Каждое утро при заходе пользователя блокирует NTUSER.dat
Пользователь вечером выходит корректно.
Как только пользователь заходит под RDP,происходит блокировка.
Соответственно создается временный профиль
Блокирует системой а не какой-то левой программой.
пытался отловить OH из инструментария там только system PID 004 ничего левого.
При выходе пользователя блок остается и не дает запустить нормальный профиль.
пользователя нет в терминале, выгружен, если смотреть по диспетчеру задач,
NTUSER.DAT блокирован системной если по файловому монитору смотреть.
попробовал увеличить количество попыток выгрузить реестр и тайм-аут.
чаще всего утром когда все заходят, посреди дня наоборот может зайти нормально.
перезагружаешь сервер, все нормально заходят.
установил User Cleanup Service думал что антивирус удалил не улучшилась ситуация.
вот лог ProcMon
принтеры HP
Код: Выделить всё
Date & Time: 15.03.2013 7:52:04
Event Class: File System
Operation: CreateFile
Result: SHARING VIOLATION
Path: C:\Documents and Settings\lkletkina\NTUSER.DAT
TID: 1248
Duration: 0.0000963
Desired Access: Read Data/List Directory, Write Data/Add File
Disposition: OpenIf
Options: Random Access, Open For Backup, No Compression
Attributes: N
ShareMode: None
AllocationSize: 0
Impersonating: NT AUTHORITY\система
[*]
"Frame","Module","Location","Address","Path"
"0","fltmgr.sys","fltmgr.sys + 0x24ca","0xf72194ca","C:\WINDOWS\System32\Drivers\fltmgr.sys"
"1","fltmgr.sys","fltmgr.sys + 0x3f2a","0xf721af2a","C:\WINDOWS\System32\Drivers\fltmgr.sys"
"2","fltmgr.sys","fltmgr.sys + 0x120ad","0xf72290ad","C:\WINDOWS\System32\Drivers\fltmgr.sys"
"3","fltmgr.sys","fltmgr.sys + 0x125cc","0xf72295cc","C:\WINDOWS\System32\Drivers\fltmgr.sys"
"4","ntkrnlpa.exe","ntkrnlpa.exe + 0x1df85","0x8081df85","C:\WINDOWS\system32\ntkrnlpa.exe"
"5","ntkrnlpa.exe","ntkrnlpa.exe + 0xf904d","0x808f904d","C:\WINDOWS\system32\ntkrnlpa.exe"
"6","ntkrnlpa.exe","ntkrnlpa.exe + 0x137a40","0x80937a40","C:\WINDOWS\system32\ntkrnlpa.exe"
"7","ntkrnlpa.exe","ntkrnlpa.exe + 0x133b74","0x80933b74","C:\WINDOWS\system32\ntkrnlpa.exe"
"8","ntkrnlpa.exe","ntkrnlpa.exe + 0xeaee7","0x808eaee7","C:\WINDOWS\system32\ntkrnlpa.exe"
"9","ntkrnlpa.exe","ntkrnlpa.exe + 0xec181","0x808ec181","C:\WINDOWS\system32\ntkrnlpa.exe"
"10","ntkrnlpa.exe","ntkrnlpa.exe + 0xeec10","0x808eec10","C:\WINDOWS\system32\ntkrnlpa.exe"
"11","ntkrnlpa.exe","ntkrnlpa.exe + 0x897ec","0x808897ec","C:\WINDOWS\system32\ntkrnlpa.exe"
"12","ntkrnlpa.exe","ntkrnlpa.exe + 0x2e921","0x8082e921","C:\WINDOWS\system32\ntkrnlpa.exe"
"13","ntkrnlpa.exe","ntkrnlpa.exe + 0xc8d7d","0x808c8d7d","C:\WINDOWS\system32\ntkrnlpa.exe"
"14","ntkrnlpa.exe","ntkrnlpa.exe + 0xca7da","0x808ca7da","C:\WINDOWS\system32\ntkrnlpa.exe"
"15","ntkrnlpa.exe","ntkrnlpa.exe + 0xc4771","0x808c4771","C:\WINDOWS\system32\ntkrnlpa.exe"
"16","ntkrnlpa.exe","ntkrnlpa.exe + 0xbc1eb","0x808bc1eb","C:\WINDOWS\system32\ntkrnlpa.exe"
"17","ntkrnlpa.exe","ntkrnlpa.exe + 0xbc402","0x808bc402","C:\WINDOWS\system32\ntkrnlpa.exe"
"18","ntkrnlpa.exe","ntkrnlpa.exe + 0x897ec","0x808897ec","C:\WINDOWS\system32\ntkrnlpa.exe"
Description: Программа входа в систему Windows NT
