouler? > Using Winow XP -- THE INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. LD55ZRA DISCLAIMS ALL WARRANTIES, EITHER EXPRESSED OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL LD55ZRA OR ITS ASSOCIATES BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DI...

Outlook Express attachment directory
I have one windows 2000 computer that defaults to the last place I saved an attachment and another that always goes back to default in my documents. Both computers are upgraded to latest version of windows 2000 professional. Where can I set a default for the download directory for attachments. Lee Lee <anonymous@discussions.microsoft.com> wrote: > I have one windows 2000 computer that defaults to the last > place I saved an attachment and another that always goes > back to default in my documents. > Both computers are upgraded to latest version of windows > 2000 p...

vlookup not working (active)
I have a random problem with vlookup that I've not been able to figure out. Sometimes when I try to lookup a value on a different workbook using vlookup, the formula disappears when I swich to the other workbook. I'm wondering if this has something to do with the format that the workbooks are save in. To work around this problem I end up having to copy the worksheet from the other workbook and paste it into the workbook I'm doing the vlookup in. This works, but is rather annoying. What causes this problem, and what's the solution? If the =vlookup() formula disappea...

Activity creation issues
I have coma across a couple of issues when creating activities: 1) When creating phone call, regardless of the direction, the sender remains as the owner and the recipient the related customer (assuming this is created from within a contact's view). This means that the incoming phonecall is recorded as being sent by one of our staff, despite it being received by them. I have attempted to create workflow to rectify this but it appears to fail to fire (presumably because there is a conflict as one cannot simply get the sender/recipient to switch, resulting in duplicates, and thus e...

how do i activate outlook setup wizard
i was not ready to upgrade from express...now I am and can't figure out how to activate the wizard to transfer my suff On 2006-10-17 18:20:02 -0500, odkelly <odkelly@discussions.microsoft.com> said: > i was not ready to upgrade from express...now I am and can't figure out > how to activate the wizard to transfer my suff ==== FILE, IMPORT????? 'File|Export|Messages' from Outlook Express to move the messages 'File|Import and Export|Import Internet Mail and Addresses' from Outlook to move addresses; be sure to uncheck the "Import Mail" checkbox...

Saving Excel file to Network drive
I recently bought a Buffalo network drive so I can access my files from both my laptop and desktop. This works perfect for my Word documents and even my Outlook PST. The problem is when I try to save an Excel (2003) file to the network drive I get a message like File xxx.Xls is possibly changed by an other user since you last saved it, do you want to overwrite it or to save with another name. (My Office version is not in English so this is my translation of the message) This only happens if I open an existing file, it happens even after I try to save it immediately after ope...

BlazeFind loop Recovery Console wrong drive letter
Hi: When I go into the Recovery Console, the choice I get is #1 C: drive. When I installed XP or did a recovery, don't remember, my main drive changed to F: Drive by itself. I can't get the repair to work to get me out of the log on loop to do a repair of USERINIT. How can I change my choice to F: Drive. thanks...Gene "Wolverine Gene" <Wolverine Gene@discussions.microsoft.com> said this in news item news:F09C4180-85D0-469B-893E-9325B1AE21D5@microsoft.com... > Hi: When I go into the Recovery Console, the choice I get is #1 C: drive. > When I...

All e-mails forwarded to CRM queue as activities
Hello everyone, I am having an odd issue with CRM, every e-mail sent from the Exchange server is forwarded to CRM to the accepted task queue. I just get an activity with "FW:OriginalTitle" where I can see the sender and not the content of the e-mail (thankfully). Has anyone else had this problem before? Any help would be greatly appreciated. Thank you. ...

group polciy not updating through active directory
Hi i am using windows 2000 server and active directory , i was trying to set up the proxy setting in active directory to limit the internet use by putting some exceptions websites that they can visit, it was working fine ealrier but now i am trying to add more sites to exception list and it dont work also other seetings seems stopped working as well. for example user can not go to internet options even when i change the policy to not configured, i try to install and use group policy management tool but no luckkk, please help me in this i am getting frustrated here... You need to ask ...

