Home/ Questions/Q 148201
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T08:54:59+00:00

The title says it. I’m looking for a way to determine exactly which file/registry

  • 0

The title says it. I’m looking for a way to determine exactly which file/registry key this executable is attempting to access. I have attempted to use Windows auditing capabilities and Process Monitor to determine where the failure is happening but, this failure does not produce audit failure events or show as access denial in Process Monitor.

Of course, If someone has experienced this and can provide a solution to resolve the error directly that would be almost as nice.

Background:

I am using moveuser.exe which is part of the Windows Server 2003 Resource Kit Tools to convert the security of local user profiles on a number Windows XP workstations.

Symptom:

Occasionally, moveuser.exe will fail to convert the security of a profile with the error ‘Error: 5 access denied’. I have not been able to determine any commonality among the failing accounts or the computers they reside upon. A given computer may have host 6 profiles, 5 of which convert without issue and 1 which produces the error.

There are a few factors that I’m as sure as I can be about:

-The account I’m using to run moveuser.exe with has full Administrator rights to the local machine and the domain to which the profile security is being converted.

-The failure is not related to file permissions within the profile directory (the entire directory can be moved, renamed, deleted, or successfully converted via a workaround).

I’ve developed a reliable workaround for these cases but, it is fairly involved and I would much rather understand the root cause of this error and correct it pre-emptively.

My workaround (glad to share it, left out for brevity) seems to indicate that the failure is related to HKEY_LOCAL_MACHINE \ SOFTWARE\ Microsoft\ Windows NT \ CurrentVersion \ ProfileList registry keys but, I cannot determine exactly how/why.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Two days after posting this I got to the bottom of the problem. It turned out, just as Rob Haupt suggested to be related to a stuck user hive. The program I was running, moveuser, was reading the Refcount key found under HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ ProfileList\ <SID>\ and ending immediately.

    Setting Refcount to 0 solved the problem immediately

    Pushing out UPHClean to all the target machines pre-emptively has all but elimated the problem and we were able to successfully convert profiles on several hundred machines over the last week.

    An important note about UPHClean:

    I’d tried installing it previously but, it didn’t appear to help. I was too impatient, the UPHClean ReadMe revealed that the service just takes time to do its job.

    • 0