Company: Microsoft Corporation
Name: winlogon.exe
Version: 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
Path: C:\WINDOWS\system32\winlogon.exe
Command Line: winlogon.exe
PID: 452
Parent PID: 380
Session ID: 0
User: NT AUTHORITY\SYSTEM
Auth ID: 00000000:000003e7
Architecture: 32-bit
Virtualized: n/a
Integrity: n/a
Started: 14.03.2013 8:10:22
Ended: (Running)
Modules:
winlogon.exe 0x1000000 0x87000 C:\WINDOWS\system32\winlogon.exe Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
xpsp2res.dll 0x1480000 0x2cd000 C:\WINDOWS\system32\xpsp2res.dll Корпорация Майкрософт 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
msvcp60.dll 0x1790000 0x65000 C:\WINDOWS\system32\msvcp60.dll Microsoft Corporation 7.0.3790.3959 (srv03_sp2_rtm.070216-1710)
msctfime.ime 0x4dcb0000 0x2e000 C:\WINDOWS\system32\msctfime.ime Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
dimsntfy.dll 0x5fe60000 0x8000 C:\WINDOWS\system32\dimsntfy.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
rsaenh.dll 0x68000000 0x35000 C:\WINDOWS\system32\rsaenh.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
hnetcfg.dll 0x6edb0000 0x5a000 C:\WINDOWS\system32\hnetcfg.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
wshtcpip.dll 0x71970000 0x8000 C:\WINDOWS\System32\wshtcpip.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
mswsock.dll 0x719b0000 0x42000 C:\WINDOWS\System32\mswsock.dll Microsoft Corporation 5.2.3790.4318 (srv03_sp2_gdr.080620-1216)
UxTheme.dll 0x71a00000 0x36000 C:\WINDOWS\system32\UxTheme.dll Microsoft Corporation 6.00.3790.3959 (srv03_sp2_rtm.070216-1710)
wsock32.dll 0x71a40000 0xa000 C:\WINDOWS\system32\wsock32.dll Microsoft Corporation 5.2.3790.0 (srv03_rtm.030324-2048)
MPR.dll 0x71a60000 0x11000 C:\WINDOWS\system32\MPR.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
WS2HELP.dll 0x71a80000 0x8000 C:\WINDOWS\system32\WS2HELP.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
WS2_32.dll 0x71a90000 0x17000 C:\WINDOWS\system32\WS2_32.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
NETAPI32.dll 0x71ad0000 0x57000 C:\WINDOWS\system32\NETAPI32.dll Microsoft Corporation 5.2.3790.4392 (srv03_sp2_gdr.081016-1620)
kerberos.dll 0x71b30000 0x59000 C:\WINDOWS\system32\kerberos.dll Microsoft Corporation 5.2.3790.4806 (srv03_sp2_gdr.101217-0235)
WINSCARD.DLL 0x722c0000 0x1b000 C:\WINDOWS\system32\WINSCARD.DLL Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
WINSPOOL.DRV 0x72ef0000 0x27000 C:\WINDOWS\system32\WINSPOOL.DRV Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
icmp.dll 0x73f20000 0x5000 C:\WINDOWS\system32\icmp.dll Microsoft Corporation 5.2.3790.0 (srv03_rtm.030324-2048)
wbemsvc.dll 0x74c00000 0xe000 C:\WINDOWS\system32\wbem\wbemsvc.dll Microsoft Corporation 5.2.3790.0 (srv03_rtm.030324-2048)
wbemprox.dll 0x74c10000 0x9000 C:\WINDOWS\system32\wbem\wbemprox.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
Cabinet.dll 0x74ec0000 0x19000 C:\WINDOWS\system32\Cabinet.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
wbemcomn.dll 0x75010000 0x3a000 C:\WINDOWS\system32\wbem\wbemcomn.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
