hovelsj

OS: Windows 2003 Standard,SP2 - 32-bit I used Process Monitor to find out about winlogon.exe: The process: ========= Description: Windows NT Logon Application Company: Microsoft Corporation Name: winlogon.exe Version: 5.02.3790.3959 Path: C:\WINDOWS\system32\winlogon.exe Command Line: winlogon.exe PID: 472 Parent PID: 400 Session ID: 0 User: NT AUTHORITY\SYSTEM Architecture: 32-bit Virtualized: n/a Integrity: n/a Started: 13.08.2008 16:17:34 Ended: (Running) Modules: winlogon.exe 0x1000000 0x87000 C:\WINDOWS\system32\winlogon.exe xpsp2res.dll 0x1290000 0x2C5000 C:\WINDOWS\system32\xpsp2res.dll msvcp60.dll 0x15A0000 0x65000 C:\WINDOWS\system32\msvcp60.dll msctfime.ime 0x4DC30000 0x2E000 C:\WINDOWS\system32\msctfime.ime dimsntfy.dll 0x5A120000 0x8000 C:\WINDOWS\system32\dimsntfy.dll NTLANMAN.dll 0x5F120000 0xE000 C:\WINDOWS\system32\NTLANMAN.dll hnetcfg.dll 0x5F270000 0x5A000 C:\WINDOWS\system32\hnetcfg.dll NETUI1.dll 0x5F860000 0x31000 C:\WINDOWS\system32\NETUI1.dll NETUI0.dll 0x5F8A0000 0x16000 C:\WINDOWS\system32\NETUI0.dll rsaenh.dll 0x68000000 0x35000 C:\WINDOWS\system32\rsaenh.dll wshtcpip.dll 0x71AE0000 0x8000 C:\WINDOWS\System32\wshtcpip.dll mswsock.dll 0x71B20000 0x41000 C:\WINDOWS\System32\mswsock.dll UxTheme.dll 0x71B70000 0x36000 C:\WINDOWS\system32\UxTheme.dll wsock32.dll 0x71BB0000 0x9000 C:\WINDOWS\system32\wsock32.dll MPR.dll 0x71BD0000 0x11000 C:\WINDOWS\system32\MPR.dll WS2HELP.dll 0x71BF0000 0x8000 C:\WINDOWS\system32\WS2HELP.dll WS2_32.dll 0x71C00000 0x17000 C:\WINDOWS\system32\WS2_32.dll NETAPI32.dll 0x71C40000 0x57000 C:\WINDOWS\system32\NETAPI32.dll kerberos.dll 0x71CA0000 0x58000 C:\WINDOWS\system32\kerberos.dll WINSCARD.DLL 0x72430000 0x1B000 C:\WINDOWS\system32\WINSCARD.DLL WINSPOOL.DRV 0x73070000 0x27000 C:\WINDOWS\system32\WINSPOOL.DRV icmp.dll 0x74010000 0x5000 C:\WINDOWS\system32\icmp.dll wbemsvc.dll 0x74CE0000 0xE000 C:\WINDOWS\system32\wbem\wbemsvc.dll wbemprox.dll 0x74CF0000 0x9000 C:\WINDOWS\system32\wbem\wbemprox.dll Cabinet.dll 0x74FA0000 0x19000 C:\WINDOWS\system32\Cabinet.dll wbemcomn.dll 0x750F0000 0x3A000 C:\WINDOWS\system32\wbem\wbemcomn.dll fastprox.dll 0x75550000 0x79000 C:\WINDOWS\system32\wbem\fastprox.dll PROFMAP.dll 0x75800000 0x9000 C:\WINDOWS\system32\PROFMAP.dll NDdeApi.dll 0x75810000 0x8000 C:\WINDOWS\system32\NDdeApi.dll WlNotify.dll 0x75820000 0x1B000 C:\WINDOWS\system32\WlNotify.dll MSGINA.dll 0x75840000 0x12C000 C:\WINDOWS\system32\MSGINA.dll sxs.dll 0x75DA0000 0xBD000 C:\WINDOWS\system32\sxs.dll apphelp.dll 0x75E60000 0x27000 C:\WINDOWS\system32\apphelp.dll drprov.dll 0x75E90000 0x7000 C:\WINDOWS\System32\drprov.dll davclnt.dll 0x75EA0000 0xA000 C:\WINDOWS\System32\davclnt.dll MSASN1.dll 0x76190000 0x12000 C:\WINDOWS\system32\MSASN1.dll CRYPT32.dll 0x761B0000 0x93000 C:\WINDOWS\system32\CRYPT32.dll IMM32.DLL 0x76290000 0x1D000 C:\WINDOWS\system32\IMM32.DLL cscdll.dll 0x76520000 0x1D000 C:\WINDOWS\system32\cscdll.dll cryptdll.dll 0x766E0000 0xC000 C:\WINDOWS\system32\cryptdll.dll NTDSAPI.DLL 0x766F0000 0x14000 C:\WINDOWS\system32\NTDSAPI.DLL USERENV.dll 0x76920000 0xC2000 C:\WINDOWS\system32\USERENV.dll ATL.DLL 0x76A80000 0x18000 C:\WINDOWS\system32\ATL.DLL WINMM.dll 0x76AA0000 0x2D000 C:\WINDOWS\system32\WINMM.dll sfc.dll 0x76B10000 0x5000 C:\WINDOWS\system32\sfc.dll SHSVCS.dll 0x76B40000 0x23000 C:\WINDOWS\system32\SHSVCS.dll PSAPI.DLL 0x76B70000 0xB000 C:\WINDOWS\system32\PSAPI.DLL credui.dll 0x76B80000 0x2E000 C:\WINDOWS\system32\credui.dll WINTRUST.dll 0x76BB0000 0x2B000 C:\WINDOWS\system32\WINTRUST.dll sfc_os.dll 0x76BE0000 0x2B000 C:\WINDOWS\system32\sfc_os.dll imagehlp.dll 0x76C10000 0x28000 C:\WINDOWS\system32\imagehlp.dll MPRAPI.dll 0x76CD0000 0x19000 C:\WINDOWS\system32\MPRAPI.dll iphlpapi.dll 0x76CF0000 0x1A000 C:\WINDOWS\system32\iphlpapi.dll adsldpc.dll 0x76DC0000 0x28000 C:\WINDOWS\system32\adsldpc.dll ACTIVEDS.dll 0x76DF0000 0x34000 