Synchronization problems with Offline Files in Windows: a complete guide

When Windows Offline Files go wrong, the result is usually the same: angry users, laptops that are left "empty" outside the office, and administrators unsure where to begin. While it may seem like a secondary function, the offline file cache is critical in many offline environments with laptops and roaming profiles.

This article provides a detailed guide to understanding, configuring, diagnosing, and repairing problems with Offline Files, the Sync Center, and the CSC cache in various versions of Windows (especially Windows 7, 10, and 11). We'll cover common issues like the system failing to return to online mode or the Sync Center stuck on "Pending," as well as how to control the feature using Group Policy or audit it with PowerShell.

What exactly are offline files in Windows?

The offline file feature is a Windows client/server technology that allows the contents of SMB shares to be copied and stored in a local cache called CSC (Client-Side Caching) . This enables the system to simulate UNC paths even when the computer is disconnected from the corporate network.

In practice, the user accesses their network folders (for example, \\Server\Users\Name ) as usual, but when there is no connection, Windows silently redirects access to the copy residing in the local cache. When the network becomes available again, the Sync Center compares changes between the server and the cache and automatically synchronizes them.

This technology is especially useful for laptops with roaming profiles or redirected folders (Desktop, Documents, Pictures, etc.). However, enabling it on folders shared by many users or on sensitive data (databases, shared departmental files) can lead to data conflicts, network overload, and duplicate copies across the organization.

For Offline Files to function correctly, the file server, the shared folder, and the Windows client must support the technology and have the offline file service enabled . If the service is disabled on the client or the resource is not compatible, the feature will not work even if you try to force it.

Internal workings: MUP, SMB and CSC redirectors

In Windows Vista, Windows 7, and later versions, all requests to access remote file systems are routed through the Multiple UNC Provider (MUP) . The MUP receives a UNC path such as \\Server\Resource\Folder and decides which network redirector (UNC provider) should handle it: usually the SMB client (LanmanWorkstation), but it could also be others.

MUP sends a prefix resolution operation (IOCTL_REDIR_QUERY_PATH) to the appropriate redirector. This operation parses the UNC path and checks, step by step, the accessibility of each component: first \\Server , then \\Server\Resource$ , and so on. If any of these steps returns errors such as STATUS_LOGON_FAILURE or STATUS_ACCESS_DENIED , MUP marks the path as inaccessible.

The client-side caching component (CSC) intercepts requests that would otherwise be passed to the network redirector. If prefix resolution fails, but the route was previously marked as available offline, the CSC decides to serve the data from the local cache instead of continuing to attempt to access the server.

This behavior explains many of the "weird" problems with offline files: the user may see some network folders online , but those configured to work offline are still served from the cache even with the network available, leading to inconsistencies, synchronization conflicts, or a feeling of "outdated data."

In terms of performance, the Sync Center performs comparisons between the local directory list and the one exposed by the remote server via SMB (CIFS/SMB/SMB2/SMB3). Windows file servers using NTFS return directory entries in alphabetical order , but many third-party servers, or those using file systems like FAT32, return unordered lists, forcing the client to perform more queries and seriously impacting synchronization speed.

Typical problem: Windows does not return to online mode

One of the most frequently reported issues, especially in Windows 7 SP1 , is that after switching to offline mode, the system does not automatically return to online mode when the network becomes available again. The user sees that the network connection is working and can access other shared resources, but items marked as "available offline" continue to be treated as if the machine were offline.

In these cases, the "Work Offline / Work Online" button may disappear from Windows Explorer after a transition, and the CSC cache remains offline until the next computer restart. To make matters worse, the Sync Center doesn't display updated information about the sync relationship, and it's not possible to force a sync of the affected UNC path.

The typical symptom is that the user opens a shared folder and finds that some network resources are online and working, but those configured to be available offline are always displayed from the local cache. They can create new files or modify existing ones, but these changes are not uploaded to the server and remain only on the laptop's hard drive.

One scenario that triggers this behavior is when a shared resource of the form \\ServerName\ShareName$\dir1\dir2 is provided , in which the user has sufficient permissions on the subfolders dir1 and dir2 , but does not have permissions to view the contents of the root shared resource ShareName$.

In this context, when analyzing the UNC path, Windows successfully checks \\ServerName , but fails when attempting to validate \\ServerName\ShareName$ due to insufficient permissions at that level. This denial causes the remote operation to be marked as failed, and by design, CSC returns the cached contents if the path had been previously synchronized.

Recommended permissions on shared resources and NTFS

The solution to this type of problem involves verifying that the user can access each segment of the UNC path with sufficient minimum permissions, both at the SMB share level and the NTFS permissions. For a path like \\ServerName\ShareName$\dir1\dir2 , where the user synchronizes the subfolder dir1 , security must be carefully configured.

