UPHClean and other profile ramblings

UPHClean v1.6 Security Vulnerability Fix

Robin Caron — Mon, 13 Sep 2010 13:56:00 GMT

The previous version of UPHClean did not call the system executable using quotes. This could in some scenarios allow a local user to elevate privileges. This issue has now been addressed in the current version. Thanks to Thierry Zoller from Verizon Business for reporting this issue to us.

Updated bits (v1.6g) are being posted on the Microsoft Download Center and should be available shortly.

Status of UPHClean

Robin Caron — Wed, 06 Jan 2010 19:59:00 GMT

Hi!

First let me apologize for the length of time since my last post. Unfortunately this post is to report that UPHClean is now officially dormant. Release bits for UPHClean v2.0 are not forthcoming. There's no plan of record for release. This means that even if it was restarted it would be months or much longer to get a final package ready. At various point I had hope that I could get time together to produce a final package but it is not in the cards for the forseable future. This is not happening.

This means that the current beta build (2.0.49.0) is the latest bits and will stay the only code available for the forseable future. This code works well for most people (> 99%). It does not function on Windows Vista, Windows Server 2008, Windows 7 nor Windows Server 2008 R2. As I have mentioned in other posts there's definintely some possibility of machine running beta bits of UPHClean v2.0 to crash or hang. The best course of action in those cases is to discontinue usage of UPHClean.

Thank you for you great support on making UPHClean a success.

Robin Caron

New UPHClean beta build

Robin Caron — Sat, 01 Nov 2008 00:27:26 GMT

Hi there!

Good news -- I'm releasing an updated beta build today. It fixes machine hangs and crashes that could occur with build 2.0.48.0.

The 32 bit plaform bits are here and for 64 bit platforms here.

If you find any problem with this build please email the details to uphclean@microsoft.com or post them here.

Thank you all for your patience in waiting for updated beta bits.

Robin

Call stack logging: what it is and where does it go?

Robin Caron — Thu, 17 Jul 2008 20:26:00 GMT

To understand what call stack logging is you must understand how software works internally. Software is put together using small pieces of code. These pieces are called functions. Complex work is done by breaking it down into simpler tasks. A function that performs a complex behavior gets it done by doing some of the work itself and by using functions to do simpler tasks.

When a function uses another function to perform a simpler task it needs to make sure that once the simpler function is done work resumes on the more complex task. To make this happen it saves off where it was. It is saved to an area of memory called the stack. The simpler function may very well also call on other function to perform even simpler tasks. It also needs to save off where work was before it calls on simpler function.

This is why the area of memory where this information is saved is called a stack. Just like you would pile dishes on top of each other, the saved information is piled on top of each other. When the simpler function is done to find out where work should resume it picks off the top of the pile. This tells it where to go back to. This repeats when that function is done.

Now suppose whenever an action is taken (e.g. retrieving a handle to a registry key) this stack memory is recorded. To do this the simpler task function looks at the stack memory find out where work would resume when it is done. What is being recorded is the address in memory where the instruction is that resumes the more complex work. This is literally just a number between 0 and about 4 billon. Using the earlier example this address could in a function in a printer driver that needs the page size to print on. This process can keep going and look at when the the page size retrieval function that is done where work would resume. This might be function that is responsible for printing. It can keep doing that back all the way to the function that starts the application (some function in a printer spooler). This information (a list of memory addresses) is called a call stack log or call stack for short.

Now imagine you decided that retrieving a registry key handle is causing a problem you could inspect the recorded information to determine why the action was taken. This helps in narrowing down what causes the problem. This is especially true today because applications are put together using 100s of thousands of functions from many vendors. Knowing the call stack tells you who initiated the action that causes a problem.

Collection of call stacks is an option in UPHClean v1.6d enabled via the registry setting HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\UPHClean\Parameters\CALLSTACK_LOG to 1. The value is a DWORD but you should find it there if UPHClean has ever been run.

The actual call stack logging is something that is not actually done by UPHClean. You can understand why based on the explanation I gave above: UPHClean is not being called on to perform the action of opening a registry handle. This work is actually by functions that reside in the DLL ADVAPI32. So when you set this option what UPHClean does is set a registry setting (HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\LeakTrack). The functions in ADVAPI32 responsible for getting a registry key handle read this value. When the value is set appropriately they collect a call stack whenever they are asked to get a registry key under the user profile hives. Later when the registry keys are release closed it removes the discards the collected call stack information.

