Hi, it’s Adam Conkle again from the Directory Services team. Today’s posting covers how to correctly disable Offline Files in Windows Vista. I recently had a case where the customer was experiencing undesirable behavior with a file share only when the file server was accessed from their Windows Vista machines.
The symptoms were:
1. Files saved to the file share from the Vista machines will not update the file on the file server, yet the changes appear when accessed on the Vista machine.
2. Files and folders that have been deleted from the file server continue to appear when the file share is accessed from the Vista machines. The files and folders cannot be deleted from the Vista machines because the files do not exist.
The customer advised that they had chosen to disable Offline Files on all of their Vista machines. I looked at Control Panel and Offline Files was set to Disabled. I then looked at Services.msc and the Offline Files service was disabled. Looks good, right?
Next, I decided it would be a good idea to get a Process Monitor capture while we reproduce the above symptoms. Analysis of the capture showed me that Explorer.exe was not accessing the UNC path as expected, but rather was accessing C:\Windows\CSC\<namespace_path_for_share>. That’s odd. You’re probably thinking: “Why is Explorer.exe trying to access the Client Side Caching database when Offline Files has been disabled?”
That is a great question, and here is the answer:
Client Side Caching has a kernel driver that is loaded at startup when Offline Files is enabled. You can check the status of the driver by opening System Information (Start > Run > msinfo32 > System Summary > Software Environment > System Drivers). In the name column you will find “csc” with a description of “Offline Files Driver”. When Offline Files is truly disabled, the Start Mode column should be set to “Disabled”; otherwise it will be set to “System” which means it is loaded at system startup.
In my case, the customer’s driver was set to “System” even though the Offline Files GUI and the Offline Files service were both disabled. Offline Files on her Vista machines was in a halfway enabled state. No synchronization with the file server was taking place, but Explorer.exe was still directed to look at the CSC database because the kernel driver was loaded.
When the customer disabled Offline Files on the Vista machines, she manually disabled the Offline Files service on each machine, and she never made any change to the Offline Files GUI in Control Panel. I found that when you only disable the service, the Offline Files GUI does get updated and shows “Disabled”, but it leaves the kernel driver startup mode set to “System”. If you disable Offline Files via the Control Panel GUI, the service is disabled and the kernel driver is disabled as well. When Offline Files is disabled via the Control Panel GUI, you will be prompted to reboot the machine for this to take effect (so that the kernel driver can be unloaded).
The supported way to disable Offline Files is to use the Offline Files GUI in Control Panel, Group Policy, or WMIC.
To enable/disable Offline Files via Group Policy:
This is a Computer Configuration setting under Administrative Templates\Network\Offline Files named “Allow of Disallow use of the Offline Files feature”. Once the GPO applies, a reboot is required for the setting to take effect.
To enable/disable Offline Files via WMIC:
We use the Enable method of Win32_OfflineFilesCache to enable or disable offline files. Simply pass the Enable method a Boolean value.
As noted in the output, a reboot is required for the new setting to take effect.
If you have gotten your Vista machines into the state described above, enable Offline Files via one of the supported methods described above, reboot, disable Offline Files using a supported method, and then reboot once again.
Adam ‘Axe Body Wash’ Conkle