RE: Server 2003 SP1 Logoff delay due to winlogon.exe

OK, I see. But I would expect printer spooler problems to log
entries in the EventLog.

Anyhow, those IBM and Lexmark printer drivers: you did *not*
install the drivers from IBM and Lexmark on the TS, I hope? That's
usually causing all kinds of problems, since 3rd party drivers are
nearly always not TS-compatible.

If you installed 3rd party printer drivers, then uninstall them
completely. In stead, you have to map the printers to a native
windows driver (which came on the OS CD-ROM). Detailed description
here:

239088 - Windows 2000 Terminal Services Server Logs Events 1111,
1105, and 1106
http://support.microsoft.com/?kbid=239088
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
*----------- Please reply in newsgroup -------------*

=?Utf-8?B?Z3Ro?= <gth@xxxxxxxxxxxxxxxx> wrote on 25 jul 2006:

Hi Vera,

Firstly - thanks for your help below, we don't use SMS at all in
our environment. However, I have done some more testing and
found something very interesting.

If the user (or administrator) doesn't have any printers in
their session, the logoff is instant. However, if they have a
printer (as assigned by the login scripts) winlogon.exe then
displays the 25% CPU spike as I previously described.

So I am now suspecting it is related to the printing subsystem
somehow. It doesn't seem to be driver specific however as it
doesn't seem to be specific to just one driver/printer (we have
a mix of IBM and Lexmark laser printers).

I have seen some previous topics around problems with
spoolsv.exe showing high CPU, but we haven't expereinced that at
all.

So if anyone has ideas/thoughts on possible solutions I'd
appreciate it!

-gth

"Vera Noest [MVP]" wrote:

OK, I understand.
I've not much more to offer, except for a wild guess: do you
happen to use Systems Management Server (SMS) 2003? If so,
check this article:

831962 - A remote desktop session may experience a long delay
when you try to log off an Advanced Client computer
http://support.microsoft.com/?kbid=831962

I have no experience at all with debugging, but this seems to
be the tool that you are looking for:

User Mode Process Dumper
http://www.microsoft.com/downloads/details.aspx?FamilyID=e23cd74
1- d222-48df-9cd8-28796f414256&DisplayLang=en
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?Z3Ro?= <gth@xxxxxxxxxxxxxxxx> wrote on 22 jul 2006 in
microsoft.public.windows.terminal_services:

Hi Vera,

Thanks for your reply. I've replied inline below:

"Vera Noest [MVP]" wrote:

KB 324446 is about the
"advanced performance" option on the disk and
lanman workstation and server reg keys

so I guess that's what the OP already tried. Can you
confirm, gth?

You're spot on. We already do those tweaks in the lanman
server and workstation keys as per the KB article.


I know that you wrote that you have already applied all of
the latest hotfixes, but without knowing explicit KB
articles, I'm going to suggest them anyway:

I should have elaborated a little further on what I meant by
all hotfixes - I meant all public post-SP1 security updates
and hotfixes that are available from Microsoft via
WSUS/Microsoft Update etc. I can give you a list of those if
that helps.

We also have the MS Private Hotfix KB 910362 applied to all
servers to fix the 0xAB STOP issue which we experienced when
users either logged off manually, or were forcefully logged
off when reaching their idle session timeout. We had also
previously applied earlier revisions of this hotfix (KB
907242 etc) and the logoff delay issue existed too. It also
exists without that private hotfix.


post-SP1:
828326 - It takes longer than you expect to log off from a
Terminal Services session in Windows 2000 or Windows Server
2003 http://support.microsoft.com/?kbid=828326


The only client printer mapping that we perform is done via
Citrix and only done for specific users. For the majority of
our users (60-70%) they connect via Thin Client devices with
no printers attached and do not have any form of client
printer mapping enabled either for RDP or ICA connections.
The only printers that the majority of our users have is one
printer which we map via a kix script at login (the printer
is dependant on the client name) and no changes have been
made to the script or the printer drivers between our pre-SP1
build and our SP1 build.

901196 - A remote session does not end immediately on a
computer that is running Windows Server 2003 Service Pack 1
http://support.microsoft.com/?kbid=901196

We have previously disabled the certificate auto-enrollment
feature via Group Policy as part of our SP1 environment
rollout. I'd heard many stories about that issue so luckily
we had the chance to stop that issue before it occured.

The AEExpress registry key is interesting - I have not yet
tried that, so I will add that registry key to some users and
perform testing to see if that makes any difference and will
let you know how it goes.


By the way, you also write:
With Server 2003 SP2 and UPHClean 2.0 Beta, no unload
events

which had me extremely confused, because there is no SP2 for
2003 yet! But after a while I understood that you probably
mean Server 2003 R2, not SP2!

Sorry I should have re-phrased that statement! I did mean the
SP2 for 2003, but I was referring to the closed beta that is
currently underway via Connect. My main point was that the
issue still seems to exist under SP2 - but that isn't really
relevant to this discussion.

I have not tried building a server image with Server 2003 R2
to see if the issue exists, but to my knowledge R2 is simply
Server 2003 SP1 as a base (CD 1) and then the optional R2 CD
2 which adds the R2 functionality if desired.

Thanks for your help so far though - I really appreciate it.
.

Relevant Pages

  • RE: Server 2003 SP1 Logoff delay due to winlogon.exe
    ... --Vera's advice in the next post I am experimenting with various drivers to ... MCSE, CCEA, Microsoft MVP - Terminal Server ... latest hotfixes, but without knowing explicit KB articles, I'm ... The only client printer mapping that we perform is done via ...
    (microsoft.public.windows.terminal_services)
  • Re: Print Spool / Pipes not released
    ... is very normal) I would expect 3 or 4 open sessions to the print server. ... service pack 2 rollout the looping client calls has not been an issue. ... > We have about 10 machines on the network with local printers. ... > all our machines we have the following local printer drivers installed: ...
    (microsoft.public.windowsxp.print_fax)
  • Missing Printer Drivers, cant connect to print server
    ... Right now I'd like to connect to the server ... From the client, I can open the ... Which package do I need to install to populate the drivers db? ...
    (Debian-User)
  • Re: BSoD on 2003 TS - varying error codes
    ... Another option is to completely wipe the server and reinstall from a known good image or from scratch. ... If the problem comes back then it is most likely faulty hardware. ... Possible Faulty Device Drivers ...
    (microsoft.public.windows.terminal_services)
  • Re: After manually undoing a recent MS Update, my server is a mess
    ... Keep in mind that I have seen OEM drivers up there so given that you've blown that image away, I can't say for certain that the 'critical' was 100% pushed by Microsoft. ... External USB is no replacement for local drives. ... LOL I show my naivety here when I say that I showed great diligence in my blind application of any MS suggested resolution to "Critical Errors" on my Small Business Server Monitor Report. ... When I got the first BSOD, I booted from the orginal CD and chose to only restore the System files. ...
    (microsoft.public.windows.server.sbs)