You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: This article provides steps to resolve issues where the load screen is stuck when applying a policy during boot in an Azure VM.
3
+
description: This article provides steps to resolve issues in which the load screen is stuck when applying a policy during boot in an Azure VM.
4
4
services: virtual-machines-windows
5
5
documentationcenter: ''
6
6
author: TobyTu
@@ -18,96 +18,80 @@ ms.author: v-mibufo
18
18
19
19
# VM is unresponsive while applying ‘Group Policy Local Users & Groups’ policy
20
20
21
-
This article provides steps to resolve issues where the load screen is stuck when applying a policy during boot in an Azure VM.
21
+
This article provides steps to resolve issues where the load screen is stuck applying a policy during boot in an Azure VM.
22
22
23
23
## Symptoms
24
24
25
-
When you use [Boot diagnostics](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/boot-diagnostics) to view the screenshot of the VM, you will see that the screen is stuck loading with the message: ‘Applying Group Policy Local Users and Groups policy’.
25
+
When you use [Boot diagnostics](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/boot-diagnostics) to view the screenshot of the VM, you will see that the screen is stuck loading with the message: ‘*Applying Group Policy Local Users and Groups policy*’.
26
26
27
27
28
28
29
29
30
30
31
31
## Cause
32
32
33
-
This issue is caused by a code defect in the Windows Profile Service Dynamic Link Library (*profsvc.dll*).
33
+
This issue is caused by conflicting locks when the policy is attempting to cleanup old user profiles.
34
34
35
35
> [!NOTE]
36
36
> This applies only on Windows Server 2012 and Windows Server 2012 R2.
37
37
38
38
The policy being applied that won’t finish its processes is:
39
39
40
-
`Computer Configuration\Policies\Administrative Templates\System\User Profiles\Delete user profiles older than a specified number of days on system restart`
40
+
`Computer Configuration\Policies\Administrative Templates\System/User Profiles\Delete user profiles older than a specified number of days on system restart`
41
41
42
-
It will only get stuck if all six of the following conditions are true:
43
-
44
-
1. The **Delete user profiles older than a specified number of days on system restart** policy is enabled.
45
-
2. You have profiles that have met the age requirements to require cleanup.
46
-
3. You have any components that have registered for delete notification for profiles.
47
-
4. The components make any calls (direct or indirect) that need to acquire data from the Service Control Manager (SCM) components of Windows, for example, Start, Stop, or Query information about a service.
48
-
5. You have a service that configured to start as automatic.
49
-
6. This same service is set to run under the context of a domain account (as opposed to using a built-in account, for example, local system).
50
-
51
-
### What's the code defect
52
-
53
-
The defect is because of the Service Control Manager (SCM) and the Profile services attempting to apply locks on one another simultaneously. Locks exist to prevent multiple services from making changes on the same data at the same time, which would cause corruption. Ordinarily multiple lock requests wouldn’t cause an issue, however since this is happening during boot, neither service can complete their processes as they are stuck waiting upon one another.
54
-
55
-
*OS Bug 5880648 - Service Control Manager deadlocks with the "Delete user profiles on restart" policy.*
56
-
57
-
There are two actions that overlap so that:
58
-
59
-
- Action 1 acquires the profile lock but hasn't yet acquired the SCM lock.
60
-
61
-
**AND**
62
-
63
-
- Action 2 acquires the SCM lock but hasn't yet acquired the profile lock.
42
+
## Resolution
64
43
65
-
Once this has occurred, the next attempt to acquire the second required lock hangs the action.
1.[Create and access a repair VM](#step-1-create-and-access-a-repair-vm)
47
+
2.[Disable the policy](#step-2-disable-the-policy)
48
+
3.[Enable Serial Console and memory dump collection](#step-3-enable-serial-console-and-memory-dump-collection)
49
+
4.[Rebuild the VM](#step-4-rebuild-the-vm)
68
50
69
-
1. First, the policy that is set to delete old profiles grabs an internal profile service lock.
51
+
> [!NOTE]
52
+
> When encountering this boot error, the Guest OS is not operational. You will be troubleshooting in offline mode to resolve this issue.
70
53
71
-
This lock is there to prevent two threads from interacting with the profiles while the delete operation is progress.
54
+
### Step 1: Create and access a repair VM
72
55
73
-
2. It then finds profiles that are old enough to be deleted.
74
-
3. As a step of the profile deletion, a component that has registered for notifications of the deletions of a profile tries to start a service.
75
-
4. Before the Service Control Manager (SCM) starting the service, it first needs to acquire an internal SCM lock, which is held by threads in **Action 2**.
56
+
1. Use [steps 1-3 of the VM repair commands](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/repair-windows-vm-using-azure-virtual-machine-repair-commands#repair-process-example) to prepare a repair VM.
57
+
2. Use Remote Desktop Connection connect to the repair VM.
76
58
77
-
**Action 2: Profile load or creation for user-specific data (has SCM Lock, needs Profile Lock)**
59
+
### Step 2: Disable the policy
78
60
79
-
1. At boot, SCM needs to first order all autostart services by their group, as well as any services that those services are dependent upon.
80
-
2. SCM acquires an internal SCM lock that is used to control access to starting, stopping, or configuring services as it orders the services.
81
-
3. Once the services are in order, the SCM loops through each service and starts it.
82
-
4. If the service is running under the context of a domain account, a profile needs to be loaded or created for the domain account in order to store user-specific data.
