Every five minutes or so, 10 instances of Event 1002 from source Known Folders appear. The text of each event is something like "Error 0x80070002 occurred while verifying known folder... with path..." In two of the 10 instances the error is 0x80070003. In one of the 10 instances, the path is D:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. In the other nine instances, the path includes C:\Windows\system32\config\systemprofile Is this something to be concerned about? Can it be stopped? Thanks.

Update 1. These events can be eliminated by manually creating the missing folders. 2. Using Process Monitor, I determined that the process that was verifying the known folders was an instance of svchost.exe that in my case had PID 400. However, 17 services were running under that instance of svchost, so it was not easy to figure out which service was doing it.

Hi, As the path is D:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, I assume it is related to Group Policy. You may have a look to see whether there is any folder redirection policy applied. As the folder cannot be found, you may receive the error. Shaon Shan| TechNet Subscriber Support in forum| If you have any feedback on our support, please contact tngfb@microsoft.com

The path being on D:, and folder redirection in general, are not relevant here. Since my original post, I have checked other computers where there is no folder redirection (and so the path is in its default location on C:), and the same event is generated. Also, most of the instances of this event, the referenced path is to the systemprofile folder, which is on C:. It seems to me that one of the services that runs every 10 minutes (under PID 400 in my example) is looking to verify folders that don't exist in a default installation of Windows. This may be a bug that could be fixed in via a Windows Update or SP1. It would be good if someone can pin this down for certain. As a matter of background information, the path on D: is there not because of Group Policy, but because it was done that way in unattended Windows setup using an AutoUnattend.xml answer file built using WAIK.

Update - Running gpupdate /force triggers a series of Event 1002, so I'm guessing that a series is also triggered when the Group Policy Service runs the equivalent command. This would tie into the 10-minute intervals on a domain controller, and the 100 to 125 minute intervals I have observed on Windows 7 domain client computers. Using Process Monitor, I determined that one of the Registry keys opened when gpupdate /force runs is HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders. This key contains the references to the folders under systemprofile that can't be verified because they don't exist. Another key that is opened is HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders. This key contains the referenced to the folders under Default User that can't be verified because they don't exist. Shaon Shan was correct that these events are related to Group Policy, but not due to folder rediriection.

Thank you for sharing the result and the process. Have a good day.Shaon Shan| TechNet Subscriber Support in forum| If you have any feedback on our support, please contact tngfb@microsoft.com

So where is the fix.......? I have the same thing on server 2008 r2 enterprise on my exchange 2010 server and it is unacceptable. Just started today. Havent updated anything and would like an explination and fix especially considering the money our company put out buying the "darned" thing. oh btw here is a more explanitory thread since Shaon thinks telling us this is a problem constitutes an answer. http://social.technet.microsoft.com/Forums/en-GB/w7itproperf/thread/047bdb94-9958-4e8e-a112-4555e1ee3ad4 Obviously it is not fixed and I would like to know after almost a year we don't even have an explination as to why it just randomly starts as this server has been in place over a year.

There is no result what's your point. I would like one. A result or answer would be greatly appreciated as the multi-million dollar Security corporation I work for has their core server about to fail from these errors. Not having a good day at this point in time.

Update - Running gpupdate /force triggers a series of Event 1002, so I'm guessing that a series is also triggered when the Group Policy Service runs the equivalent command. This would tie into the 10-minute intervals on a domain controller, and the 100 to 125 minute intervals I have observed on Windows 7 domain client computers. Using Process Monitor, I determined that one of the Registry keys opened when gpupdate /force runs is HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders. This key contains the references to the folders under systemprofile that can't be verified because they don't exist. Another key that is opened is HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders. This key contains the referenced to the folders under Default User that can't be verified because they don't exist. Shaon Shan was correct that these events are related to Group Policy, but not due to folder rediriection. Update - Running gpupdate /force triggers a series of Event 1002, so I'm guessing I would like to see guessing not be considered an anwer.

Any news or fixes on that? I am experiencing the same problem and I am not comfortable just creating new folder not knowning what is behind it..

Creating those missing folders does not work on our Windows 7 Home Premium 64-bit Operating Systems, it only work on the 32-bit Operating Systems. Almost all our computers have this issue and those running on the 64-bit system cannot be fix. This has nothing to do with installation or the type of hardwares and softwares that were installed on the systems. This is a MICROSOFT OPERATING SYSTEM ISSUE THAT NEED TO BE FIX!