Users with Roaming Profiles Cannot Use EFS On Domain Controllers

View products that this article applies to.

This article was previously published under Q311513

Expand all | Collapse all

SYMPTOMS

If the Encrypting File System (EFS) feature is configured for use in a Windows 2000-based domain environment and the "Delete cached copies of roaming profiles" policy is enabled, users with roaming profiles can encrypt files on Windows 2000-based member servers but cannot encrypt files on shares that are located on domain controllers.

For example, if you use the cipher command on a file that is located on a domain controller share (by using the cipher /e /a filename command), the following error message may be displayed:

An error occurred applying attributes to the file:
Filename
The parameter is incorrect

If user environment logging is enabled on the domain controller (which creates a Userenv.log file), the log may contain entries that are similar to the following sample entries. The first entry is an indicator that the problem has occurred:

USERENV(110.150) 14:51:58:810 RestoreUserProfile: Profile not loaded because Cache has to be deleted, during liteload
USERENV(110.150) 14:51:58:810 RestoreUserProfile: About to Leave. Final Information follows:
USERENV(110.150) 14:51:58:810 Profile was NOT successfully loaded.

Users without roaming profiles are not affected by this issue.

Back to the top

CAUSE

This problem occurs because the flag combination that EFS uses when the user profile is loaded causes EFS not to work when the system policy is in effect.

Back to the top

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 (http://support.microsoft.com/kb/260910/EN-US/ ) How to Obtain the Latest Windows 2000 Service Pack

Back to the top

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.

Back to the top

MORE INFORMATION

For additional information about applicable group policies, click the article number below to view the article in the Microsoft Knowledge Base:

274152 (http://support.microsoft.com/kb/274152/EN-US/ ) Using Group Policy to Delete Cached Copies of Roaming Profiles

For additional information about user environment event logging, click the article number below to view the article in the Microsoft Knowledge Base:

221833 (http://support.microsoft.com/kb/221833/EN-US/ ) How to Enable User Environment Debug Logging in Retail Builds of Windows

For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:

265173 (http://support.microsoft.com/kb/265173/EN-US/ ) The Datacenter Program and Windows 2000 Datacenter Server Product

For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:

296861 (http://support.microsoft.com/kb/296861/EN-US/ ) Use QChain.exe to Install Multiple Hotfixes with Only One Reboot

For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:

249149 (http://support.microsoft.com/kb/249149/EN-US/ ) Installing Microsoft Windows 2000 and Windows 2000 Hotfixes

Back to the top