Citrix XenApp / Presentation Server

Re: Roaming Profile NTUser.dat to large

anthonyd — Thu, 05 Apr 2012 14:34:03 GMT

Old post I know but I've spent the better part of a week trying to find a definitive answer to the specific issues at my site and this site has definately helped! The following is my take on an amalgamation of a number of blogs and articles and may help someone else with the same issue. I haven't tested this yet (so make your own mind up whether this will work for you). Feel free to comment/correct me as I am NOT a citrix boffin...

Problem:

Citrix roaming profile Ntuser.dat files are 40-100MB in size. Editing ntuser.dat in Notepad++ shows 250,000 lines of HP printer entries (out of perhaps 255,000 lines). This makes logons very slow as registry entries are merged and prevents/delays Group Policy applying. (this may also cause WMI overload as suggested by others on this site).

Process:

Every time a user logs on, their printer mappings create a unique key under the following registry key:

HKEY_USERS\.DEFAULT\Software\Hewlett-Packard

The key grows until it has unique entries (1000+ in my case) for each printer instance in each user’s profile who has ever logged on. The Default User Registry key is merged with completely new profiles at logon (and HKEY_CURRENT_USER), so deleting/recreating the user’s roaming profile has very limited effect. Deleting the local Default User Profile works in the very short term but each user’s logon builds up multiple registry entries again.

When the user logs off all the entries are merged with their ntuser.dat file, which spread to the server at the user's next logon, replicaing the problem across the farm.

Solution:

This is a known issue with HP Universal Print Drivers

HKCU\Software\Hewlett-Packard registry hive increases in size in Citrix

Print driver versions 61.071.xxx.xx fail to clean up registry data written to the ―HKEY_CURRENT_USER\Software\Hewlett-Packard‖ registry hive. Keys under this hive will grow over time. A new registry key is created each time a user logs onto a Citrix server for each printer auto-created. An example of such a key is ―HKEY_CURRENT_USER\Software\Hewlett-Packard\165b5934-15c4-4a84-c392-d044915211da‖ where ―165b5934-15c4-4a84-c392-d044915211da‖ is a GUID (globally unique identifier). HPBIDIInfo or HPCUSTOMForms are keys in the GUID hive. Newer versions of the print driver, such as version 61.081.xxx.xx or the latest HP Universal Print Driver, have a fix for this issue.

HP Printers Supported in XenApp Environments

Suggested Actions:

As I say, I am no Citrix buff and I have not yet tested this fix (we need to upgrade our print server from 2003 x86 to 2008 x64 as part of the process) but (upgrade aside) this is what I intend to do.

1. Upgrade all the HP print drivers to 61.081.xxx.xx or above.

2. After all drivers are upgraded, check whether the local DEFAULT USER registry on the individual citrix servers has been cleaned up or if this needs doing manually.

3. Re-create roaming profiles (in conjunction with Citrix Profile Management Tool - just purchased - to prevent ntuser.dat bloat from other applications)

Re: Roaming Profile NTUser.dat to large

EmilBeck — Tue, 20 Jan 2009 10:11:32 GMT

I think you are going to be in for the long haul to solve the issue. I would start to look at the basics:

Does it happen on all Servers (Server performance issue)?

Does it happen for all users (size of profile/registry)?

Is the user connecting mapped drives/printers/resources in remote locations?

Is DNS working 100%? (dual NIC's)

Disable GPO's for the user/server

Are you using Folder Redirection for the desktop etc?

Also enable login logging - http://technet.microsoft.com/en-us/library/cc775423.aspx

And pour through the log files in excel to see the times between steps (5 or more second pauses).

If you have issues with the size of the NTUser.dat load it up in Regedit and see which keys you can remove. This can then be automated via a script to delete the HKCU keys you do not need on logon.

Good luck --Emil

Re: Roaming Profile NTUser.dat to large

Sam Rodriguez — Fri, 16 Jan 2009 19:50:08 GMT

To Guest who started thread, Roaming Profiles will keep you busy - believe me. The Shadow Key, can create some headaches as well. Might want to research that and perform a bit of surgery there. I would recommend begin plannng and testing a flex (hybrid) profile solution.