83
-
5. This request is sent to the Profile Service.
84
-
6. The profile service needs access to the internal lock acquired in **Action 1**.
61
+
1. On the repair VM, open the Registry Editor.
62
+
2. Locate the key **HKEY_LOCAL_MACHINE** and then select **File** > **Load Hive...** from the menu.
85
63
86
-
## Resolution
64
+
87
65
88
-
### Process overview
66
+
- Load Hive allows you to load a registry key from an offline system, which in this case is your broken disk attached to your repair VM.
67
+
-**HKEY_LOCAL_MACHINE** is where all the system-wide settings are stored and may be abbreviated as “HKLM”.
68
+
3. In the attached disk, navigate to the `\windows\system32\config\SOFTWARE` file and open it.
89
69
90
-
1.[Create and access a Repair VM](#step-1-create-and-access-a-repair-vm)
91
-
2.[Enable Serial Console and memory dump collection](#step-2-enable-serial-console-and-memory-dump-collection)
92
-
3.[Rebuild the VM](#step-3-rebuild-the-vm)
93
-
4.[Collect the memory dump file](#step-4-collect-the-memory-dump-file)
70
+
a) When you open it, you will be prompted for a name. Enter BROKENSOFTWARE as the name.<br/>
71
+
b) To verify that BROKENSOFTWARE was loaded, you can expand **HKEY_LOCAL_MACHINE** and look for the added BROKENSOFTWARE key.
72
+
4. Navigate to the BROKENSOFTWARE and validate if the CleanupProfile key exists in the hive that was loaded.
94
73
95
-
> [!NOTE]
96
-
> When encountering this boot error, the Guest OS is not operational. You will be troubleshooting in Offline mode to resolve this issue.
74
+
a) If the key does not exist, then the CleanupProfile policy is not set up. In this case, you should [submit a support ticket](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade), including the memory.dmp file located in the Windows directory of the attached OS disk.<br/>
75
+
b) If the key does exist, then it means that the CleanupProfile policy is set up. Its value represents the retention policy in days. Continue to delete the key.
76
+
5. Delete the CleanupProfiles key using the command below:
6. Unload the BROKENSOFTWARE hive using the command below:
99
82
100
-
1. Use [steps 1-3 of the VM Repair Commands](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/repair-windows-vm-using-azure-virtual-machine-repair-commands#repair-process-example) to prepare a Repair VM.
101
-
2. Use Remote Desktop Connection connect to the Repair VM.
83
+
```
84
+
reg unload HKLM\BROKENSOFTWARE
85
+
```
102
86
103
-
### Step 2: Enable Serial Console and memory dump collection
87
+
### Step 3: Enable Serial Console and memory dump collection
104
88
105
89
To enable memory dump collection and Serial Console, run the script below:
106
90
107
91
1. Open an elevated command prompt session (Run as administrator).
108
92
2. Run the following commands:
109
93
110
-
Enable Serial Console:
94
+
**Enable Serial Console**:
111
95
112
96
```
113
97
bcdedit /store <VOLUME LETTER WHERE THE BCD FOLDER IS>:\boot\bcd /ems {<BOOT LOADER IDENTIFIER>} ON
@@ -116,55 +100,46 @@ To enable memory dump collection and Serial Console, run the script below:
116
100
```
117
101
bcdedit /store <VOLUME LETTER WHERE THE BCD FOLDER IS>:\boot\bcd /emssettings EMSPORT:1 EMSBAUDRATE:115200
118
102
```
119
-
3. Verify that the free space on the OS disk is as much as the memory size (RAM) on the VM.
103
+
3. Verify if the free space on the OS disk is as much as the memory size (RAM) on the VM.
120
104
121
105
If there's not enough space on the OS disk, you should change the location where the memory dump file will be created and refer that to any data disk attached to the VM that has enough free space. To change the location, replace “%SystemRoot%” with the drive letter (for example “F:”) of the data disk in the below commands.
Use [step 5 of the VM Repair Commands](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/repair-windows-vm-using-azure-virtual-machine-repair-commands#repair-process-example) to reassemble the VM.
156
140
157
-
### Step 4: Collect the memory dump file
158
-
159
-
To resolve this problem, you would need first to gather the memory dump file for the crash and contact support with the memory dump file. To collect the dump file, follow these steps:
160
-
161
-
1. Attach the OS disk to a new Repair VM:
162
-
163
-
- Use [steps 1-3 of the VM Repair Commands](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/repair-windows-vm-using-azure-virtual-machine-repair-commands#repair-process-example) to prepare a new Repair VM.
164
-
- Use Remote Desktop Connection connect to the Repair VM.
141
+
If this fixed the issue, then you have disabled this policy locally. For a permanent solution, do not to use the CleanupProfiles policy on VMs, and use another method to perform the profile cleanup.
165
142
166
-
2. Locate the dump file and submit a support ticket:
143
+
Policy to stop using:
167
144
168
-
- On the repair VM, go to windows folder in the attached OS disk. If the driver letter that is assigned to the attached OS disk is F, you need to go to `F:\Windows`.
169
-
- Locate the memory.dmp file, and then [submit a support ticket](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade) with the memory dump file.
170
-
- If you are having trouble locating the memory.dmp file, you may wish to use [non-maskable interrupt (NMI) calls in serial console](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/serial-console-windows#use-the-serial-console-for-nmi-calls) instead. You can follow the guide to [generate a crash dump file using NMI calls](https://docs.microsoft.com/windows/client-management/generate-kernel-or-complete-crash-dump) here.
145
+
Machine\Admin Templates\System\User Profiles\Delete user profiles older than a specified number of days on system restart
0 commit comments