VOGONS


First post, by feipoa

User metadata
Rank l33t++
Rank
l33t++

I've been using POS2009 on my XP system (Opteron 185) for years without issue, but when there were a few updates which didn't work right sometime in 2018 or early 2019, I had to do a system restore using XP's restore feature. The restore worked, but I've had these errors ever since. Unfortunately, I did the same update on my XP laptop, so both systems now have these Event Viewer errors. Creating a new profile didn't help. I have spent many fruitless hours trying to figure this out with the aid of internet searching. Anyone solved these?

Profile_Errors_Event_Viewer.jpg
Filename
Profile_Errors_Event_Viewer.jpg
File size
215.06 KiB
Views
1795 views
File license
Fair use/fair dealing exception
Source: Userenv
Event ID: 1502
Type: Error
User: NT AUTHORITY\NETWORK SERVICE
Computer: Opteron

Windows cannot load the locally stored profile. Possible causes of this error include insufficient security rights or a corrupt local profile. If this problem persists, contact your network administrator.

DETAIL - Access is denied.
Source: Userenv
Event ID: 1515
Type: Error
User: NT AUTHORITY\NETWORK SERVICE
Computer: Opteron

Windows has backed up this user's profile. Windows will automatically try to use the backed up profile the next time this user logs on.
Source: Userenv
Event ID: 1511
Type: Error
User: NT AUTHORITY\NETWORK SERVICE
Computer: Opteron

Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.
Source: Userenv
Event ID: 1502
Type: Error
User: NT AUTHORITY\LOCAL SERVICE
Computer: Opteron

Windows cannot load the locally stored profile. Possible causes of this error include insufficient security rights or a corrupt local profile. If this problem persists, contact your network administrator.

DETAIL - Access is denied
Source: Userenv
Event ID: 1515
Type: Error
User: NT AUTHORITY\LOCAL SERVICE
Computer: Opteron

Windows has backed up this user's profile. Windows will automatically try to use the backed up profile the next time this user logs on.
Source: Userenv
Event ID: 1511
Type: Error
User: NT AUTHORITY\LOCAL SERVICE
Computer: Opteron

Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.
Last edited by feipoa on 2019-11-14, 09:56. Edited 2 times in total.

Plan your life wisely, you'll be dead before you know it.

Reply 1 of 12, by DosFreak

User metadata
Rank l33t++
Rank
l33t++

First, is this ever preventing something from working?

Have you tried:

Resetting permissions on the profile folders
Deleting the profile folders
UPHclean

How To Ask Questions The Smart Way
Make your games work offline

Reply 2 of 12, by gca

User metadata
Rank Member
Rank
Member

Had a similar problem with a Windows 7 box a while back. Turns out it was a bad registry entry that was causing the problem. Editing/deleting the offending entry fixed the issue:

https://www.techwalla.com/articles/how-to-rep … in-the-registry

Reply 3 of 12, by cyclone3d

User metadata
Rank l33t++
Rank
l33t++

I've had that happen before.

Simplest fix most of the time is to backup needed files and reinstall from scratch.

Yamaha modified setupds and drivers
Yamaha XG repository
YMF7x4 Guide
Aopen AW744L II SB-LINK

Reply 4 of 12, by feipoa

User metadata
Rank l33t++
Rank
l33t++
DosFreak wrote:

First, is this ever preventing something from working?

Originally, I thought it was causing issues with MsiInstaller programs installing properly, but I'm not convinced anymore because I have a P4 Prescott which I didn't use restore on and it has the same MsiInstaller issues. A recent post on this is here: Solved - HELP! Cannot get MsiInstaller to install programs in XP SP3 + POS2009

I once did solve this issue after about 10 hours of messing around with google-returned fix ideas, but the fix didn't work this time around. This was about a year since I tried whatever convoluted fix that worked and I don't remember exactly what I did anymore. But I do recall trying the same fix for the current installation and it not working.

Do answer directly, I don't know if using a temporary profile at boot is causing any other program not to run

DosFreak wrote:
Have you tried: […]
Show full quote

Have you tried:

Resetting permissions on the profile folders
Deleting the profile folders
UPHclean

I tried many things 6 months ago, but my memory is foggy now. I know I tried creating a new profile and using that, but the error message prevailed. When you say "deleting the profile folders", do you mean deleting C:\Documents and Settings\feipoa ? or deleting my user profile from within System Properties/User Profiles? I have definitely tried the latter after creating a new user profile, but it didn't help.

