Windows Event ID 1130 – Microsoft-Windows-User Profiles Service: User Profile Service Failed

Start by examining the complete event details and related events to understand the specific failure context.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter for Event ID 1130 using Filter Current Log from the Actions pane
4. Double-click the most recent Event ID 1130 to view detailed information including error codes and affected user accounts
5. Check for related events around the same timestamp, particularly from sources like Winlogon, Group Policy, or Disk events
6. Use PowerShell to extract detailed event information:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1130} -MaxEvents 10 | Format-List TimeCreated, Id, LevelDisplayName, Message

# Get related profile service events
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-User Profiles Service'} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Insufficient disk space and permission issues are common causes of User Profile Service failures.

1. Check available disk space on the system drive:

# Check disk space
Get-WmiObject -Class Win32_LogicalDisk | Where-Object {$_.DriveType -eq 3} | Select-Object DeviceID, @{Name="Size(GB)";Expression={[math]::Round($_.Size/1GB,2)}}, @{Name="FreeSpace(GB)";Expression={[math]::Round($_.FreeSpace/1GB,2)}}, @{Name="%Free";Expression={[math]::Round(($_.FreeSpace/$_.Size)*100,2)}}

2. Verify profile directory permissions and ownership:

# Check Users directory permissions
Get-Acl "C:\Users" | Format-List

# Check specific user profile permissions (replace USERNAME)
Get-Acl "C:\Users\USERNAME" | Format-List

# Check for profile directory issues
Get-ChildItem "C:\Users" -Force | Where-Object {$_.Name -like "*.bak" -or $_.Name -like "TEMP*"}

3. Clean up temporary profiles and ensure adequate free space (minimum 15% recommended)
4. Reset permissions on the Users directory if necessary:

# Reset Users directory permissions (run as Administrator)
icacls "C:\Users" /reset /t /c /q

Registry corruption in profile-related keys can cause User Profile Service failures requiring targeted repair.

1. Check the User Profile Service status and dependencies:

# Check User Profile Service status
Get-Service -Name "ProfSvc" | Format-List Name, Status, StartType, DependentServices, ServicesDependedOn

# Restart the service if it's not running
Restart-Service -Name "ProfSvc" -Force

2. Examine profile registry entries for corruption:

# Check profile list registry entries
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" | ForEach-Object {
    $sid = $_.PSChildName
    $profilePath = (Get-ItemProperty $_.PSPath).ProfileImagePath
    Write-Output "SID: $sid, Path: $profilePath"
}

3. Open Registry Editor (regedit.exe) and navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
4. Look for duplicate entries or entries with ".bak" extensions that indicate profile corruption
5. For corrupted profiles, delete the problematic registry key (after backing up the registry):

# Backup registry before making changes
reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" "C:\Temp\ProfileList_Backup.reg"

6. Check and restart critical service dependencies:

# Check and restart RPC service
Get-Service -Name "RpcSs" | Restart-Service -Force

# Check Windows Management Instrumentation
Get-Service -Name "Winmgmt" | Restart-Service -Force

In domain environments, Event ID 1130 often relates to Active Directory connectivity or roaming profile synchronization failures.

1. Test domain controller connectivity and authentication:

# Test domain controller connectivity
nltest /dsgetdc:yourdomain.com

# Check domain trust relationship
Test-ComputerSecureChannel -Verbose

# Verify Kerberos tickets
klist tickets

2. Check Group Policy processing and profile-related policies:

# Force Group Policy update
gpupdate /force

# Check Group Policy processing events
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-GroupPolicy'} -MaxEvents 10

3. For roaming profiles, verify network share accessibility:

# Test network share connectivity (replace with your profile share)
Test-Path "\\server\profiles$\username"

# Check network share permissions
Get-Acl "\\server\profiles$\username" | Format-List

4. Examine DNS resolution and network connectivity:

# Test DNS resolution for domain controllers
nslookup yourdomain.com

# Check network connectivity to domain controllers
Test-NetConnection -ComputerName dc01.yourdomain.com -Port 389

5. Review Active Directory event logs on domain controllers for related authentication or replication issues
6. Consider temporarily disabling roaming profiles for affected users to isolate the issue:

# Check current profile type for a user
Get-WmiObject -Class Win32_UserProfile | Where-Object {$_.LocalPath -like "*username*"} | Select-Object LocalPath, RoamingConfigured, Special

For persistent issues, enable detailed logging and perform comprehensive system integrity checks.

1. Enable verbose logging for the User Profile Service:

# Enable User Profile Service debug logging
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics" /v GPSvcDebugLevel /t REG_DWORD /d 0x30002 /f

# Create logging directory
New-Item -Path "C:\Windows\debug\usermode" -ItemType Directory -Force

2. Restart the User Profile Service to begin detailed logging:

Restart-Service -Name "ProfSvc" -Force

3. Reproduce the issue and examine detailed logs in C:\Windows\debug\usermode\gpsvc.log
4. Run comprehensive system file and registry integrity checks:

# Run System File Checker
sfc /scannow

# Run DISM to repair Windows image
DISM /Online /Cleanup-Image /RestoreHealth

# Check registry integrity
scanreg /fix

5. Perform Windows Management Instrumentation repository repair:

# Stop WMI service
Stop-Service -Name "Winmgmt" -Force

# Rebuild WMI repository
winmgmt /resetrepository

# Restart WMI service
Start-Service -Name "Winmgmt"

6. Check for hardware issues affecting profile storage:

# Check disk health
Get-WmiObject -Class Win32_DiskDrive | Get-WmiObject -Class Win32_DiskDrivePhysicalMedia

# Run disk check on system drive
chkdsk C: /f /r

7. Disable verbose logging after troubleshooting:

# Disable debug logging
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics" /v GPSvcDebugLevel /f