Terminal Server NTUSER.DAT file bloat

[Marc Tollefson]

We have a Terminal Server solution running on Windows 2003 virtual machines. This is used for the account team around the world to access the client network/applications. The users (approx 100) have roaming profiles stored on a roaming profile server share. We have a NetScaler load balancing least connections to this Terminal Server farm. We have these Terminal Servers in their own OU, with a GPO attached to it. When we first went live in May, we had no restrictions on printer redirection. Somehow, the mapping of printers via RDP has caused bloating in the NTUSER.DAT file. We are talking 150MB in size, when typical NTUSER.DAT files are < 2MB. I have since modified the GPO to disallow all printer redirection, since at any point in time you would see 200+ printers mapped on each Terminal Server, and users were printing to wrong printers, causing Print Spooler spiking the CPU until the job was killed.

I opened a case with Microsoft, and after analyzing a good/bad NTUSER.DAT, they were able to determine the bloat is in [HKEY_USERS\{user}\Software\Hewlett-Packard\{ID}\HPBIDIInfo]. There are thousands of entries on the bloated profile with the HPBIDIInfo. Microsoft gave us a fix to load the user hive, delete the keys, and compress the file using the CHKREG command, which takes the NTUSER.DAT from 150MB file to 2MB. This has worked great. However, when some users log on (haven’t figured out why only some), the bloat happens again. Since we store our roaming profiles on a share, it takes time to write the NTUSER.DAT file and copy it. We’ve had users complain of 20+ minutes to login to a Terminal Server, sitting at a blue screen before seeing icons. The TS itself really has no CPU/MEM resource issues during this time. You will see USERINIT.EXE running, but not taking up too much. It’s just the writing/reading of that bloated NTUSER.DAT file. You can watch that file slowly grow in size, until it stops, and the user can start working.

Microsoft suggested that I open a case with HP to figure out and resolve where this HPBIDIInfo registry entries are coming from. They indicated this was a known issue with some HP drivers, but couldn’t elaborate on which ones. Since I have no printers with no support contracts, I really have no means to do it.

[wobbe]

Isn't it possible to do some sort of printer driver mapping. So when a client connects with a problem driver it gets mapped to, let say, a hp laserjet 4 driver. Or was this only possible with citrix? Anyway might be something to investigate.

[Matt (Brinker)]

Does anyone have any insight regarding this? We are expiriencing the exact same issues with various users having a bloated ntuser.dat file. Then, with a 30MB profile storage space limit, they are notified that they have exceeded the limit and are instructed to decrease the size before they logoff.

[Cobson]

I think the problem may originate from keys in HKLM\Software\Microsoft\Windows NT\Terminal Server\Install\Software

I imagine that any new user profiles will get these keys added.

[Phil.Howell]

Some HP printer drivers install services to do printer and port monitoring, so you may have hpboid.exe and hpbpro.exe running?
Google for various methods to remove them.
Also, installing UPHClean may help.
Phil

[Cobson]

I had a similar problem, but in my case the bloat was being caused by Konica Minolta printer drivers. By deleting the Konica Minolta key from the HKLM location I mentioned in my last post, I stopped the bloat from affecting new profiles.

[Cobson]

Marc: would you be able to expand on how to use chkreg.exe to compress an ntuser.dat file ?