Microsoft KB Archive/311513

= Users with Roaming Profiles Cannot Use EFS On Domain Controllers =

Article ID: 311513

Article Last Modified on 1/31/2007

-

APPLIES TO


 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2

-



This article was previously published under Q311513



SYMPTOMS
If the Encrypting File System (EFS) feature is configured for use in a Windows 2000-based domain environment and the &quot;Delete cached copies of roaming profiles&quot; policy is enabled, users with roaming profiles can encrypt files on Windows 2000-based member servers but cannot encrypt files on shares that are located on domain controllers.

For example, if you use the cipher command on a file that is located on a domain controller share (by using the cipher /e /a  command), the following error message may be displayed:

An error occurred applying attributes to the file:

The parameter is incorrect

If user environment logging is enabled on the domain controller (which creates a Userenv.log file), the log may contain entries that are similar to the following sample entries. The first entry is an indicator that the problem has occurred:

USERENV(110.150) 14:51:58:810 RestoreUserProfile: Profile not loaded because Cache has to be deleted, during liteload

USERENV(110.150) 14:51:58:810 RestoreUserProfile: About to Leave. Final Information follows:

USERENV(110.150) 14:51:58:810 Profile was NOT successfully loaded.

Users without roaming profiles are not affected by this issue.



CAUSE
This problem occurs because the flag combination that EFS uses when the user profile is loaded causes EFS not to work when the system policy is in effect.



RESOLUTION
To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.



MORE INFORMATION
For additional information about applicable group policies, click the article number below to view the article in the Microsoft Knowledge Base:

274152 Using Group Policy to Delete Cached Copies of Roaming Profiles

For additional information about user environment event logging, click the article number below to view the article in the Microsoft Knowledge Base:

221833 How to Enable User Environment Debug Logging in Retail Builds of Windows

For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:

265173 The Datacenter Program and Windows 2000 Datacenter Server Product

For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:

296861 Use QChain.exe to Install Multiple Hotfixes with Only One Reboot

For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:

249149 Installing Microsoft Windows 2000 and Windows 2000 Hotfixes

Additional query words:

Keywords: kbbug kbfix kbwin2000presp3fix kbwin2000sp3fix kbsecurity KB311513

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.