How to restore user profile

While I was logging on from a remote console through RDP I've got a message telling me that the user profile is damaged. I was able to log on and I lost all the settings: desktop, menu and all the settings of the various applications, as if my user had just been created; that means, the user registry was corrupted and it has been replaced with the default user registry.

Event Viewer reported these error messages:

DETAIL - The process cannot access the file because it is being used by another process. for C:\Documents and Settings\Z24\ntuser.dat

Windows has backed up this user's profile. Windows will automatically try to use the backed up profile the next time this user logs on.

Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.

I don't know what would have happened logging off and on again (the original profile would have been restored automatically?), by the way I recovered it this way:

• I created a new user, just to be sure to be able to logon if something went bad
• I rebooted into linux
• I copied the user registry file C:\System Volume Information\_restore{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}\RPyy\snapshot\_REGISTRY_USER_NTUSER_S-z-z-zz-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzz-zzzz to C:\Documents and Settings\USERNAME\ntuser.dat:
  the x's in the restore path are hex digits and yy is a number: the exact restore path where to look in should be the one with the most recent date and time before the date and time of the unsuccessful logon, i.e. yesterday's date if the error happened at today's first logon;
  S-z-z-zz... is the user's SID (see how to associate username and SID);
  and USERNAME is the username
• I also copied the file _REGISTRY_USER_USRCLASS_S-z-z-zz-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzz-zzzz from the same path to C:\Documents and Settings\USERNAME\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

At the next logon my windows settings and my applications settings came back!

Posted by: Z24 | Thu, Aug 21 2008 | Category: /windows | Permanent link | home
Tagged as: howto, windows, xp

---

How to associate username and SID

To know which is the username associated with a known SID (Security Identifier), open the registry (regedit.exe) at this location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.

Each SID key has a ProfileImagePath string whose value is the user path which contains the username.
To know which is the SID associated with a known username, select the ProfileList key and search the username.

There is also a SysInternals command-line utility which shows the SID associated with a known username:

C:\>psgetsid Z24

PsGetSid v1.43 - Translates SIDs to names and vice versa
Copyright (C) 1999-2006 Mark Russinovich
Sysinternals - www.sysinternals.com

SID for WAM2\Z24:
S-1-5-21-1993962763-2139871995-725345543-1003

or the username associated with a known SID:

C:\>psgetsid S-1-5-21-1993962763-2139871995-725345543-1003

PsGetSid v1.43 - Translates SIDs to names and vice versa
Copyright (C) 1999-2006 Mark Russinovich
Sysinternals - www.sysinternals.com

Account for WAM2\S-1-5-21-1993962763-2139871995-725345543-1003:
User: WAM2\Z24

Posted by: Z24 | Thu, Aug 21 2008 | Category: /windows | Permanent link | home
Tagged as: command-line, howto, windows, xp

---