Plan your life wisely, you'll be dead before you know it.

Reply 5 of 12, by feipoa

User metadata
Rank l33t++
Rank
l33t++
gca wrote:

Had a similar problem with a Windows 7 box a while back. Turns out it was a bad registry entry that was causing the problem. Editing/deleting the offending entry fixed the issue:

https://www.techwalla.com/articles/how-to-rep … in-the-registry

I will try this next. Thanks.

Plan your life wisely, you'll be dead before you know it.

Reply 6 of 12, by feipoa

User metadata
Rank l33t++
Rank
l33t++

I'm going to try working on this tonight.

DosFreak wrote:

First, is this ever preventing something from working?

I thought it was causing Windows Installer issues, but I've fixed that.

DosFreak wrote:

?Have you tried:
Resetting permissions on the profile folders

How is this done? And set them to what? Creating new profiles illicit the same 6 errors.

DosFreak wrote:

Have you tried:
UPHclean

Yes, I am using UPHClean 1.6d. I had installed it to fixed some shutdown error. I know there is a 2.0 beta, but haven't tried it. Should I bother?

Plan your life wisely, you'll be dead before you know it.

Reply 7 of 12, by feipoa

User metadata
Rank l33t++
Rank
l33t++
gca wrote:

Had a similar problem with a Windows 7 box a while back. Turns out it was a bad registry entry that was causing the problem. Editing/deleting the offending entry fixed the issue:

https://www.techwalla.com/articles/how-to-rep … in-the-registry

I recall trying these instructions a few months ago, but it didn't work for me. There was an instance whereby these instructions worked for me when the profile with a problem was my personal profile. The profiles afflicted in this case appear to be: LocalService and NetworkService. But alas, I followed the instructions, but it did not help. Here are some screenshots.

NETWORK_SERVICE.jpg
Filename
NETWORK_SERVICE.jpg
File size
136.63 KiB
Views
1795 views
File license
Fair use/fair dealing exception
LOCAL_SERVICE.jpg
Filename
LOCAL_SERVICE.jpg
File size
135.28 KiB
Views
1795 views
File license
Fair use/fair dealing exception

Renamed per instructions:

RENAMED_per_instructions.jpg
Filename
RENAMED_per_instructions.jpg
File size
132.42 KiB
Views
1795 views
File license
Fair use/fair dealing exception

Rebooted, and the same 6 errors persist.

Here's a screenshot of all the profiles on the computer. So perhaps the permissions to NetworkService and LocalService are buggered up? How to fix this and what should they be set to? Alternately, how to properly delete these profiles and re-create them? Much appreciated everyone!

ALL_PROFILES.jpg
Filename
ALL_PROFILES.jpg
File size
250.75 KiB
Views
1795 views
File license
Fair use/fair dealing exception

The registry contents of the NTUSER.DAT files for the NetworkService LocalService profiles is shown below. Not sure what to check in these for errors.

NTUSER.DAT_for_NetworkService_and_LocalService.jpg
Filename
NTUSER.DAT_for_NetworkService_and_LocalService.jpg
File size
132.32 KiB
Views
1791 views
File license
Fair use/fair dealing exception

I suspect that some unknown service is locking down NTUSER.DAT for the NetworkService and LocalService, thus forcing temp profiles for Network/Local services. How do I find out what service, program, driver or other entity is holding down these NSUSER.DAT files?

Plan your life wisely, you'll be dead before you know it.

Reply 8 of 12, by feipoa

User metadata
Rank l33t++
Rank
l33t++

I decided to run MSCONFIG, and perform a startup in diagnostic mode. Everything is pretty much disabled. I reboot. Microsoft says I've made "substantial changes" to my system and must re-activate Windows XP. I tried my [legally obtained] activation key, and it tells me I've used it for activation too many times. I try the next key I have, and it worked. But I'm probably 1 activation away from not being able to activate anymore. Can calling phone activation clear up increment counter on activation's?

Back to the original story. The Event Viewer won't run in diagnostic mode, so that test was of no use to me.

I've checked the permissions on c:\documents and settings\LocalService and *.\NetworkService on a non-afflicted XP installation to compare them to the afflicted computer, and both permissions look to be the same.

Most of the online help topics on my issue are concerning a user profile that is buggered, not specifically the LocalService and Network Service profiles. How can I clear out these profiles and start over without formatting the machine? Delete c:\documents and settings\LocalService , c:\documents and settings\NetworkService , c:\documents and settings\TEMP , c:\documents and settings\TEMP.NT AUTHORITY , c:\documents and settings\TEMP.NT AUTHORITY.000 , and c:\documents and settings\TEMP.NT AUTHORITY.001 ???