fastprox.dll 0x75470000 0x79000 C:\WINDOWS\system32\wbem\fastprox.dll Microsoft Corporation 5.2.3790.4455 (srv03_sp2_gdr.090203-1205)
PROFMAP.dll 0x75720000 0x9000 C:\WINDOWS\system32\PROFMAP.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
NDdeApi.dll 0x75730000 0x8000 C:\WINDOWS\system32\NDdeApi.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
WlNotify.dll 0x75740000 0x1c000 C:\WINDOWS\system32\WlNotify.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
MSGINA.dll 0x75760000 0x12d000 C:\WINDOWS\system32\MSGINA.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
sxs.dll 0x75cc0000 0xbd000 C:\WINDOWS\system32\sxs.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
apphelp.dll 0x75d80000 0x27000 C:\WINDOWS\system32\apphelp.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
MSASN1.dll 0x760b0000 0x12000 C:\WINDOWS\system32\MSASN1.dll Microsoft Corporation 5.2.3790.4584 (srv03_sp2_gdr.090904-1300)
CRYPT32.dll 0x760d0000 0x94000 C:\WINDOWS\system32\CRYPT32.dll Microsoft Corporation 5.131.3790.4933 (srv03_sp2_gdr.111111-0334)
IMM32.DLL 0x761b0000 0x1d000 C:\WINDOWS\system32\IMM32.DLL Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
cscdll.dll 0x76440000 0x1d000 C:\WINDOWS\system32\cscdll.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
SETUPAPI.dll 0x764c0000 0x10a000 C:\WINDOWS\system32\SETUPAPI.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
cryptdll.dll 0x76600000 0xc000 C:\WINDOWS\system32\cryptdll.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
NTDSAPI.DLL 0x76610000 0x14000 C:\WINDOWS\system32\NTDSAPI.DLL Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
USERENV.dll 0x76840000 0xc2000 C:\WINDOWS\system32\USERENV.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
ATL.DLL 0x769a0000 0x12000 C:\WINDOWS\system32\ATL.DLL Microsoft Corporation 3.05.2284
WINMM.dll 0x769c0000 0x2e000 C:\WINDOWS\system32\WINMM.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
sfc.dll 0x76a30000 0x5000 C:\WINDOWS\system32\sfc.dll Microsoft Corporation 5.2.3790.0 (srv03_rtm.030324-2048)
SHSVCS.dll 0x76a60000 0x24000 C:\WINDOWS\system32\SHSVCS.dll Microsoft Corporation 6.00.3790.3959 (srv03_sp2_rtm.070216-1710)
PSAPI.DLL 0x76a90000 0xb000 C:\WINDOWS\system32\PSAPI.DLL Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
credui.dll 0x76aa0000 0x2e000 C:\WINDOWS\system32\credui.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
WINTRUST.dll 0x76ad0000 0x2c000 C:\WINDOWS\system32\WINTRUST.dll Microsoft Corporation 5.131.3790.4642 (srv03_sp2_gdr.091223-1236)
sfc_os.dll 0x76b00000 0x2b000 C:\WINDOWS\system32\sfc_os.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
imagehlp.dll 0x76b30000 0x28000 C:\WINDOWS\system32\imagehlp.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
MPRAPI.dll 0x76bf0000 0x19000 C:\WINDOWS\system32\MPRAPI.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
iphlpapi.dll 0x76c10000 0x1a000 C:\WINDOWS\system32\iphlpapi.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
adsldpc.dll 0x76ce0000 0x28000 C:\WINDOWS\system32\adsldpc.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
ACTIVEDS.dll 0x76d10000 0x34000 C:\WINDOWS\system32\ACTIVEDS.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
