Hello, Our organization uses roaming profiles. The roaming profiles are stored on a virtual machine running windows server 2003 R2 standard with SP2. This morning we started receiving reports of users with roaming profiles having trouble logging onto their XP machines. When a user tries to log in they get an error message stating: "Windows cannot copy file C:\Documents and Settings\username\Cookies\filename.txt to location \\servername\profiles$\username\Cookies\filename.txt. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator. DETAIL - Access is denied" Windows then logs the user in with a temp local profile and the user's settings from the roaming profile does not get loaded. Hence access to their network resources need to be re-established. I've checked the share and NTFS permissions of the "profiles$" folder on the server and everyone has full control. Does anyone have a solution to resolve this? We've had roaming profiles for about 5 years and this is the first time I've ever come across a problem like this. Thank you in advance for your help.

http://support.microsoft.com/kb/973835 http://support.microsoft.com/kb/896427 The issue happend before. Paste the completed event log with event id.

Thanks for the KB articles!! Here is event id 1504 and 1509 for one of the user's experiencing the problem...these errors come up when this particular user tries to log on. Other users get different directory paths, but they are all the same error. The only workaround I've come up with is to recreate the profiles, but I have a feeling these errors will show up again in the future. Event Type: Error Event Source: Userenv Event Category: None Event ID: 1509 Date: 1/8/2011 Time: 6:29:38 AM User: Description: Windows cannot copy file C:\Documents and Settings\username\Cookies\username@phg.hitbox[2].txt to location \\server name\profiles$\username\Cookies\username@phg.hitbox[2].txt. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator. DETAIL - Access is denied. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Error Event Source: Userenv Event Category: None Event ID: 1504 Date: 1/8/2011 Time: 6:29:42 AM User: NT AUTHORITY\SYSTEM Description: Windows cannot update your roaming profile. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator. DETAIL - Access is denied. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

We've had the same problem on our network , event ID's 1515 and 1509 , only started happening on wednesday , I wonder if its to do with a microsoft update anyone got any fixes other than recreating profiles , i've got quite a few profiles and don't really want to re-create them

Arobbo, Since the error message is stating it cannot read the profile folder's "Cookies" directory I started deleting the cookies from the server for users experiencing the problem. Once they were deleted the error message went away and the user's profile was able to load. This workaround is much easier than re-creating the profile, but it's just a workaround. I'm concerned about it happening again. If anyone knows of any fixes please let us know.

I've got exactly the same problem on multiple user accounts. As long as users are using the same computer there is no problem. Because there is already a local copy of the file. But when a users logs on on a comuter wich doesn't have a local copy of his profile i get various errors. I understand that deleting the cookies solves the problem but in my opion also this isn't a fix. i would like to know how to prefent this strange cookie files. The error says that the user doesn't have acces to this specified cookie. When i look on mij 2003 DFS server wich host this file the users has the right permissions to open edit and delete the file. But the user cannot open the file or copy the file even not via File Explorer. But the user can delete the file. strange.. One copy of an event (in dutch because of dutch version of W7) Logboeknaam: Application Bron: Microsoft-Windows-User Profiles General Datum: 14-1-2011 9:29:56 Gebeurtenis-id:1509 Taakcategorie: Geen Niveau: Waarschuwing Trefwoorden: Gebruiker: DONNERSCHOOL\%USERNAME% Computer: DONNER-W032.donnerschool.intra Beschrijving: Bestand \\donnerschool.intra$NOCSC$\dfs\ProfilesDonnerschool\%USERNAME%.V2\AppData\Roaming\Microsoft\Windows\Cookies\Low\%USERNAME%@2o7[2].txt kan niet naar locatie C:\Users\delfgou\AppData\Roaming\Microsoft\Windows\Cookies\Low\%USERNAME%@2o7[2].txt worden gekopieerd. Deze fout wordt mogelijk veroorzaakt door netwerkproblemen of onvoldoende beveiligingsrechten. DETAIL - Toegang geweigerd. Gebeurtenis-XML: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-User Profiles General" Guid="{DB00DFB6-29F9-4A9C-9B3B-1F4F9E7D9770}" /> <EventID>1509</EventID> <Version>0</Version> <Level>3</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x8000000000000000</Keywords> <TimeCreated SystemTime="2011-01-14T08:29:56.744108100Z" /> <EventRecordID>1110</EventRecordID> <Correlation /> <Execution ProcessID="120" ThreadID="2932" /> <Channel>Application</Channel> <Computer>DONNER-W032.donnerschool.intra</Computer> <Security UserID="S-1-5-21-3800746973-3073627213-1406637412-1443" /> </System> <EventData Name="EVENT_COPYERROR"> <Data Name="Source">\\donnerschool.intra$NOCSC$\dfs\ProfilesDonnerschool\%username%.V2\AppData\Roaming\Microsoft\Windows\Cookies\Low\%username%@2o7[2].txt</Data> <Data Name="Target">C:\Users\delfgou\AppData\Roaming\Microsoft\Windows\Cookies\Low\%username%@2o7[2].txt</Data> <Data Name="Error">Toegang geweigerd. </Data> </EventData> </Event>

