samba - Sep 2019 - Windows 10 temporary profile error, when domain remote profile directory exists and is empty

Hello,

The below happens with Samba 4.7.* (didn't checked with other Samba 4
versions):

Setup: Samba 4.7.* AD, two domain controllers, 'computer A' and
'computer B' are Windows 10 domain members.

1. A user (login 'username') logs in into domain for the first time, on
a 'computer A'.

Samba DC doesn't find existing profile directory and creates an empty
one on corresponding file server (or whatever is the correct term for
that), 'username.V6'.

2. User marks its profile as Local on Windows and logs out. Nothing is
written to profile directory ('username.V6') on domain file server.

User then can log on and log off at 'computer A', no problems happen.

3. Now user tries to log on to the same domain at 'computer B'.

Windows 10 tries to get profile from domain, gets an empty profile,
writes an error to event logs and creates a temporary profile.

Note: no inconsistencies in registry: there were no damaged/whatever
profile entry for 'username' on 'computer B'. No inconsistency
under
"C:\Users" on 'computer B'.

4. After I physically remove the empty domain profile directory
('username.V6'), there's no problem logging in/logging out on
'computer
B'. The corresponding 'username.V6' is successfully re-created on
domain
file server.

Question: is this 'temporary profile error' a bug/feature of AD, or
Samba 4.7-specific bug/feature?

It's kind of inconvenient to remove empty profile each time a user
wishes to log on to a new domain member.

Thanks.

Sincerely,
Konstantin

You should check that if a user is logged and you look at the local (c:\users)
folder
Does it have a TEMP folder in it. If thats the case.

I suggest you try this. 
Click Start ?? Run ?? Regedit
Navigate to the following registry key
:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Then find the GUID from the user that is having problem. (tip, properties,
security tab )
Then under ProfileList navigate to binary key?s like this:
S-1-5-21-3656904587-1668747452-4095529-1234

On the right side under ProfileImagePath you'll see the profile path.
Chose the one with the desired user and delete the long registry key like:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
You will then need to either rename (preferable), or delete the user profile on
disk under C:\Users\%username%

And/or use :
https://helgeklein.com/free-tools/delprof2-user-profile-deletion-tool/
I have not used it myself yet, but looks ok. 

Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Konstantin Boyandin via samba
> Verzonden: dinsdag 24 september 2019 3:03
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] Windows 10 temporary profile error, when 
> domain remote profile directory exists and is empty
> 
> Hello,
> 
> The below happens with Samba 4.7.* (didn't checked with other Samba 4
> versions):
> 
> Setup: Samba 4.7.* AD, two domain controllers, 'computer A' and
> 'computer B' are Windows 10 domain members.
> 
> 1. A user (login 'username') logs in into domain for the 
> first time, on
> a 'computer A'.
> 
> Samba DC doesn't find existing profile directory and creates an empty
> one on corresponding file server (or whatever is the correct term for
> that), 'username.V6'.
> 
> 2. User marks its profile as Local on Windows and logs out. Nothing is
> written to profile directory ('username.V6') on domain file server.
> 
> User then can log on and log off at 'computer A', no problems
happen.
> 
> 3. Now user tries to log on to the same domain at 'computer B'.
> 
> Windows 10 tries to get profile from domain, gets an empty profile,
> writes an error to event logs and creates a temporary profile.
> 
> Note: no inconsistencies in registry: there were no damaged/whatever
> profile entry for 'username' on 'computer B'. No
inconsistency under
> "C:\Users" on 'computer B'.
> 
> 4. After I physically remove the empty domain profile directory
> ('username.V6'), there's no problem logging in/logging out on 
> 'computer
> B'. The corresponding 'username.V6' is successfully 
> re-created on domain
> file server.
> 
> Question: is this 'temporary profile error' a bug/feature of AD, or
> Samba 4.7-specific bug/feature?
> 
> It's kind of inconvenient to remove empty profile each time a user
> wishes to log on to a new domain member.
> 
> Thanks.
> 
> Sincerely,
> Konstantin
> 
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

Mandi! Konstantin Boyandin via samba
  In chel di` si favelave...
> It's kind of inconvenient to remove empty profile each time a user
> wishes to log on to a new domain member.
I don't know if it is related, but i was forced to add to smb.conf:

	socket options = TCP_NODELAY TCP_KEEPIDLE=240 TCP_KEEPCNT=4 TCP_KEEPINTVL=15

because profile disconnection was 'too quick', some locks on files
remains and so subsequent relogon (on the same or different machine)
lead to profile errors (but in event viewer i can see 'lock' errors...)

-- 
dott. Marco Gaiarin				        GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''         
http://www.lanostrafamiglia.it/
  Polo FVG   -   Via della Bont?, 7 - 33078   -   San Vito al Tagliamento (PN)
  marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   f +39-0434-842797

		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
      http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

Hmm,


This gets my attention...  
Because once in about 6 month i have 1 or 2 users with the same problem.
All i do then if fix the windows pc and it going again. 
 
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Marco Gaiarin via samba
> Verzonden: dinsdag 24 september 2019 9:46
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] Windows 10 temporary profile error, 
> when domain remote profile directory exists and is empty
> 
> Mandi! Konstantin Boyandin via samba
>   In chel di` si favelave...
> 
> > It's kind of inconvenient to remove empty profile each time a user
> > wishes to log on to a new domain member.
> 
> I don't know if it is related, but i was forced to add to smb.conf:
> 
> 	socket options = TCP_NODELAY TCP_KEEPIDLE=240 
> TCP_KEEPCNT=4 TCP_KEEPINTVL=15
> 
> because profile disconnection was 'too quick', some locks on files
> remains and so subsequent relogon (on the same or different machine)
> lead to profile errors (but in event viewer i can see 'lock' 
> errors...)
This is a bit in line with what i've seen, that a profile (.dat file) was
still locked after the pc was turned off.
Which is fixed automaticly every with a logrotate that restarts samba and
releases the lock.