In offline file shares (for example, ShareName$ ), the usual recommendation is to remove the "Everyone" group from the sharing permissions and use a security group that includes the users who actually need to use that resource, granting them Change permissions or higher. This avoids unnecessary exposure but ensures that anyone with access to the subfolders can resolve the UNC prefix without errors.

At the NTFS level in the root folder of the shared resource, entries such as the following are typically established: CREATOR OWNER with full control over subfolders and files , SYSTEM with full control , and a security group for users with "Show folder/read data" permissions on this folder . The "Everyone" group is left without permissions to strengthen security, and administrators can have direct access or delegate it to specific groups according to the organization's policy.

In specific user subfolders (e.g., dir1 and dir2 ), it is common practice to grant the owner user read and write permissions , maintain SYSTEM with full control , and remove unnecessary permissions for "Everyone" and, in many environments, "Administrators" on the contents of each user folder, depending on the privacy policy and technical support.

If these permissions are not aligned, MUP may mark the path as inaccessible due to access denial at the share level, and Offline Files will continue to serve data from the cache without returning to online mode, resulting in failed or missing synchronizations.

Sync center stuck on "Pending" and corrupted CSC cache

Another common problem is the Sync Center getting stuck in a "Pending" state for Offline File associations. There's no clear error message; the interface offers few clues, and the user simply sees that the syncing process never finishes.

This type of problem usually points to a corrupted or inconsistent CSC cache . One effective (though somewhat drastic) way to fix it is to disable the offline files feature, completely clean the C:\Windows\CSC folder , and then re-enable the feature to regenerate the cache from scratch.

The typical procedure would be something like this: first, offline files are disabled from the Sync Center , the computer is restarted so that the service stops being active, and then ownership of the C:\Windows\CSC folder is taken , since by default it is protected and belongs to the system.

To take ownership, you can use the "Take Ownership" context menu if it was added via the registry, or you can use the command line with administrator privileges and run something like: takeown /f "c:\windows\csc" /r /a /dy , followed by icacls "c:\windows\csc" /grant Administrators:(F) /t /l /q . This grants full control permissions to the administrators group over the entire structure.

Once access is secured, it's advisable to back up the CSC folder in case the user has unsynced data that needs to be manually recovered. Next, it's important to delete the entire C:\Windows\CSC folder , not just its contents; leaving the folder with incorrect ACLs can cause the system to get stuck in "Pending" mode again. After deletion, reactivate offline files in the Sync Center and restart the system to regenerate the cache structure.

In more complicated cases, when the CSC folder cannot be deleted even after changing permissions, you can use tools like PsExec (SysInternals) to open a console as the system account (SYSTEM) and use `rmdir /s` on the internal folder (for example, C:\Windows\CSC\v2.0.6 ). Another alternative is to boot into the Windows Recovery Environment (WinRE), go to the command prompt, rename the CSC folder (for example, `ren csc csc1` ), and create a new empty folder with `md csc`.

Slow performance when syncing with non-Windows servers

Offline file synchronizations may take significantly longer than normal when the underlying file server is not a classic Windows Server (e.g., third-party NAS or Linux servers with Samba) or when the underlying file system is not NTFS.

The reason is that the Sync Center bases much of its logic on comparing the local content list with the one returned by the server via SMB. Microsoft servers using NTFS return directory entries already sorted alphabetically , allowing the client to efficiently compare data.

However, many file systems do not maintain ordered internal lists , neither in third-party SMB implementations nor in other formats like FAT32. In these scenarios, the Windows client receives unordered directories, forcing it to perform more queries to both the local file system and the remote server , especially when there are hundreds or thousands of files with long names and the sorting is uneven.

The larger the volume of files and the more disorganized the lists returned by the server, the more the number of operations required to determine what has changed and what hasn't increases. While this doesn't cause integrity errors, it does result in very slow synchronizations and a significant impact on the user experience.

To mitigate the problem, it is recommended to divide the data into smaller folders (either by reducing the number of files per directory or the size of the names) and, where possible, to organize or restructure the underlying file system so that file creation follows a less chaotic pattern, helping the client to avoid making so many queries.

Control offline files with group policies (GPO)

In corporate environments with Active Directory, the most sensible approach is to control Offline Files using Group Policy Objects (GPOs) , both at the computer and user levels. This allows you to precisely decide who can use the feature, on which computers, and how it behaves in the event of slow connections, disconnections, or certain types of files.

A common strategy involves separating the "Enabled" and "Disabled" policies so they can be assigned to different Organizational Units (OUs). For example, you can create a "Computers" OU and, within it, subfolders for "Laptops" and "Workstations." A GPO enabling offline files is applied to laptops, while a GPO disabling offline files is applied to office workstations.

