Users with Roaming Profiles Cannot Use EFS On Domain Controllers (311513)


The information in this article applies to:

  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Professional SP1
  • Microsoft Windows 2000 Professional SP2
This article was previously published under Q311513

SYMPTOMS

If the Encrypting File System (EFS) feature is configured for use in a Windows 2000-based domain environment and the "Delete cached copies of roaming profiles" policy is enabled, users with roaming profiles can encrypt files on Windows 2000-based member servers but cannot encrypt files on shares that are located on domain controllers.

For example, if you use the cipher command on a file that is located on a domain controller share (by using the cipher /e /a filename command), the following error message may be displayed:
An error occurred applying attributes to the file:
Filename
The parameter is incorrect
If user environment logging is enabled on the domain controller (which creates a Userenv.log file), the log may contain entries that are similar to the following sample entries. The first entry is an indicator that the problem has occurred:
USERENV(110.150) 14:51:58:810 RestoreUserProfile: Profile not loaded because Cache has to be deleted, during liteload
USERENV(110.150) 14:51:58:810 RestoreUserProfile: About to Leave. Final Information follows:
USERENV(110.150) 14:51:58:810 Profile was NOT successfully loaded.
Users without roaming profiles are not affected by this issue.

CAUSE

This problem occurs because the flag combination that EFS uses when the user profile is loaded causes EFS not to work when the system policy is in effect.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.

MORE INFORMATION

For additional information about applicable group policies, click the article number below to view the article in the Microsoft Knowledge Base:

274152 Using Group Policy to Delete Cached Copies of Roaming Profiles

For additional information about user environment event logging, click the article number below to view the article in the Microsoft Knowledge Base:

221833 How to Enable User Environment Debug Logging in Retail Builds of Windows

For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:

265173 The Datacenter Program and Windows 2000 Datacenter Server Product

For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:

296861 Use QChain.exe to Install Multiple Hotfixes with Only One Reboot

For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:

249149 Installing Microsoft Windows 2000 and Windows 2000 Hotfixes

Modification Type:MinorLast Reviewed:7/11/2005
Keywords:kbbug kbfix kbSecurity kbWin2000PreSP3Fix kbWin2000sp3fix KB311513
©2004 Microsoft Corporation. All rights reserved.