RE: Server 2003 SP1 Logoff delay due to winlogon.exe

Hi,

--All of the drivers that we have used have been MS Certified, however as
per
--Vera's advice in the next post I am experimenting with various drivers to
see
--if there is a certain combination that is causing the delay (although
surely
--I'd expect to see spoolsv.exe crashing if it is a driver issue?).

I think Vera's suggestion is good. Let's know the result. :)

Best regards,

Vincent Xu
Microsoft Online Partner Support

======================================================
PLEASE NOTE: The partner managed newsgroups are provided to assist with
break/fix issues and simple how to questions.

We also love to hear your product feedback!
Let us know what you think by posting
from the web interface: Partner Feedback
from your newsreader: microsoft.private.directaccess.partnerfeedback.
We look forward to hearing from you!
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no rights.
======================================================



--------------------
Thread-Topic: Server 2003 SP1 Logoff delay due to winlogon.exe
thread-index: AcaxCttX0diupEEsT4a0Ai0/GV2Ikw==
X-WBNR-Posting-Host: 210.18.232.18
From: =?Utf-8?B?Z3Ro?= <gth@xxxxxxxxxxxxxxxx>
References: <A590BB6B-86E4-4D64-BCE1-69D087FAC71C@xxxxxxxxxxxxx>
<46emDHHrGHA.6120@xxxxxxxxxxxxxxxxxxxxx>
<Xns98075F150BFAEveranoesthemutforsse@xxxxxxxxxxxxx>
<7F2EE803-962A-4256-A358-69DCEDC1F6A6@xxxxxxxxxxxxx>
<Xns980894B2685B1veranoesthemutforsse@xxxxxxxxxxxxx>
<B5C67137-9948-4B02-8A74-079969BA16CD@xxxxxxxxxxxxx>
<r7rvFZ7rGHA.2024@xxxxxxxxxxxxxxxxxxxxx>
Subject: RE: Server 2003 SP1 Logoff delay due to winlogon.exe
Date: Wed, 26 Jul 2006 16:26:01 -0700
Lines: 225
Message-ID: <FA5C38F9-89D0-48D8-8962-EE3806214845@xxxxxxxxxxxxx>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
Newsgroups: microsoft.public.windows.terminal_services
Path: TK2MSFTNGXA01.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.windows.terminal_services:41543
NNTP-Posting-Host: TK2MSFTNGXA01.phx.gbl 10.40.2.250
X-Tomcat-NG: microsoft.public.windows.terminal_services

Hi Vincent,

I have enabled Dr Watson logging on a few servers and have found that the
spooler service is not crashing or restarting at all nor are there any
events
logged in the Event Log for any printing/spooler related events.

All of the drivers that we have used have been MS Certified, however as
per
Vera's advice in the next post I am experimenting with various drivers to
see
if there is a certain combination that is causing the delay (although
surely
I'd expect to see spoolsv.exe crashing if it is a driver issue?).

I have also found that if you remove the printer from the connected
printers
list as a user before logoff, generally the delay doesn't seem to occur.
So
we may have a possible work around by creating a logoff script to remove
all
printers (using con2prt.exe possibly) during logoff - however I guess
that
will take some testing to see if it is a viable option or not.

Thanks

"Vincent Xu [MSFT]" wrote:

Hi,

I suspect this problem occurs when the print spooler stops responding
on
the Terminal server. A spooler failure can be identified by information
in
the application event log or in the Drwtsn32.log on the Terminal
server.
The log indicates that the Spoolsv.exe process has terminated
unexpectedly.
I suggest you clean the Drwtsn32.log first and try to reproduce this
problem. Then check the log. Note: The Drwtsn32.log file path is drive
:\Documents and Settings\All Users\Documents\DrWatson\Drwtsn32.log.



Best regards,

Vincent Xu
Microsoft Online Partner Support

======================================================
Get Secure! - www.microsoft.com/security
======================================================
When responding to posts, please "Reply to Group" via your newsreader
so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no
rights.
======================================================



--------------------
Thread-Topic: Server 2003 SP1 Logoff delay due to winlogon.exe
thread-index: Acavn8jzzurq1QfaR4yCDz1cgSRb7g==
X-WBNR-Posting-Host: 210.18.232.18
From: =?Utf-8?B?Z3Ro?= <gth@xxxxxxxxxxxxxxxx>
References: <A590BB6B-86E4-4D64-BCE1-69D087FAC71C@xxxxxxxxxxxxx>
<46emDHHrGHA.6120@xxxxxxxxxxxxxxxxxxxxx>
<Xns98075F150BFAEveranoesthemutforsse@xxxxxxxxxxxxx>
<7F2EE803-962A-4256-A358-69DCEDC1F6A6@xxxxxxxxxxxxx>
<Xns980894B2685B1veranoesthemutforsse@xxxxxxxxxxxxx>
Subject: RE: Server 2003 SP1 Logoff delay due to winlogon.exe
Date: Mon, 24 Jul 2006 21:07:03 -0700
Lines: 135
Message-ID: <B5C67137-9948-4B02-8A74-079969BA16CD@xxxxxxxxxxxxx>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
Newsgroups: microsoft.public.windows.terminal_services
Path: TK2MSFTNGXA01.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.windows.terminal_services:41430
NNTP-Posting-Host: TK2MSFTNGXA01.phx.gbl 10.40.2.250
X-Tomcat-NG: microsoft.public.windows.terminal_services

Hi Vera,

Firstly - thanks for your help below, we don't use SMS at all in our
environment. However, I have done some more testing and found
something
very
interesting.