Hi all, I got the same issue here. I got a Windows 2003 server & all the clients are windows 7. My server never had this prblem before but since begining of the January user startes getting this profile issues. Users can login to their own computer but loading with a patially syncronized profile, And they cannot login to a different machine as the profile is not loading at all from the server (going to a temporary profile). I am using McAfee as my virus & firewall for all the client computer + the Server. There was a major version upgrade from McAfee withing the month of december. I have a small suspect on that as well! So either windows update or McAfee has messed up something???????? My Events : Log Name: Application Source: Microsoft-Windows-User Profiles General Date: 17/01/2011 17:15:09 Event ID: 1509 Task Category: None Level: Warning Keywords: User: OIA\emerton Computer: Desktop06V.oia.local Description: Windows cannot copy file C:\Users\emerton\AppData\Roaming\Microsoft\Windows\Cookies\emerton@atdmt.combing[2].txt to location \\server01$NOCSC$\Profiles$\emerton.V2\AppData\Roaming\Microsoft\Windows\Cookies\emerton@atdmt.combing[2].txt. This error may be caused by network problems or insufficient security rights. DETAIL - Access is denied. Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-User Profiles General" Guid="{DB00DFB6-29F9-4A9C-9B3B-1F4F9E7D9770}" /> <EventID>1509</EventID> <Version>0</Version> <Level>3</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x8000000000000000</Keywords> <TimeCreated SystemTime="2011-01-17T17:15:09.910977300Z" /> <EventRecordID>19947</EventRecordID> <Correlation /> <Execution ProcessID="972" ThreadID="6048" /> <Channel>Application</Channel> <Computer>Desktop06V.oia.local</Computer> <Security UserID="S-1-5-21-2911354414-1737097844-1967369931-1133" /> </System> <EventData Name="EVENT_COPYERROR"> <Data Name="Source">C:\Users\emerton\AppData\Roaming\Microsoft\Windows\Cookies\emerton@atdmt.combing[2].txt</Data> <Data Name="Target">\\server01$NOCSC$\Profiles$\emerton.V2\AppData\Roaming\Microsoft\Windows\Cookies\emerton@atdmt.combing[2].txt</Data> <Data Name="Error">Access is denied. </Data> </EventData> </Event> This looks like a big issue. Many Thanks Milindra

Has anybody looked at the suggested KB articles? --jp

I have, but we are not using FSRM and I don't see the security update KB896427 is referring to installed on our server. I've begun removing roaming profiles for users who have their own laptop or workstation. However, we have a pretty significant amount of users who share PC's and I've already come across 2 users since 1/6 who have received this error more than once.