In the meantime, take a look at this tool (ProfileNurse). May help you with the current profiles you have in place http://blogs.sepago.de/helge/2008/12/17/enter-profilenurse-your-skilled-profile-care-professional/

I had taken a good hard look at disk quotas once, but found that (like index service) it puts quite a load on the file server, you end up raising the quotas for the biggest violators anyway, and it monitors the whole profile folder rather than the user registry hive. So, not really an effective tool considering the resources it needs to run. Found that I could run the Diskuse.exe tool from the Server 2003 Resource Kit once every other week or so http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en just cat the results to a text file and import into Excel so you can sort by folder size, username, whatever. -Then you'll probably find that 3% of your users hog-up 90% of your storage. The next thing you'll discover is that they're probably all VIP's so forget about doing anything about it. 8 ))

Re: RE: Roaming Profile NTUser.dat to large

antick — Fri, 16 Jan 2009 19:13:00 GMT

Thank you very much for the reply; So maybe i should be asking for HELP in diagnosing what is causing our regsitry to suddenly increase in size and make the server unresponsive. We have a 4.5 HRP2, win3k sp2 farm where servers suddenly become unresopnsive and FREEZE. Through troubleshooting we have identified the same exact issues as this post (where the registry balloons to massive size). We have written a script that uses the DUREG.exe utility to dump and analyze the registry size every 10mnts. Our registry can go from 50MB up to 800MB in an instance. We have been working with MSFT to no avail. the HKU key is the only one that grows exponentially.

Anyone have any ideas on what we can do to troubleshoot next?

Re: RE: Roaming Profile NTUser.dat to large

Shawn Bass — Mon, 08 Dec 2008 23:54:05 GMT

Registry keys located in the Terminal Server\Install\Software key are registry entries that were captured during installation of something during Install Mode. Keep in mind that Install Mode isn't only triggered by running "Change user /install" On TS pretty much any setup installer engine including setup.exe, Windows Installer, etc. will set the server in Install Mode.

Shawn

Re: RE: Roaming Profile NTUser.dat to large

antick — Mon, 08 Dec 2008 20:12:28 GMT

How did you determine that the "Hewlett-Packard" sofware was not loaded in "INSTALL MODE"? We are having the EXACT SAME ISSUE and see a mess of keys under the HKLM\Soft\MSFT\WINNT\CurrVer\Term Ser\Install\Software\xxxx --> does that mean all those apps were loaded in "EXECUTE MODE"?

RE: Roaming Profile NTUser.dat to large

kirk lashbrook — Mon, 21 Jan 2008 13:30:41 GMT

I had this same issue on three Win2000 servers.

It looks like the server was in "install" mode for a duration of time while a bunch of printer objects were being created and written to the shadow key (HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\hewlett-packard)

Whenever a user logged-in, all of those keys were copied to their HKCU; leading to huge registry bloat. About 270+ megs in my case. NTUser.DAT in each profile was about 36 megs.

I fixed by deleting the following keys:

- HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\hewlett-packard

- HKUsers\.Default\Software\Hewlett-Packard

Then we deleted all the user profiles so they'd be recreated at next user login without all the bloat.

As always, your mileage may vary.

RE: Roaming Profile NTUser.dat to large

Kevin Stewart — Fri, 27 Jul 2007 01:42:05 GMT

While Flex and Mandatory profiles are really the way to go, if you need to continue on with roaming profiles, consider creating a login script that deletes all of these unnecessary entries from the user's HKCU hive. I'm guessing whatever is creating the entries will continue to do so until you figure that one out, but at least the entries won't have a chance to accumulate between logins.

Kevin

RE: Roaming Profile NTUser.dat to large

Greg A — Thu, 26 Jul 2007 11:10:12 GMT

More likely the size of the user profile.

RE: Roaming Profile NTUser.dat to large

Dan Murray — Wed, 25 Jul 2007 15:31:43 GMT

This is just one of the many reasons I no longer use roaming TS profiles. Instead, I use a mandatory profile, which keeps the NTUSER.DAT file down to around 512KB, and FlexProfiles for the remaining settings that I care about. Otherwise, the user's NTUSER.DAT file picks up EVERY little settings that comes along, whether it actually does anything useful or not.

Roaming Profile NTUser.dat to large

Guest — Wed, 25 Jul 2007 12:33:09 GMT

Hi,

I have users connecting to a PS4 Farm using TS Roaming Profiles. I've started having complaints about slow logon times when launching published apps, specifically whilst loading personal settings. The problem appears to be related to the size of the NTUser.dat in the users Roaming Profile. A lot of these files are now between 5mb and 8mb in size. The following Registery key seems to be the cause of these problems.

HKEY_USERS\test\Software\Hewlett-Packard

It contains thousand of keys simular to this one

108f7038-c6fe-4972-2492-bbf0b3257bef

All of these keys contain one binary value: ShowJobStorageDlg with a value of 01

I suspect its printer related

Has anybody else had expereince of any simular problems

Thanks