> 
> -- 
> dott. Marco Gaiarin				        GNUPG 
> Key ID: 240A3D66
>   Associazione ``La Nostra Famiglia''          
> http://www.lanostrafamiglia.it/
>   Polo FVG   -   Via della Bont?, 7 - 33078   -   San Vito al 
> Tagliamento (PN)
>   marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   
> f +39-0434-842797
> 
> 		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
>       http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
> 	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

Mandi! L.P.H. van Belle via samba
  In chel di` si favelave...
> This gets my attention...  
I don't know if was samba or kernel (the default are in
/proc/sys/net/ipv4/{tcp_keepalive_time,tcp_keepalive_probes,tcp_keepalive_intvl})
change, but i start to suffer from that when jumped in samba 4.2
(jessie)...

-- 
dott. Marco Gaiarin				        GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''         
http://www.lanostrafamiglia.it/
  Polo FVG   -   Via della Bont?, 7 - 33078   -   San Vito al Tagliamento (PN)
  marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   f +39-0434-842797

		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
      http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

Hello,

Thanks. Yes, those are known Windows mantras to fix the profile/registry
folder, in case either of them has consistency issues.

But I was doing that on brand-new, just installed Windows 10 computer,
that was thoroughly scanned with whatever anti-malware stuff was at hand
- before the user in question attempted to use it.

The only fix that handled the issue was the one I mentioned.
Renaming/deleting registry records and/profiles didn't work in my case.

Sincerely,
Konstantin

On 24.09.2019 13:47, L.P.H. van Belle via samba wrote:
> You should check that if a user is logged and you look at the local
 (c:\users) folder
> Does it have a TEMP folder in it. If thats the case.
> 
> I suggest you try this. 
> Click Start ?? Run ?? Regedit
> Navigate to the following registry key
 :HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList
> Then find the GUID from the user that is having problem. (tip, properties,
 security tab ) 
> Then under ProfileList navigate to binary key?s like this:
 S-1-5-21-3656904587-1668747452-4095529-1234
> 
> On the right side under ProfileImagePath you'll see the profile path.
> Chose the one with the desired user and delete the long registry key like:
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList
> You will then need to either rename (preferable), or delete the user
 profile on disk under C:\Users\%username% 
> 
> And/or use :
 https://helgeklein.com/free-tools/delprof2-user-profile-deletion-tool/
> I have not used it myself yet, but looks ok. 
> 
> Greetz, 
> 
> Louis
> 
> 
>> -----Oorspronkelijk bericht-----
>> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
>> Konstantin Boyandin via samba
>> Verzonden: dinsdag 24 september 2019 3:03
>> Aan: samba at lists.samba.org
>> Onderwerp: [Samba] Windows 10 temporary profile error, when 
>> domain remote profile directory exists and is empty
>>
>> Hello,
>>
>> The below happens with Samba 4.7.* (didn't checked with other Samba
4
>> versions):
>>
>> Setup: Samba 4.7.* AD, two domain controllers, 'computer A' and
>> 'computer B' are Windows 10 domain members.
>>
>> 1. A user (login 'username') logs in into domain for the 
>> first time, on
>> a 'computer A'.
>>
>> Samba DC doesn't find existing profile directory and creates an
empty
>> one on corresponding file server (or whatever is the correct term for
>> that), 'username.V6'.
>>
>> 2. User marks its profile as Local on Windows and logs out. Nothing is
>> written to profile directory ('username.V6') on domain file
server.
>>
>> User then can log on and log off at 'computer A', no problems
happen.
>>
>> 3. Now user tries to log on to the same domain at 'computer B'.
>>
>> Windows 10 tries to get profile from domain, gets an empty profile,
>> writes an error to event logs and creates a temporary profile.
>>
>> Note: no inconsistencies in registry: there were no damaged/whatever
>> profile entry for 'username' on 'computer B'. No
inconsistency under
>> "C:\Users" on 'computer B'.
>>
>> 4. After I physically remove the empty domain profile directory
>> ('username.V6'), there's no problem logging in/logging out
on
>> 'computer
>> B'. The corresponding 'username.V6' is successfully 
>> re-created on domain
>> file server.
>>
>> Question: is this 'temporary profile error' a bug/feature of
AD, or
>> Samba 4.7-specific bug/feature?
>>
>> It's kind of inconvenient to remove empty profile each time a user
>> wishes to log on to a new domain member.
>>
>> Thanks.
>>
>> Sincerely,
>> Konstantin
>>
>>
>>
>> -- 
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba

Hello,

That's interesting. I think I'll keep a record of that trick - perhaps I
have similar issue of profile disconnecting to fast.

Thank you!

Sincerely,
Konstantin

On 24.09.2019 14:45, Marco Gaiarin via samba wrote:
>> It's kind of inconvenient to remove empty profile each time a user
>> wishes to log on to a new domain member.
> 
> I don't know if it is related, but i was forced to add to smb.conf:
> 
> 	socket options = TCP_NODELAY TCP_KEEPIDLE=240 TCP_KEEPCNT=4
 TCP_KEEPINTVL=15
> 
> because profile disconnection was 'too quick', some locks on files
> remains and so subsequent relogon (on the same or different machine)
> lead to profile errors (but in event viewer i can see 'lock'
errors...)