What if I copy NTUSER.DAT files for LocalService and NetworkService from the non-afflicated computer onto the afflicted computer?

This has been the most informative write-up I've found, but no solution was offered. https://serverfault.com/questions/242935/temp … r/517859#517859

Plan your life wisely, you'll be dead before you know it.

Reply 9 of 12, by gca

User metadata
Rank Member
Rank
Member

Took a look through eventid.net for those event id, they have a couple of suggestions, not sure how helpful they will be but here you go:

http://eventid.net/display-eventid-1511-sourc … 555-phase-1.htm

http://eventid.net/display-eventid-1502-sourc … 503-phase-1.htm

Reply 10 of 12, by feipoa

User metadata
Rank l33t++
Rank
l33t++

From that site: “This issue occurs because the NTUser.dat file is not released successfully after the file is loaded under the HKEY_USERS\<SID> registry key. See ME941339 for information on solving this problem.”

Then I click ME941339 and they want me to pay to subscribe. The probability that the working solution is presented upon paying is minimal.

Plan your life wisely, you'll be dead before you know it.

Reply 11 of 12, by feipoa

User metadata
Rank l33t++
Rank
l33t++

I've almost solved this. What did I do? I deleted C:\Documents and Settings\LocalService and C:\Documents and Settings\NetworkService. Then rebooted. The system renamed its .TEMP folders in C:\Documents and Settings to: LocalService.NT AUTHORITY and NetworkService.NT AUTHORITY. There is no longer a *.bak SID in the registry. I no longer receive the 6 error messages in the Event Viewer.

The only thing left remaining which bugs me is the naming. LocalService.NT AUTHORITY should be "LocalService" without the ".NT AUTHORITY"

But WindowsXP won't let me rename those folders, even if I remove the read only setting on it.

So the remaining task is to figure out how to rename these folders and how to rename the S-1-5-19 and S-1-5-20 ProfileImagePath in registry, HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/ProfileList

%SystemDrive%\Documents and Settings\LocalService.NT AUTHORITY and *\NetworkService.NT AUTHORITY and remove the "NT AUTHORITY".

Perhaps if I can rename C:\Documents and Settings\LocalService.NT AUTHORITY and C:\Documents and Settings\NetworkService.NT AUTHORITY by putting the harddrive into another XP machine. Then hopefully Windows would fix the registry to these names? Unfortunately, one of the afflicted computers is a laptop and if I recall, the laptop IDE interface is smaller than standard. I do not have such an adapter.

Plan your life wisely, you'll be dead before you know it.

Reply 12 of 12, by feipoa

User metadata
Rank l33t++
Rank
l33t++

SOLVED!

I believe the issue is caused by the NTUSER.DAT registry file in c:\documents and settings\LocalService and c:\documents and settings\NetworkService getting corrupted by a system restore. Whether it is the restore itself, or the restore in combination with a disagreeable Windows update, I don't know for sure. But to fix the issue, you must delete /LocalService and /NetworkService. Deleting these won't be an issue because, if you are receiving the error messages that I am, you aren't using these folders. You are using some temporary (but persistant) NetworkService.NT AUTHORITY folder and LocalService.NT AUTHORITY folders with a different ntuser.dat file.

Once you've deleted those folders, delete all other temporary folders in c:\documents and settings which aren't being used, e.g. NetworkService.NT AUTHORITY.001, TEMP, etc.

Then go into the registry editor and delete the *bak folders associatd with S-1-5-19 and S-1-5-20. Then rename the ProfileImagePath's for these two folders to %SystemDrive%\Documents and Settings\LocalService and %SystemDrive%\Documents and Settings\NetworkService

The SID for S-1-5-19 and S-1-5-20 may be missing, so copy them over from the -bak folders if they are in there. On my systems, the Sid for S-1-5-19 is 01 01 00 00 00 00 00 05 13 00 00 00 and the Sid for S-1-5-20 is 01 01 00 00 00 00 00 05 14 00 00 00

Reboot and Windows will generate and new c:\documents and settings\LocalService and c:\documents and settings\NetworkService folders. It should now be using these folders. You can now delete the previously two in-use c:\Documents and Settings\ TEMP-type folders as they shouldn't be being used anymore.

Plan your life wisely, you'll be dead before you know it.