graysky

Thanks for the suggestions guys. I dunno what I did to fix it, but <knocking on wood> it seems to be better now. I may have been a function of a low vcore on the machine but I can't prove it.

Thanks... tried it but still no help... it only writes a log on a successful boot. What happens is on a cold boot it locks up on the loading windows screen. The little blue bars just stop, no response from the keyboard, etc. I have to hit reset. The second time up, it goes into windows just fine. It doesn't write a log unless it successfully gets past the part where it hangs up.

Is there a switch in the winnt.sif or unattend.txt or elsewhere that would prevent windows from loading a RAID/AHCI driver? I've been using the same unattended CD that I've built up years ago on my new Asus P5B-Del/Intel Q6600 based machine. Long story short, I cannot get the driver for the onboard AHCI driver to work. I've tried both the floppy disk/F6 method and the method Intel recommends (copy the files over to <SystemRoot>:\i386\$OEM$\Textmode as well as add lines to UNATTEND.TXT What happens is it sees the drives okay and allows me to select a partition to install the O/S, but hangs up on the "copying files" stage telling me it can't read iaStor.sys and I can either retry or skip. If I use a non unattended CD slipstreamed w/ SP2 it doesn't hang at this step which makes me think there has to be some switch in my files that prevents this. Anyone? Thanks!

For some odd reason, WinXP started hanging on boot (on "Starting XP" screen). It seems to do it on a cold boot regularly now that I added a new keyboard (natural USB) but I could be mistaken. If I hit reset it usually works the 2nd time. Anyway, I'm wondering windows logs the bootup to a file I can look at to see where it got locked? Something similar to /var/log/dmesg in the LINUX world? Thanks.

@twig: not at all. It was really starting to get on my nerves. There is only hit-or-miss info out there with no definitive answer... is your system still doing it?

Finally fixed this by reinstalling the o/s... Knocking on wood that it doesn't return. Must be a microsoft "feature"

More information. When I check in my event viewer>security I get: failure audit logged just when I tried to log-back in after a lockout: Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: myuseraccount Source Workstation: myPCNAME Error Code: 0xC000006A For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Here is the info from that url: Details Product: Windows Operating System ID: 680 Source: Security Version: 5.2 Symbolic Name: SE_AUDITID_ACCOUNT_LOGON Message: Logon attempt by: %1 Logon account: %2 Source Workstation: %3 Error Code: %4 Explanation A set of credentials was passed to the authentication system on this computer either by a local process or by a remote process or user. Success or failure is displayed in the message. If this event indicates success, then the credentials presented were valid. The error code is 0x0 for success messages. For failure messages, the user field in the message header displays NT AUTHORITY\SYSTEM, and an NTStatus code is displayed. The following is a list of the most common failure status codes and their meanings. NT Status Code Meaning 0xC000006A An incorrect password was supplied. 0xC000006F The account is not allowed to log on at this time. 0xC0000064 The account does not exist. 0xC0000070 The account is not allowed to log on from this computer. 0xC0000071 The password has expired. 0xC0000072 The account is disabled. User Action No user action is required. Version: 5.0 Symbolic Name: SE_AUDITID_ACCOUNT_LOGON Message: Logon attempt by: %1 Logon account: %2 Source Workstation: %3 Error Code: %4 Explanation A set of credentials was passed to the authentication system on this computer either by a local process or by a remote process or user. Success or failure is displayed in the message. If this event indicates success, then the credentials presented were valid. The error code is 0x0 for success messages. For failure messages, the user field in the message header displays NT AUTHORITY\SYSTEM, and an NTStatus code is displayed. The following is a list of the most common failure status codes and their meanings. NT Status Code Meaning 0xC000006A An incorrect password was supplied. 0xC000006F The account is not allowed to log on at this time. 0xC0000064 The account does not exist. 0xC0000070 The account is not allowed to log on from this computer. 0xC0000071 The password has expired. 0xC0000072 The account is disabled. User Action No user action is required. -------------------------------------------------------------------------------- Related Knowledge Base articles You can find additional information on this topic in the following Microsoft Knowledge Base articles: • Microsoft Security Center Find information, answers to your questions, instructions, the latest downloads, and more on the Blaster worm. • Failure Events Are Logged When the Welcome Screen Is Enabled With the welcome screen and logon/logoff and/or account logon success and failure auditing are enabled, pairs of Logon/Logoff failure or Account Logon failure audits with successful logon audit entries are added to the computer security log. The... • A message stating that an instance of SQL Server is vulnerable to virus attacks is logged in the application event log when you install SQL Server 2000 or MSDE 2000 on a computer that is running Windows XP Service Pack 2 When you install SQL Server 2000 SP2 or MSDE 2000 SP2 or earlier versions on computers that are running Windows XP SP2, you must install the latest SQL Server 2000 service pack or the latest MSDE 2000 service pack to help protect your computer.