If the user (or administrator) doesn't have any printers in their
session,
the logoff is instant. However, if they have a printer (as assigned
by
the
login scripts) winlogon.exe then displays the 25% CPU spike as I
previously
described.

So I am now suspecting it is related to the printing subsystem
somehow.
It
doesn't seem to be driver specific however as it doesn't seem to be
specific
to just one driver/printer (we have a mix of IBM and Lexmark laser
printers).

I have seen some previous topics around problems with spoolsv.exe
showing
high CPU, but we haven't expereinced that at all.

So if anyone has ideas/thoughts on possible solutions I'd appreciate
it!

-gth

"Vera Noest [MVP]" wrote:

OK, I understand.
I've not much more to offer, except for a wild guess: do you happen
to use Systems Management Server (SMS) 2003? If so, check this
article:

831962 - A remote desktop session may experience a long delay when
you try to log off an Advanced Client computer
http://support.microsoft.com/?kbid=831962

I have no experience at all with debugging, but this seems to be
the tool that you are looking for:

User Mode Process Dumper
http://www.microsoft.com/downloads/details.aspx?FamilyID=e23cd741-
d222-48df-9cd8-28796f414256&DisplayLang=en
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?Z3Ro?= <gth@xxxxxxxxxxxxxxxx> wrote on 22 jul 2006 in
microsoft.public.windows.terminal_services:

Hi Vera,

Thanks for your reply. I've replied inline below:

"Vera Noest [MVP]" wrote:

KB 324446 is about the
"advanced performance" option on the disk and
lanman workstation and server reg keys

so I guess that's what the OP already tried. Can you confirm,
gth?

You're spot on. We already do those tweaks in the lanman server
and workstation keys as per the KB article.


I know that you wrote that you have already applied all of the
latest hotfixes, but without knowing explicit KB articles, I'm
going to suggest them anyway:

I should have elaborated a little further on what I meant by all
hotfixes - I meant all public post-SP1 security updates and
hotfixes that are available from Microsoft via WSUS/Microsoft
Update etc. I can give you a list of those if that helps.

We also have the MS Private Hotfix KB 910362 applied to all
servers to fix the 0xAB STOP issue which we experienced when
users either logged off manually, or were forcefully logged off
when reaching their idle session timeout. We had also previously
applied earlier revisions of this hotfix (KB 907242 etc) and the
logoff delay issue existed too. It also exists without that
private hotfix.


post-SP1:
828326 - It takes longer than you expect to log off from a
Terminal Services session in Windows 2000 or Windows Server
2003 http://support.microsoft.com/?kbid=828326


The only client printer mapping that we perform is done via
Citrix and only done for specific users. For the majority of our
users (60-70%) they connect via Thin Client devices with no
printers attached and do not have any form of client printer
mapping enabled either for RDP or ICA connections. The only
printers that the majority of our users have is one printer
which we map via a kix script at login (the printer is dependant
on the client name) and no changes have been made to the script
or the printer drivers between our pre-SP1 build and our SP1
build.

901196 - A remote session does not end immediately on a
computer that is running Windows Server 2003 Service Pack 1
http://support.microsoft.com/?kbid=901196

We have previously disabled the certificate auto-enrollment
feature via Group Policy as part of our SP1 environment rollout.
I'd heard many stories about that issue so luckily we had the
chance to stop that issue before it occured.

The AEExpress registry key is interesting - I have not yet tried
that, so I will add that registry key to some users and perform
testing to see if that makes any difference and will let you
know how it goes.


By the way, you also write:
With Server 2003 SP2 and UPHClean 2.0 Beta, no unload events

which had me extremely confused, because there is no SP2 for
2003 yet! But after a while I understood that you probably mean
Server 2003 R2, not SP2!

Sorry I should have re-phrased that statement! I did mean the
SP2 for 2003, but I was referring to the closed beta that is
currently underway via Connect. My main point was that the issue
still seems to exist under SP2 - but that isn't really relevant
to this discussion.

I have not tried building a server image with Server 2003 R2 to
see if the issue exists, but to my knowledge R2 is simply Server
2003 SP1 as a base (CD 1) and then the optional R2 CD 2 which
adds the R2 functionality if desired.

Thanks for your help so far though - I really appreciate it.






.

Relevant Pages

  • Re: Print Spool / Pipes not released
    ... is very normal) I would expect 3 or 4 open sessions to the print server. ... service pack 2 rollout the looping client calls has not been an issue. ... > We have about 10 machines on the network with local printers. ... > all our machines we have the following local printer drivers installed: ...
    (microsoft.public.windowsxp.print_fax)
  • Missing Printer Drivers, cant connect to print server
    ... Right now I'd like to connect to the server ... From the client, I can open the ... Which package do I need to install to populate the drivers db? ...
    (Debian-User)
  • RE: Server 2003 SP1 Logoff delay due to winlogon.exe
    ... those IBM and Lexmark printer drivers: ... MCSE, CCEA, Microsoft MVP - Terminal Server ... the latest hotfixes, ... The only client printer mapping that we perform is done via ...
    (microsoft.public.windows.terminal_services)
  • RE: Server 2003 SP1 Logoff delay due to winlogon.exe
    ... MCSE, CCEA, Microsoft MVP - Terminal Server ... latest hotfixes, but without knowing explicit KB articles, I'm ... The only client printer mapping that we perform is done via ... The AEExpress registry key is interesting - I have not yet tried ...
    (microsoft.public.windows.terminal_services)
  • Re: BSoD on 2003 TS - varying error codes
    ... Another option is to completely wipe the server and reinstall from a known good image or from scratch. ... If the problem comes back then it is most likely faulty hardware. ... Possible Faulty Device Drivers ...
    (microsoft.public.windows.terminal_services)
Loading