Arobbo, Since the error message is stating it cannot read the profile folder's "Cookies" directory I started deleting the cookies from the server for users experiencing the problem. Once they were deleted the error message went away and the user's profile was able to load. This workaround is much easier than re-creating the profile, but it's just a workaround. I'm concerned about it happening again. If anyone knows of any fixes please let us know. Hi, How did you delete the cookies on the server. Because ususally even the admin dont have permission to access each profile folders. Thanks

Our domain admin account has full control on the profile shares and the folders themselves. When you access the user's profile folder on the server the "Cookies" directory does not appear even if you have hidden files and folders displayed. Add "\cookies" at the end of the profile directory path in the address bar and the cookie files will appear. I do a ctrl + A to select them all and a shift + delete to remove them. I also remote into the local machine and remove the cookies from there as well. I know this is very cumbersome, especially since it is most likely the problem will appear again, but it's the only way I figured out how to get their profile loaded. I have a call into a third-party vendor we use to help us out with problems like these. I'll keep this thread posted.

Two weeks further and still having this issue sometimes. resolution for me is still deleting the cookies on the network server. WHen i browse to the folder with the cookies on the network i cant delete the specific cookie. But when I log on to the server browse to the file locally and then delete the file it goes OK. Also i delete the file on the local computer of the user wich is having problems. so i delete: C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Cookies\Low\%username%@adtech[1].txt this often can't be done by the user itself. so log in as administrator and delete the specific cookie. If this still isn't possible (i've experienced it) then start a CMD windows and delete the file by command. second i delete the network version of the file if available \\donnerschool.intra$NOCSC$\dfs\ProfilesDonnerschool\%username%.V2\AppData\Roaming\Microsoft\Windows\Cookies\Low\aalberts@adtech[1].txt when you browse to the share and cant delete it log on to the server wich host is en delete it there. The problem happens on WIndows 7 clients wich host there profile on a dfs share. The dfs is a windows 2003 R2 DFS. hosted on a site with 2003 R2 as server and on an othersite hosted on a WIndows 2008 R2 server. On both locations this error occurs once in a while. so i have the feeling it can't be solved by an upgrade to windows 2008 R2 An other solution i've implemented for our users with an mandatory profile is an bootscript wich delete al the cookies from the local computer. but this also isn't a real solution!

i'm also using mcafee as a virusscanner. and windows 7...

https://community.mcafee.com/thread/31975 im contacting mcafee about this...

Looks like this problem cased by Macfee! Oh if that so I hate them!!!!!

I just called them and the didn't gave me a good solution yet. but for you all to try. in the online control pannel you can change the policy voor virus and spyware 1) Lower the artemis level to low 2) Select “report” for all PUPs. On the computers itself you can disable cookie scanning 3) Disable the cookiescanning from the reg : HK_Local_machine\software\Mcafee\SystemCore\VSCore\On Acess Scanner\Mchield\Configuration . The Dword is “ScanCookies” , the default value is “ 1” , change it to “0” Edit extra info i've just located the problem with mcafee. when you edit online your mcafee saas policy then you can go to Protection against virusses and spyware third tab accepted files Look here and you will find al the blokked files. al my blokked cookies were in this list. Here you can OK the cookies. (if you want) So problem discription is Mcafee finds a cookie Mcafee doesn't trust it so locks the file Windows cannot sync your profile User cant login

wow...I should've mentioned that our organization also uses mcafee for anti-virus. Our current version is 5.2. I don't have access to modify our mcafee policy, but I did follow the procedure on how to disable cookie scanning on the local machines. Once I disabled the scanning, I had one user, who was experiencing the problem, log into a problem machine...he was able to log in just fine. I will continue to monitor the problem. If reports of this type of problem stop I will certainly be on the phone with Mcafee to find out what is going on. Thank you Hoenderdos for the information....and good call Milindra!