When UPHClean is about to process a handle that is leaked by an application for remapping or closure UPHClean checks to see if call stack logging is enabled. If call stack logging is enabled it reads the stack information recorded by ADVAPI32. This information is recorded as a list of memory addresses tha

It is logged in the application event log as an addition to event 1401 or 1201. The readme has an example:

Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1201
Date:  10/21/2003
Time:  5:17:38 PM
User:  RCARONDOM-DC1\u1
Computer: RCARONDOM-DC1
Description:
The following handles in user profile hive RCARONDOM-DC1\u1
(S-1-5-21-3230802392-3390281410-1560515013-1307) have been closed because they
were preventing the profile from unloading successfully:

profleak.exe (2604)
HKCU (0x80)
      0x77dfc200 ADVAPI32!TrackObject+0xe
      0x00412112 profleak!<no symbol>
      0x77db571b ADVAPI32!ScSvcctrlThreadA+0xe
HKCU\Software\Policies (0x88)
      0x77dfc200 ADVAPI32!TrackObject+0xe
      0x77da1949 ADVAPI32!RegOpenKeyExW+0x10b
      0x0041350c profleak!<no symbol>
      0x00412112 profleak!<no symbol>
      0x77db571b ADVAPI32!ScSvcctrlThreadA+0xe

This this call stack data indicates that the user profile hive handle leak is caused by profleak. Profleak is an application used to causes a user profile hive handle leak. It is not true that in all cases the listed module/DLL listed after ADVAPI32 is the culprit. Interpreting this information requires an experienced developer or someone who can debug.

When will UPHClean v2.0 be done?

Robin Caron — Fri, 07 Mar 2008 00:58:00 GMT

UPHClean v2.0 has been in beta for an extended period. Over 3,000 people have received the beta bits. There have been enough reports of computers hanging and crashing to prevent release. Further beta builds are needed to insure that those remaining problems are resolved. Once ship quality is achieved a release date will be selected. Based on my current work load and experience with past projects I expect that will at least 6 more months before final release.

Group Policy Administrative Template To Manage 2.0 Beta Settings

Robin Caron — Wed, 05 Mar 2008 00:18:00 GMT

Here is an administrative template to make it easier to manage the file remapping settings available with UPHClean v2.0.

Thank you Kevin Henriksen for this contribution.

About UPHClean v2.0 events 1630, 1631 and 1632

Robin Caron — Mon, 03 Mar 2008 20:38:00 GMT

UPHClean v2.0 tries to assist when the security descriptor prevents access to a file or directory. This often prevents the system from completing the profile reconciliation process. This can happen because the inherited permissions are set incorrectly or possibly because the user sets to prevent administrative and/or system access.

UPHClean attempts to deal with that by changing the security descriptor. This is done for access to file or directory access that result in access denied. In the case where the file or directory is local it is likely that UPHClean will be able to change the security descriptor since it can use the take ownership right to do so. In the remote case it is possible that UPHClean will fail to change the permissions. So this correction UPHClean may not always succeed.

Here are relevant events that can occur:

Event 1630: Access to %1 was granted after updating the security descriptor of the file.
- This event indicates that UPHClean changed the security descriptor for the file/directory named %1 and was successful. Access permissions necessary to proceed with profile work were granted. Access to the file or directory was successful.
Event 1631: Access to %1 failed after updating the security descriptor of the file.
- This event indicates that UPHClean changed the security descriptor and was successful. Even though UPHClean granted the access permissions necessary to perform the profile work the requested access was denied. This can happen if the source of the access denied is not security descriptor permission related. The interference could be coming from a background process (i.e. a virus scanner) or other unknown source.
Event 1632: Security descriptor for file %1 could not be updated. Error %2 %3.
- This event indicates that UPHClean failed in its attempt to change the security descriptor. %2 is replaced with the text of the error and %3 is the error number. Access to the file or directory failed.

Note that the name logged with the event may contain an unfamiliar drive letter. This drive letter represents the roaming profile location. It exists only during the profile reconciliation process.

These events are logged so that you can know that UPHClean took these actions. This is critical if auditing.

If the user profile is reconciling properly you can ignore these. If the profile is not reconciling properly and you are logging events 1631 or 1632 you should review the security descriptor hierarchy to insure that the permissions are as intended and allow system/administrative access.

UPHClean v2.0 beta

Robin Caron — Thu, 28 Feb 2008 22:39:00 GMT

So you want to try out the UPHClean v2.0 beta? Very good because that is what this post is about!

The current beta build installs on Windows 2000, Windows XP and Windows Server 2003. A future build will install on Windows Vista and Windows Server 2008.

To get the full benefit of UPHClean you should set the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPHClean\Parameters\SHARING_VIOLATION_REMAP to 1. This setting allows UPHClean to act on problems caused by application holding on to files after logoff. When this happens you may see profile folders left behind and/or creation of profile folders with names username.domain, username.000, username.001, etc. Do this after installation is done.

Remember it is beta code. Others who have tested it have reported crashes or hangs. It has been rare but keep that in mind when you decide what testing to do with it. UPHClean v2.0 will be released once the current build does not cause crashing/hanging. I will announce later beta bits through this blog.