I have no idea what that is... so I think the answer is, no

I've been looking around in the ms kb but I'm out of fuel on this issue. Anyone have any ideas?

I've been googling around on this and found this link: http://techrepublic.com.com/5208-11184-0.h...threadID=169167 Unfortunately, there isn't a solution there either.

I'm wrong, it just did it to me with nothing connected

Yeah, there's definitely something to having a USB flash drive connected. Usually run either speedfan or rightmark cpu monitor, both of which write log files. Whenever either of these is actively logging (log writes to the USB drive) and windows gets logged out, this happens: -can't use ctrl+alt+del to invoke the administrator account -windows refuses passwords to accounts @twig: does your occur with a usb device plugged in?

No on both both for me too... it seems to do this when I have a USB flash drive plugged into the machine but I can't be sure since it hasn't done it in a while and I've been careful about keeping the flash drive unplugged when not logged in... @twig: you have a usb device plugged in?

Man, this problem is annoying! Anyone have any thoughts? Thanks!

@ponch - both users are using the default keyboard layout @twig - yeah, this does suck Hopefully someone in here will have a solution; I have looked on google a about 30 minutes with no luck... you have tried?

I have two user accounts on this XP Pro SP2 machine (2 not counting the built-in administrator account). When both users are logged in and the welcome screen is presented, neither user can log back into the O/S. This only happens if one user account has "switched users" AND the other user logged in and allowed Windows to auto log out. Does that make sense? When I try to log back in to either account, Windows just reports that the password entered is invalid. It's not true, I'm typing it correctly (no caps, etc.) I can't do the ctrl+alt+del several times to get the old style login box to come in as administrator; it just doesn't work. I can tell windows to shutdown/restart but it ALWAYS hangs and only displays a black underline cursor. Anyone seen this before?

This is exactly what I need. Thanks!

I seem to have quite a bit of HD activity when idle. I've closed pretty much everything but the OS and services. Does anyone know of a piece of software that can monitor HD activity and potentially even show the exes that are reading/writing to disc? Something akin to process explorer for HD activity would be great. Thanks for your suggestions all.

Thanks for the replies all. I logged in as admin and disabled power management (it's odd because my user is a PC admin as well) but that did the trick!

Anyone else experienced this? The machine just enters PS mode and freezes in the process. All I can see on the screen is, "preparing to go to stand by..." It doesn't hard lock because I can move the mouse, but I cannot abort it or interact beyond just moving the mouse. The only way to recover is to reboot and lose data in the process. Power savings is disabled by the way. Could this be the sign of some sort of hardware failure? Thanks for any advice.

Is there an easy method to change a profile name? I reinstalled XP on top of an old XP install without nuking the partition first. The installer wiped out the c:\windows okay, but it didn't touch the user space in c:\documents and settings. Long story short, I now have a c:\documents and settings\username.pc name that I'd like to rename without messing up the profile for that user. Is there a utility to do this or is it as simple as renaming that dir from another user account? Thanks all!

I got the new client, but unfortunately I can't install it on the machine since I don't have admin rights. I tried installing it on another machine and copying the mstsc.exe and dll out of the windows dir but it can't run like that A related question: Is there anyway I can manually install this (i.e. copy files from the archive somewhere?)

Thanks for the link. Is the screenshot below depicting what you're referring to as the "client"? If so I can't find any menus in it at all and have no idea what version I'm running Thanks.

Yeah, I know that... I was trying to make it known that there seems to be a difference between when it locks the workstation and when a users locks it: when the user locks it, I can get in via remote desktop. When it locks it, I cannot. Thanks for the advice, I'll check it out on monday when I'm back in the office. I'm not sure what version it's running. Both machines are WinXP SP2. How can I get it to display a version number?

I originally posted here describing this odd problem with remote desktop. What happens is when I remote desktop into the target machine, everything works fine until I close the session which locks the target machine's screen. If I use the machine locally after going in through remote desktop, and then later in the day, try to get in remotely again, I cannot - I am presented with a login screen through remote desktop and I enter my password but after clicking OK, nothing happens. I cannot connect via remote desktop or via VNC when the machine is in this state. I can get in just fine from the local keyboard and if I leave the machine unlocked, I can get in through VNC, but never again with remote desktop until I reboot. Somehow, the way remote desktop is locking the screen also locks out VNC connections. If I try to hit the "locked" box with VNC, I just get a black screen that I'm unable to unlock it through VNC. If I reboot and never use remote desktop, VNC works flawlessly and I can lock/unlock with no problems. Some how when I log out with remote desktop it is "super locking" the machine such that the only way I can get back in is from the local keyboard. The final piece of info that doesn't make any sense to me is this: if I reboot the target machine AND I don't use it from the local keyboard at all, I can get in and out many times with remote desktop. This "super locked" state only happens once I use the machine from the local keyboard and then from remote desktop. Does anyone have any thoughts on this perplexing behavior?