rtutils.dll 0x76d50000 0xc000 C:\WINDOWS\system32\rtutils.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
DNSAPI.dll 0x76df0000 0x2b000 C:\WINDOWS\system32\DNSAPI.dll Microsoft Corporation 5.2.3790.4840 (srv03_sp2_gdr.110302-0457)
WTSAPI32.dll 0x76e20000 0x8000 C:\WINDOWS\system32\WTSAPI32.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
WLDAP32.dll 0x76e30000 0x2f000 C:\WINDOWS\system32\WLDAP32.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
Secur32.dll 0x76e70000 0x13000 C:\WINDOWS\system32\Secur32.dll Microsoft Corporation 5.2.3790.4530 (srv03_sp2_gdr.090615-1611)
rasadhlp.dll 0x76ea0000 0x5000 C:\WINDOWS\system32\rasadhlp.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
COMRes.dll 0x76f30000 0x187000 C:\WINDOWS\system32\COMRes.dll Корпорация Майкрософт 2001.12.4720.3959 (srv03_sp2_rtm.070216-1710)
Comctl32.dll 0x77360000 0x103000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.4770_x-ww_05FDF087\Comctl32.dll Microsoft Corporation 6.0 (srv03_sp2_qfe.100903-0347)
ole32.dll 0x77510000 0x139000 C:\WINDOWS\system32\ole32.dll Microsoft Corporation 5.2.3790.4750 (srv03_sp2_gdr.100723-0347)
CLBCatQ.DLL 0x77650000 0x83000 C:\WINDOWS\system32\CLBCatQ.DLL Microsoft Corporation 2001.12.4720.3959 (srv03_sp2_rtm.070216-1710)
WINSTA.dll 0x779b0000 0x11000 C:\WINDOWS\system32\WINSTA.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
VERSION.dll 0x77b80000 0x8000 C:\WINDOWS\system32\VERSION.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
msvcrt.dll 0x77b90000 0x5a000 C:\WINDOWS\system32\msvcrt.dll Microsoft Corporation 7.0.3790.3959 (srv03_sp2_rtm.070216-1710)
GDI32.dll 0x77bf0000 0x49000 C:\WINDOWS\system32\GDI32.dll Microsoft Corporation 5.2.3790.4396 (srv03_sp2_gdr.081022-1212)
RPCRT4.dll 0x77c40000 0xa0000 C:\WINDOWS\system32\RPCRT4.dll Microsoft Corporation 5.2.3790.4759 (srv03_sp2_gdr.100817-0343)
OLEAUT32.dll 0x77cf0000 0x8b000 C:\WINDOWS\system32\OLEAUT32.dll Microsoft Corporation 5.2.3790.4807
COMCTL32.dll 0x77e40000 0x97000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_5.82.3790.4770_x-ww_A689AB02\COMCTL32.dll Microsoft Corporation 5.82 (srv03_sp2_qfe.100903-0347)
SHLWAPI.dll 0x77ee0000 0x52000 C:\WINDOWS\system32\SHLWAPI.dll Microsoft Corporation 6.00.3790.4603 (srv03_sp2_gdr.091015-1453)
USER32.dll 0x77f40000 0x91000 C:\WINDOWS\system32\USER32.dll Microsoft Corporation 5.2.3790.4033 (srv03_sp2_gdr.070228-0030)
REGAPI.dll 0x77fe0000 0x11000 C:\WINDOWS\system32\REGAPI.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
ADVAPI32.dll 0x78000000 0xaf000 C:\WINDOWS\system32\ADVAPI32.dll Microsoft Corporation 5.2.3790.4555 (srv03_sp2_gdr.090718-1230)
kernel32.dll 0x7c800000 0x103000 C:\WINDOWS\system32\kernel32.dll Microsoft Corporation 5.2.3790.4480 (srv03_sp2_gdr.090321-1244)
ntdll.dll 0x7c910000 0xc4000 C:\WINDOWS\system32\ntdll.dll Microsoft Corporation 5.2.3790.4789 (srv03_sp2_gdr.101019-0340)
shell32.dll 0x7c9e0000 0x803000 C:\WINDOWS\system32\shell32.dll Microsoft Corporation 6.00.3790.4822 (srv03_sp2_gdr.110121-0354)
SAMLIB.dll 0x7e020000 0xf000 C:\WINDOWS\system32\SAMLIB.dll Microsoft Corporation 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
