Login Scripts Fail Using Profile Manager

Login Scripts Fail Using Profile Manager

book

Article ID: CTX137853

calendar_today

Updated On:

Description

Login scripts do not run with Profile Manager, configured to delete cached profiles, and RSOP logging disabled through Group Policy.

Configuration Settings

Group Policy Policy Settings

  • Disable RSOP Logging - The corresponding policy is located in Administrative Templates\System\Group Policy. (Turn off Resultant Set of Policy logging)

  • Enable Drive Mapping Script - The corresponding policy is located in Windows Settings\Scripts\Logon.

Citrix Profile Manager Settings

  • Base Settings
    • Enable Profile Management (Enabled)
    • Process logons of local administrators (Enabled)
    • Path to user store (Enabled - \\server-name\share-name\%username%\)
    • Active write back (Enabled)
  • Profile Handling
    • Delete locally cached profiles on logoff (Enabled)
    • Local profile conflict handling (Enabled – Delete local profile)
  • Log settings
    • Enable Logging (Enabled)
    • Log Settings (Enabled – All checked)
  • Streamed User Profiles
    • Profile streaming (Enabled)
    • Always cache (Enabled – 0)

Debug Settings

  • Enabled GPSvcDebugLevel for Group Policy Logging
    • In registry editor, expand HKLM\Software\Microsoft\Windows NT\CurrentVersion.
    • Create new key Diagnostics.
    • Create DWORD GPSvcDebugLevel and set value to 0x10002.
  • Run Process Monitor
    • Filter on HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\<USER_SID>\Scripts

Script Contents

Net use <drive-letter> \\server-name\share-name /persistent:no 

Troubleshooting Methodology

Complete the following steps to reproduce the issue:

  1. Login to published desktop session with user managed by profile manager and drive mapping policy.
    Validate drive mapping exists for user.

  2. Logoff session and wait for profile to be completely deleted.
    Validate profile is gone and references in HKLM are also removed.
    Get user SID with PsGetsid (http://technet.microsoft.com/en-us/sysinternals/bb897417.aspx) - Psgetsid domain\user
    Ensure references to SID are removed from HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy.
    i. State\SID
    ii. Cache\SID
    iii. Status\SID

  3. Log on when all settings are removed. Validate that drive mapping does not exist.

Debug Data

Process Monitor Logon

  • svchost.exe         RegCreateKey     HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts   SUCCESS
  • svchost.exe         RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegCloseKey       HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegOpenKey       HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts   SUCCESS
  • svchost.exe         RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegCloseKey       HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • gpscript.exe         RegOpenKey       HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts   SUCCESS
  • gpscript.exe         RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • gpscript.exe         RegCloseKey       HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegOpenKey        HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts   SUCCESS
  • svchost.exe         RegQueryKey       HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegCloseKey        HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
 GPSVC Log
  • GPSVC(4d0.cf4) 11:41:45:514 ProcessGPOs: Processing extension Scripts
  • GPSVC(4d0.cf4) 11:41:45:514 ReadStatus: Read Extension's Previous status successfully.
  • GPSVC(4d0.cf4) 11:41:45:514 CompareGPOLists:  The lists are the same.
  • GPSVC(4d0.cf4) 11:41:45:514 GPLockPolicySection: Sid = S-1-5-21-1878797127-1335095706-2846387547-31931, dwTimeout = 30000, dwFlags = 0
  • GPSVC(4d0.cf4) 11:41:45:514 LockPolicySection called for user <S-1-5-21-1878797127-1335095706-2846387547-31931>
  • GPSVC(4d0.cf4) 11:41:45:514 Sync Lock Called
  • GPSVC(4d0.cf4) 11:41:45:514 Writer Lock got immediately.
  • GPSVC(4d0.cf4) 11:41:45:514 Lock taken successfully
  • GPSVC(4d0.cf4) 11:41:45:514 ProcessGPOList: Entering for extension Scripts
  • GPSVC(4d0.cf4) 11:41:45:514 UserPolicyCallback: Setting status UI to Applying Scripts policy...
  • GPSVC(4d0.139c) 11:41:45:514 Message Status = <Applying Scripts policy...>
  • GPSVC(4d0.cf4) 11:41:45:530 LogExtSessionStatus: Successfully logged Extension Session data
  • GPSVC(4d0.139c) 11:41:45:530 Setting GPsession state = 1
  • GPSVC(4d0.cf4) 11:41:45:671 ProcessGPOList: Extension Scripts returned 0x0.
  • GPSVC(4d0.cf4) 11:41:45:671 ProcessGPOList: Extension Scripts was able to log data. RsopStatus = 0x0, dwRet = 0, Clearing the dirty bit
  • GPSVC(4d0.cf4) 11:41:45:686 UnLockPolicySection called for user <S-1-5-21-1878797127-1335095706-2846387547-31931>
  • GPSVC(4d0.cf4) 11:41:45:686 UnLocked successfully
Process Monitor Logoff
  • svchost.exe         RegOpenKey  HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts   SUCCESS
  • svchost.exe         RegQueryKey HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegCloseKey  HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • gpscript.exe         RegOpenKey  HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts   SUCCESS
  • gpscript.exe         RegQueryKey HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • gpscript.exe         RegCloseKey  HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegOpenKey   HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts   SUCCESS
  • svchost.exe         RegQueryKey  HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • svchost.exe         RegCloseKey   HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegOpenKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegEnumKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegEnumKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegQueryKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegEnumKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      NO MORE ENTRIES
  • UserProfileManager.exe          RegCloseKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegOpenKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegDeleteKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS
  • UserProfileManager.exe          RegCloseKey      HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts      SUCCESS

Troubleshooting Methodology– Continued

  1. Enable Policy Turn off Resultant Set of Policy Logging.

  2. Run GPUPDATE /FORCE on XenApp Server.

  3. Log on again with test user.

Process Monitor Log

  • svchost.exe         RegOpenKey           HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts   NAME NOT FOUND
  • gpscript.exe         RegOpenKey          HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts   NAME NOT FOUND
  • svchost.exe         RegOpenKey           HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1878797127-1335095706-2846387547-31931\Scripts   NAME NOT FOUND

GPSVC Log

  • GPSVC(4d0.5f4) 12:03:16:615 ProcessGPOs: Processing extension Scripts
  • GPSVC(4d0.5f4) 12:03:16:615 ReadStatus: Read Extension's Previous status successfully.
  • GPSVC(4d0.5f4) 12:03:16:615 CompareGPOLists:  The lists are the same.
  • GPSVC(4d0.5f4) 12:03:16:615 CheckGPOs: No GPO changes and no security group membership change and extension Scripts has NoGPOChanges set.

MS Roaming Profile

The same steps were followed with a Microsoft Roaming profile. It was seen that when using a Microsoft Roaming profile, the issue was not reproducible.  A Time Travel Trace was taken while reproducing the issue and it was later found that Citrix Profile Manager was deleting the following key:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PolicyGuid\<GUID>

This particular GUID has a reference to the user SID. Early in Group Policy processing a comparison is done to check if any changes mustere  be processed for a user and if the Scripts Client Side Extension needs to do a refresh.  In the case it is seen that no script refresh needs to occur.

Resolution

As a workaround, enable the following policy:

  • Set the following policy to Enable:
    Computer Configuration\Administrative Templates\System\Group Policy\Scripts policy processing

  • Select the Process even if the Group Policy objects have not changed option.

Issue/Introduction

This article contains information to run logon scripts with Profile Manager configured to delete cached profiles.
Powered by Wolken Software