The main options are located in the administrative templates under Computer Configuration > Policies > Administrative Templates > Network > Offline Files , where you can adjust the global usage of the feature using the policy "Allow or deny use of the Offline Files feature ." Setting it to "Disabled" completely shuts down the service, and the user cannot modify it from the Sync Center.

At the user level, under User Configuration > Policies > Administrative Templates > Network > Offline Files , you can control aspects such as the default action when the connection is lost, which extensions should not be cached, and whether synchronizations are performed at logon and logoff. To limit access to certain users, a specific security group (for example, "Users with Offline Files") is typically created , and GPO security filtering is used, removing "Authenticated Users" and adding only that group.

When configuring user folder permissions on the server, ensure that the security group used in the GPO has the appropriate permissions on NTFS : show folder/read data, create folder/append data, and read permissions on the root folder; while SYSTEM, CREATOR OWNER, and administrators maintain full control where appropriate, following best practices for roaming profiles and redirects.

Advanced customization of Offline Files by policy

Beyond simply enabling or disabling the feature, GPOs allow you to fine-tune the behavior of offline files to suit different scenarios. Some of the most useful options that a production administrator typically configures are:

Define the action to take when disconnecting from the server , setting the computer to automatically switch to "Work Offline" mode when it detects a loss of connection. This prevents the user from having to watch network errors and ensures they can continue accessing their files from the cache without abrupt interruptions.

Configure a list of "non-cached files ," including problematic extensions like *.mdb, *.dbf, or other database types that don't handle offline copies well. Marking them to never synchronize greatly reduces the risk of corruption and conflicts.

Enable the "Encrypt offline file cache" option . This way, even if the laptop is lost or stolen, the information stored in the CSC cache remains encrypted and cannot be easily read without the user's credentials.

Force synchronization of all offline files both upon login and logout . This ensures that changes made outside the corporate network are sent to the server as soon as the user reconnects, reducing the time during which discrepancies exist between the local and remote copies.

Adjust the maximum cache size using the "Default cache size" setting, where the value is specified as a percentage with two decimal places (e.g., 2550 for 25,50%). It's important to consider the actual capacity of the laptop's hard drive and the amount of data you intend to keep offline.

Users with slow connections or who are always out of the office

Some users rarely access the corporate network with a reliable connection, or almost always connect via VPN with limited bandwidth . For these users, it can be beneficial for them to always work offline , with synchronization occurring only at specific times or under certain conditions.

The "Configure low-speed link mode" directive allows you to define specific shared resources that, for the system, should be treated as if they were always on a slow link, setting parameters such as Latency=1 to force the consideration of that route as a slow connection in Spanish or English systems.

Combined with this, you can enable the "Enable file synchronization on estimated networks" option , so that automatic synchronization is more bandwidth-friendly and doesn't flood weak mobile or Wi-Fi connections with file update traffic.

With the correct combination of these policies, it is possible to ensure that the user always works from the local copy, and that their changes are synchronized when the machine detects a better connection, reducing waiting times and complaints about slowness.

Troubleshooting: Sync Center, Event Viewer, and PowerShell

If you encounter any unusual behavior with Offline Files, the first place to check is always the Sync Center . From there, you can review errors, conflicts, and the status of each sync association. You can also initiate manual syncs, either globally or on a specific folder or file, which helps reproduce errors on demand.

When the Sync Center doesn't provide enough information, the next step is to use the Event Viewer , located at Applications and Services Logs > Microsoft > Windows > Offline Files > Operational . This log stores a history of operations, errors, and warnings issued by the Offline Files component, which is very useful for identifying recurring patterns or specific error codes.

In large environments, where there are dozens or hundreds of potentially affected computers, it's practical to use PowerShell and WMI to gather information on a large scale. The Win32_OfflineFilesCache class allows you to check if the offline file cache is enabled and active, but it falls short if you want to know which specific items are being synchronized.

To delve deeper, you can use the Win32_OfflineFilesItem class , which returns a detailed listing of everything that is part of Offline Files on a computer. Each entry includes an ItemType property that indicates whether it is a server (3), a share (2), a directory (1), or a file (0), allowing you to quickly filter out those computers that are actually synchronizing files and not just having remnants of old associations.

This information is especially useful when preparing, for example, a script that automatically disables Offline Files via a local GPO on computers where the feature isn't actually being used. If a device only has "server" or "share" items without files (type 0), it can be considered safe to disable the feature without risk of losing user data.

As you can see, offline files are a powerful tool for maintaining the productivity of users working outside the corporate network, but they are also a common source of headaches when server permissions are not properly configured, the CSC cache is corrupted, or group policies haven't been carefully defined. Understanding how MUP works, knowing how to read the OfflineFiles event log, having a clear grasp of UNC permission best practices, and mastering GPO and PowerShell options makes all the difference between a stable infrastructure and one where users lose confidence in their own data.