How to not show particular Activity Types
Does anyone have a suggestion to hide particular activity types (such as Fax, Service Request, Campaign Response) when a user clicks Add Activity? We have a call center that will only be scheduling tasks for other users, so we want to hide all of the unused items. We are in 3.0. Thanks for any suggestions -- Steve Luc Senior Consultant InfoGrow Corp (330)929-1353 x222 ...

Allowing multiple users across a network to a single .pst file
Hello, I was wondering whether there is a way to add the same .pst-archive to multiple users across a network. The pst-archive is located on a shared network drive, but I can only add the file in 1 useraccount, the others tell me 'the file is in use'. Is there a way to circumvent this? Best regards, Sven Herremans That would be a surefire way to make sure that it get corrupted and unusable. Sven Herremans wrote: > Hello, > > I was wondering whether there is a way to add the same .pst-archive to > multiple users across a network. > >...

Map one more column map within a single XSD element.
Map one more column map within a single XSD element. I have export the xml file from the excel file format, the data has in one more column a xml element data. How can I map one more column? In my XSD (problem is "sub-item" element) <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <xsd:element name="body"> <xsd:complexType> <xsd:sequence> <xsd:element name="item-group" minOccurs="0" maxOccurs="unbounded"> <xsd:complexType> <xsd:sequence> <xsd:element name="item...

Creating a directory booklet
I'm not even sure if Publisher is the way to go with this. I have both Publisher 2003 and Word 2003. I have checked help and can't figure out how to create a directory booklet using 81/2x11 paper in landscape mode so that there are 5 names per page. Imagine 15 sheets of paper turned landscape and then folded in half with the fold line on the left. The page edges are on the right and so each page is turned to reveal both the left and right next pages. Please forgive my laborious description. I don't know the technical terms. The top page is the right side of the top sheet of ...

Outlook CRM Menu Bar
Hello I added buttons for ...

XP & Vista & Win 7 My Doc Directory Structure.
Hi, I'm developing using Access XP Office on Windows 7. My users are running Access XP and Access 2007 on Widows XP, Vista, and Windows 7. I not quite in which forum this question belongs, but since it came up in a form, I'm asking the question in this forum. I have "blob" type files (.tiff, .jpg, etc.) that were stored in different sub-directories under C:\Documents and Settings\<User Name>\My Documents\....." Rather than store the file in the database, I store the full path and file name in my database. As you know MS, "in their inf...

How to log mailbox activity? Exch 5.5
We are running Exchange 5.5. This morning a department head asked me to log incoming and outgoing activity (including time messages were sent) for one employee. I have looked through MS Knowledge Base and the FAQ's here, along with doing a search here. No luck. Can anyone point me in the right direction? Thanks. In Exchange 5.5 Open the Exchange Admin program and go to Configuration> Connections> Internet Mail Service > Diagnostics and Logging. On the MS Exchange IMC select the Items to monitor and level. Make sure that on the Internet Mail tab that message tracking is enabl...

CRM Customization Activities
How I can customize the Activities on My Home Page. Link must be like http: //crmserver/tools/viewEditor/viewManager.aspx? id={00000000-0000-0000-00AA-000010001209} Where i can find the GUID of Activities? At present I don't believe it is possible to customise activities, I am aware that some Microsoft partners have written add ons for this purpose. Maybe this will change in the future. But i can`t add necessary column. In web dialoging there are Actual end, created by, and other but there are no field Regarding Dmitry, only fields that are common to all activity types are availab...

How to add new type of activity?
In CRM 4.0, is there a way to add a new type of activity? Many times we see a person in passing, and would like to add a note reflecting this. However, it doesn;t qualify as a phone call or appointment. If there is a way to add a custom 'conversation', how would this affect upgrades, patches, and/or hotfixes? Thanks Unfortunately you cannot add a custom activity type in Microsoft CRM 4.0. For some of our customers that really wanted a new activity type, we have suggested that they rename one of the other system activities to their new one. For example, you could rename the "...