I loathe the typical and all to frequent support response to weird desktop issues: reimage it! If your company has an SLA established where by issues that cannot be resolved within a certain time period, yadda, yadda, yadda; but I see it too often where these SLAs don't exist, and folks just jump to reimaging the system when a solution isn't easily available.

Case in point: User logs onto their workstation one morning and receives the error:

Can't find script engine "VBScript" for script \\server\sysvol\domain.com\Policies\{1E6FB511-C1A1-49AB-8E4C-BC34076F683B}\User\Scripts\Logon\Drivemapping.vbs

They click OK and then nothing happens. Explorer doesn't load; you can't even manually start it. Yet when you logon as an administrator, all is well.

Little could be found via Google on this error. I tried a few things (re-register vbscript.dll, reinstall IE6 SP1, patch) - no dice. I was able to replicate the error when logged on as an admin by using runas /user:domain\username "wscript myscript.vbs" which caused the same error. I assumed it was a permissions issue, so I whipped out the handy regmon and filemon tools. Nothing in the regmon capture log (filtered to just wscript) indicated a problem, but filemon quickly showed the source of the problem: access denied to C:\WINNT\Registration\R000000000006.clb. I checked the privs - System & Admins Full Control, Everyone special Read (everything but execute). The permissions were unique to the folder, not inherited from the system root.

The fix:

cacls %windir%\Registration /e /g Users:R

It took me about an hour of total work to come up with a single command-line fix, versus the hours of toil and trouble to backup the user data, reimage the system, replace the data, etc. Of course that's another task for me for a rainy day: automate that process with SMS OSD.... :)