Error Message "Unable to Load Your Profile" When You Install Systems Management Server Client Software

When you attempt to install Systems Management Server (SMS) version 2.0 client software, you may receive the following error message: This error message is displayed on the screen after the current user has logged on to the computer.

This behavior can occur if the "default user" profile has either been replaced with a preconfigured profile or has been corrupted. This behavior can cause the SMS client software to be unable to make the security changes to the protected storage key when it attempts to create a new user profile for one of the SMS client software accounts, the SMSCliToknAcct$ account.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To work around this behavior, use one of the following three methods:

• Ignore the errors on the client. The profile is able to load despite the errors. The errors occur only during SMS client installation. Most computers report this behavior only one time. After the installation has completed, the profile loads properly. The SMS client also runs properly. Subsequent logon attempts do not report the profile load error.
• For each computer that exhibits this behavior:
  1. Connect to the admin share, or log on locally to the affected computer.
  2. Load and edit the permissions in the "default user" Ntuser.dat file. To perform this step, you must load the Ntuser.dat file as a registry hive:
     1. Start Regedt32.exe.
     2. Click the HKEY_LOCAL_MACHINE hive.
     3. On the Registry menu, click Load Hive.
     4. Specify the Ntuser.dat file at the %Systemroot%\Profiles\Default User folder on the affected computer.
     5. You are asked to specify a "key name." This key name is used to identify the hive that you are loading and is a subkey of HKEY_LOCAL_MACHINE. Enter any name that is not already in use.
     6. Locate HKEY_LOCAL_MACHINE/Key Name/Software/Microsoft/Protected Storage System Provider/Sid. The security identifier (SID) is for the user who created the profile that had been copied to the default user (for example, S-1-5-21-1234567890-1234567890-123456789-1001). The SID can be unavailable because you do not have permission to access this key. Click this key. On the Security menu, click Permissions, and then add the group "Everyone" with full control access.
     7. Click the key name. On the Registry menu, click Unload.
• Replace the Ntuser.dat file or the entire user profile for "default user" with an unmodified copy from another computer. This step, however, is not recommended because a new user can lose the benefit of obtaining a preconfigured default profile.

The default user profile is located in the %Systemroot%\Profiles\Default User folder. When a new user logs on, the computer copies the "default user" profile to the new users profile folder under the %Systemroot%\Profiles\Username folder. You may be unable to make the security changes to the protected storage key when the preconfigured (default user) profile is used to create a new profile for the SMSCLiToknAcct$ account.

The registry key is located at: NOTE: The preceding registry key is one path; the key may have been wrapped for readability.

To confirm this behavior, enable userenv logging as discussed in the following article: The output from the logging can be similar to the following output: The SID that is listed, S-1-5-21-1283131943-1217870647-1252928729-500, belongs to the local administrator account because the administrator had been the user that created the profile, which had been copied to the default user profile during the operating system installation. An error occurred after the operating system copied the profile from the default user to the new user account (SMSClitokn$, in this scenario) and attempted to change the permissions on the protected storage key.