C:\WINDOWS\system32\ACTIVEDS.dll rtutils.dll 0x76E30000 0xC000 C:\WINDOWS\system32\rtutils.dll DNSAPI.dll 0x76ED0000 0x2A000 C:\WINDOWS\system32\DNSAPI.dll WTSAPI32.dll 0x76F00000 0x8000 C:\WINDOWS\system32\WTSAPI32.dll WLDAP32.dll 0x76F10000 0x2E000 C:\WINDOWS\system32\WLDAP32.dll Secur32.dll 0x76F50000 0x13000 C:\WINDOWS\system32\Secur32.dll winrnr.dll 0x76F70000 0x7000 C:\WINDOWS\System32\winrnr.dll rasadhlp.dll 0x76F80000 0x5000 C:\WINDOWS\system32\rasadhlp.dll COMRes.dll 0x77010000 0xC6000 C:\WINDOWS\system32\COMRes.dll SETUPAPI.dll 0x770E0000 0x108000 C:\WINDOWS\system32\SETUPAPI.dll WINSTA.dll 0x771F0000 0x11000 C:\WINDOWS\system32\WINSTA.dll USER32.dll 0x77380000 0x91000 C:\WINDOWS\system32\USER32.dll Comctl32.dll 0x77420000 0x103000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55\Comctl32.dll COMCTL32.dll 0x77530000 0x97000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_5.82.3790.3959_x-ww_78FCF8D0\COMCTL32.dll ole32.dll 0x77670000 0x139000 C:\WINDOWS\system32\ole32.dll CLBCatQ.DLL 0x777B0000 0x83000 C:\WINDOWS\system32\CLBCatQ.DLL REGAPI.dll 0x77910000 0x11000 C:\WINDOWS\system32\REGAPI.dll VERSION.dll 0x77B90000 0x8000 C:\WINDOWS\system32\VERSION.dll msvcrt.dll 0x77BA0000 0x5A000 C:\WINDOWS\system32\msvcrt.dll GDI32.dll 0x77C00000 0x48000 C:\WINDOWS\system32\GDI32.dll RPCRT4.dll 0x77C50000 0x9F000 C:\WINDOWS\system32\RPCRT4.dll OLEAUT32.dll 0x77D00000 0x8B000 C:\WINDOWS\system32\OLEAUT32.dll SHLWAPI.dll 0x77DA0000 0x52000 C:\WINDOWS\system32\SHLWAPI.dll NTMARTA.DLL 0x77E00000 0x21000 C:\WINDOWS\system32\NTMARTA.DLL kernel32.dll 0x77E40000 0x102000 C:\WINDOWS\system32\kernel32.dll ADVAPI32.dll 0x77F50000 0x9B000 C:\WINDOWS\system32\ADVAPI32.dll ntdll.dll 0x7C800000 0xC0000 C:\WINDOWS\system32\ntdll.dll shell32.dll 0x7C8D0000 0x7FF000 C:\WINDOWS\system32\shell32.dll SAMLIB.dll 0x7E020000 0xF000 C:\WINDOWS\system32\SAMLIB.dll The Event: ======= Sequence: 555880 Date & Time: 05.09.2008 10:08:40 Event Class: File System Operation: SetBasicInformationFile Result: SUCCESS Path: C:\Documents and Settings\%username%\Application Data\<path to folder> TID: 34504 Duration: 0.0000461 CreationTime: 01.01.1601 02:00:00 LastAccessTime: 01.01.1601 02:00:00 LastWriteTime: 01.01.1601 02:00:00 ChangeTime: 01.01.1601 02:00:00 FileAttributes: RN

We have a problem with roaming profiles copied during logon. We experience that winlogon.exe copies files and folders from the profile-share and sets the "Read-Only"-attribute on the folders through the "SetBasicInformationFile"-operation. An application we use checks for this attribute and quits if found. If we copy files from the profile-share manually from a logged in session, the attribute is not set. The share is on Samba (version 3.0.21b). The Archive-attribute is set on the files on the share. Why does winlogon.exe set the "Read-Only"-attribute ® at logon? Any input is appreciated

We have a strange problem: If a user who is not member of "Domain Users" tries to print the font "Times New Roman" disappears. Other fonts appears fine. The printer is a part of the domain. The user is member of a global group we have created and is not member of any other group. The created group is not member of any other group either. Using printer Xerox Phaser 5400 with the lates PS driver. Have tried with a PCL driver with same kind of problem. Have anyone experienced anything like this before?

I use Active Desktop through Group Policy to import the Wallpaper.

We have a profile at a remote location, a background stored at another location and a guest account for the users to login (which we have set several settings to secure the account). Sometimes, especially after reboot, 90 % of the screen is black and only the top of the background is shown on top of the screen. If we refresh the screen (by pressing F5), the whole background gets visible. Have anyone experienced anything like this?