The 32 bit plaform bits are here and for 64 bit platforms here.

I appreciate any feedback you have on this release.

UPHClean v2.0

Robin Caron — Thu, 28 Feb 2008 21:18:00 GMT

UPHClean v2.0 is a new version that tries to help with the following scenarios:

Timing fix

In v1.6 there is a timing issue with where the profile unload process stopped trying to unload the user profile hive before UPHClean finished its work. UPHClean finished its release of user profile hive handles but Winlogon had already proceeded without unloading the profile causing it to report a profile hive unload failure. This is now addressed by having Winlogon waiting until UPHClean has finished all of its work before proceeding.

Open file handles

Apart open registry handles that UPHClean v1.6 deals with open file handles to the user profile can have a bad influence on the profile load and unload process. Open references to profile files prevent the profile load and unload process from reconciling (copying files) from and to the roaming profile location. This prevents the deletion of the locally cached profile. Other symptoms of this is if the same user logs in again he or she gets a new profile with a name like username.000, username.001 etc.

UPHClean v2.0 takes care of these by releasing the handle to user profile files when the profile is unloaded. This is not without risk. Since UPHClean removes access to files or directories data that was cached by the application for the file is lost. This could cause the process to fail because it cannot read from the file. During testing this has not been found to be true but there is still a chance that it could happen. This is the reason why the file handle remap feature is disabled by default.

To enable the feature you have to set the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPHClean\Parameters
SHARING_VIOLATION_REMAP REG_DWORD 0X00000001

Without enabling the remapping feature UPHClean automatically detects sharing violation during the user logoff and retries the failed operation for a small amount of time. You can control the amount of time using the SHARING_VIOLATION_DELAY value. This value is specified in millisecond and has a default value of 1000 millisecond.

File permissions

In some cases a program might change file permissions or creates a new file/folder within the profile but incorrect permissions. This may leave the profile load/unload process unable to copy it or delete it. To resolve the issue you have to take ownership first before you can delete the file or folder. UPHClean takes care of those situations.

Real world problems

Here are actual scenarios that UPHClean v2.0 resolves:

VMware hgfs.dat
VMware creates the hgfs.dat file in profile folder for the first user that logs in and keeps it open. When using roaming profiles you get a problem with that. (read VMware FAQ1317 for a solution)
SUN Java (JRE)
In some cases SUN Java creates a folder called hsperfdata<username> with file permissions only set to the user and can not be removed by the system without taking ownership. SUN say’s this is by design (bug id 5042659)
Microsoft Internet explorer cookies and favorites
Favorites and cookie files sometimes excide more than 255 chars and can only be deleted through the command line
Also suspects for open file handles causing sharing violation
SAP SapGui (SapWorkDir), Imprivata SSO, Indexing Software, Virus scanner etc.

It will be supported on Windows 2000 (all versions), Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008. It will be available for 32 bit and 64 bit platforms. There are beta bit available for 32 and 64 bit platforms for all Windows 2000, Windows XP, and Windows Server 2003.

Windows Vista, Windows Server 2008 and UPHClean

Robin Caron — Thu, 28 Feb 2008 20:32:00 GMT

UPHClean fails to install on Windows Vista and Windows Server 2008. This happens because the User Profile service included with those operating system includes the functionality of UPHClean v1.6 built in. There is no point in having UPHClean perform its monitoring work when the profile service does all necessary work to prevent user hive fails from occuring.

Whereas UPHClean logs event 1401 to indicate that it took action to resolve a problem that would have prevent a user profile hive from unloading, the User Profile service logs event 1530. It looks like this:

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 2/28/2008 2:56:52 PM
Event ID: 1530
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: RCARON-PC
Description:
Windows detected your registry file is still in use by other applications or
services. The file will be unloaded now. The applications or services that
hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from
\Registry\User\S-1-5-21-2641105361-2081720548-7543625-1000:
Process 896 (\Device\HarddiskVolume1\Windows\System32\svchost. exe) has
opened key \REGISTRY\USER\S-1-5-21-2641105361-2081720548-7543625-1000

This event is letting you know that when the profile was being unloaded svchost.exe with process id (PID) 896 had a registry key handle to the profile hive for the user with SID S-1-5-21-2641105361-2081720548-7543625-1000.

The event is there so you know that the system took action. That way you could know that if the application fails in some way you can investigate whether this action might be involved in the failure. Generally my advice for this (as for UPHClean event 1401) is to ignore it.

I am working on UPHClean v2.0. This version will address many more user profile problem scenarios. This version will likely install on Windows Vista and Windows Server 2008. It is in beta but currently the beta bits do not yet install on those operating systems.

Robin.