I received the registry fix from McAfee. After installing it on 7 workstations I was still receiving the roaming profile error, but after realizing that the server where the roaming profiles are located is also performing the cookie scan I went ahead and installed the registry fix on the server as well since it has the same version of mcafee as the workstations. Roaming profiles are now loading correctly. Looks like all is well for now. Thanks again!

Hi efg20, Thank you for your feedback. This solution will benefit many other users who access this forum. Have a nice day!This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, I also got the registry fix from Mcafee & that seems to be the tirc! Thanks All

Hi efg20 , I'm from Brazil , my name is Mateus. In my company we have the same problem , and here in Brazil we can't contact McAfee's personal. Can I send you my e-mail and you send me the fix to this McAfee's problem ? shaka.29@hotmail.com Thank you now , sorry for the inconvenience. Shaka

Hi efg20, Sorry about the delay reply. Iwas really busy with some other stuff. I can send this tomorrow. Many Thanks

It's on its way Mateus.

mcafee is a pain seriosuly. For protection download microsoft security essentials and also in mcafee there is a option either you promt or decline a cookie as it prompts.

Hi efg20, Sorry about the delay reply. Iwas really busy with some other stuff. I can send this tomorrow. Many Thanks I was given the reg fix as well, but it doesn't seem to be fixing the issue and unfortunately McAfee support is very slow. Can you verify that your registry fix is the same as below? [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\SystemCore\vscore\On Access Scanner\McShield\Configuration] "ScanProcessesOnEnable"=dword:00000000 "ScanCookies"=dword:00000000 Thanks.

Hi efg20, yes that the fix given. Its looks it happening again to my desktops as well. Well I only ran the fix on my server. I though thats enough. Probably I will run that fix on the desktops as well. Lets see what happens. Thanks

Hello All... It has been for over a year now since McAfee set us up with this annoying defect in their software and still no suitable solution! I serve several customers with McAfee in client/server and terminal Server environments and still having problems with roaming profiles. Also the Online back-up solutions we use with rSync are being affected. So I decided to try figure this out and come up with a solution that works. Been to all the forums, spoke to McAfee, since we have Gold Support and all... No luck. Patches, registry tweaks, you name it... It does not work! Then I decided to figure out how to exclude these annoying cookies from being scanned... This is what I came up with and it works! Finally! Setup your policies with wildcards ** to exclude folders containing cookies. For Windows XP and Server 2003: Folder: C:\Documents and Settings\**\Cookies\ For Windows 7 and Server 2008: Folder: C:\Users\**\AppData\Roaming\Microsoft\Windows\Cookies\ The ** means to exclude all folders it comes across form the folder "Documents and Settings" or "Users" In other words, this applies for all users on the workstation or server. I also excluded the shares profile folder on the server for my online back-up: For Windows 7: F:\Profile\**\AppData\Roaming\Microsoft\Windows\Cookies\ For Windows XP: F:\profile\**\Cookies\ Also the shared UNC path is excluded: For Windows 7: \\ServerName\prf$\**\AppData\Roaming\Microsoft\Windows\Cookies For Windows XP: \\ ServerName\prf$\**\Cookies\ But be aware, double wildcards for folders does not seem to work, eg. \\ ServerName\prf$\**\**\Cookies\ I tried this on my provisioned Terminal Server, witch is shared with more company’s. \\ ServerName\prf$\Company1\Username\Cookies\ \\ ServerName\prf$\Company2\Username\Cookies\ \\ ServerName\prf$\Company3\Username\Cookies\ It’s not a very neat solution because no cookies get scanned anymore by McAfee, but in my humble opinion, cookies aren’t that harmful in this case. I sure hope McAfee can come up with a more subtle solution than this, but I kind of lost hope after a year! I hope I can help fellow system administrators with this solution. Michael van Zomeren SkylarNET www.skylarnet.nl

Hi Michael van Zomeren, SkylarNET I will try this. Many Thanks again. many thanks for the effort you have put to give us a solution. Yes the problem still exsist with the previous registry issues.