Microsoft-Windows-Folder Redirection Error 502. CSC database locked by another user

Question

Dear all,
We are finalizing our Windows 7 migration where we migrated 500+ clients. In our enterprise concept we implemented RUP (Roaming User Profiles) and Redirected Folders for all
users. The Redirected Folders have been by enabled by a single GPO which redirects all folders from
AppData to
Searches \\servername.domain.name\documents$\%username%.
Problem:
The RUP and Redirected folders solution works fine until a new user wants to logon. This new user has been migrated to RUP and Redirected on another system and
he just wants to work on another workplace or gets a temporary pc. What happens is that redirected folders do not work. The user gets a message that the folder is not reachable and desktop is empty.
Troubleshooting:
Soon I found out that something was being locked. If we used a user account which had working Redirect Folders than this
worked for that user. An event of 10 was logged in OfflineFiles area of EventViewer to reconnect the path which was configured in the GPO.
This is example screenshot. It says "Error on Open Folder. \\server.domain.name\documents$\%username%\Desktop refers to a location that is unavailable. It could be on a hard disk
on this computer, or a on a network. Check to make sure that the disk is properly inserted, or that you are connected to the Internet or your network, and then try again. If it still cannot be located, the information might have been moved to a different location."
These symptoms happen randomly and not on all workstations. The pain here is when it happens on a portable computer. For desktop we disabled the "Disable Offline Files' in "Manage
Offline Files" control panel and then reboot. After the reboot the folders are directed
and it works without these errors... On portable computer we can't use this work around as they need to work offline.
If I connect to the share without the FQDN like \\servername\documents$\%username%\Desktop than this works fine and user can access all folders. When I try the FQDN path which is
configured in the GPO to redirect user to like \\servername.domain.name\documents$\%username%\Desktop than it fails with this message. I personally think because the C:\Windows\CSC database is locked by the previous user who has been logged on this system.
An example of the event generated in the Applications Event viewer part (I removed some username and server path):
Log Name:      Application
Source:        Microsoft-Windows-Folder Redirection
Date:          1-2-2011 17:40:11
Event ID:      502
Task Category: None
Level:         Error
Keywords:     
User:          domain\ivan
Computer:      computer.domain.name
Description:
Failed to apply policy and redirect folder "Videos" to "\\servername.domain.name\documents$\ivan\Documents\My Videos".
 Redirection options=0x1001.
 The following error occurred: "Can not create folder "\\\servername.domain.name\documents$\ivan\Documents\My Videos"".
 Error details: "Access is denied.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Folder Redirection" Guid="{7D7B0C39-93F6-4100-BD96-4DDA859652C5}" />
    <EventID>502</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-02-01T16:40:11.486983400Z" />
    <EventRecordID>2754</EventRecordID>
    <Correlation ActivityID="{3211E6FB-2801-456D-BE6E-66AAE150A4DC}" />
    <Execution ProcessID="968" ThreadID="5856" />
    <Channel>Application</Channel>
    <Computer>computer.domain.name</Computer>
    <Security UserID="S-1-5-21-3705223304-2632712944-1292073641-26755" />
  </System>
  <EventData Name="EVENT_FDEPLOY_FailedToApplyPolicy">
    <Data Name="FromFolder">Videos</Data>
    <Data Name="ToFolder">\\servername.domain.name\documents$\ivan\Documents\My Videos</Data>
    <Data Name="Options">0x1001</Data>
    <Data Name="Error">Can not create folder "\\servername.domain.name\documents$\ivan\Documents\My Videos"</Data>
    <Data Name="ErrorDetails">Access is denied.
</Data>
  </EventData>
</Event> 
Something like this I see in the Application Eventviewer:
Environment:
Windows 7 Enterprise client with patches until 1-Nov-2010
Windows Server 2008 R2 for the Documents$ share
Windows Server 2003 R2 as the domain controller
I have tried all different option even to rebuild the CSC database but this also was not helping. I hope we are not dealing with a bug.
Any help is much appreciated.
Best regards, Ivan Versluis http://www.networknet.nl

Answer 1

Ivan and SteveDIG - Thanks for taking the time to post detailed information about what you have found.  I have found the same things over the past few months and have been working with Microsoft to resolve this.  Like Ivan, I have been told by
MS that this is a design problem in Windows 7, but they did admit it is a bug and did not charge me for the case.  That was the good news.  The bad news was that the problem is so 'deep' in Windows 7 that it will not be fixed until Windows 8 and
the CSC engineering team in Redmond has rejected several requests to fix this issue in Windows 7 from several customers.  I personally feel we should have hauled our TAM in over this, but that wasn't my call so we haven't attempted to get an attitude
change from MS.
<RANT> I find this completely outrageous.  Windows is supposed to be a multi-user operating system suitable for deployment to mobile workforces spread around the world and often using slow VPN links.  Offline folders, folder redirection,
slow link detection, etc. are all great on paper and as I did the design work for the W7 solution I've just built I sold these advantages heavily.  I now have serious egg on my face and am not happy.  Like others here I missed this in testing as
multiple users are a fringe for us, but still important, I unfortunately didn't think to specifically test for multiple users, though I tested the features thoroughly and was happy with the results when used on single user machines.</RANT>
As identified above, this issue manifests when more than one user uses a machine and their Offline folders (all redirected folders are configured this way by default) are in an offline state when the first user logs off.  The second user cannot access
this 'offline' share so folder redirection fails.  We get burnt as we have latency=0 configured for slow link detection with Offline folders so users always work offline.  This is partly because of WAN optimisers in the network that lie to Windows
so the online/offline transition doesn't work on slow links (not MS's fault), and partly because it made sense for other reasons.
The workaround Microsoft and I came up with for our environment was to use individual file shares for each user.  We had been using a common file share with each user folder under that file share.  Changing to an individual share for each users
means the share is not locked by the previous user.
Examples
This would cause a problem if John then Emma logged on to the same machine. Folder redirection would fail for Emma:
\\FileServer1\Users$\john
\\FileServer1\Users$\emma
So would this if DFS was used
\\my.domain\users\john            (points to \\FileServer1\Users$\John)
\\my.domain\users\emma          (points to \\FileServer1\Users$\Emma)
This would fix the problem:
\\FileServer1\John$
\\FileServer1\Emma$
Unfortunately we then figured we could move these shares behind DFS like so:
\\my.domain\homes\john             (points to \\FileServer1\John$)
\\my.domain\homes\emma          (points to \\FileServer1\emma$)
This was wrong.  The problem returned.  I assume the share that is being locked is now the DFS root and not the user share.
The operations team here is very reluctant to go with direct access to the file servers and not use DFS as that will create issues for them in the future when they need to make file server changes.  I sympathise with them but can't see an alternative
at the moment as we are deploying W7 and can't stop.  If I'd picked this up earlier a third party product might have been the solution (MS actually suggested this when I opened my case).
I hope the information about individual shares above is helpful to someone.  Otherwise I don't really have more to add but I needed the rant :-)
<RANT>BTW.  Has anyone tested changing a user’s home directory path once it is cached?  Try it. Test a scenario where you move the user from one file server to another.  You will not enjoy the results.  I'll say no more
than this as it is off topic, but it shows the lack of investment in the CSC feature in Windows.  Very disappointing</RANT>