Occasional hang on boot before login

[Net Man]

Long time reader - first time poster.

We have approx 250 XP pro machines connected (2 per site) to corporate via T1 WAN link. The machines are rebooted daily (we run some really badly written software that needs the daily housekeeping!) When the WAN link is slow and the machines get rebooted, the computers hang before displaying the logon screen.

This has been an issue for a little over 6 months. (Coincided with a big bandwidth web app being deployed over the WAN) I have added the /SOS option to the boot.ini file. The machines get through loading the drivers but display the OS version/SP level but never shows the logon box.

I'm not sure if the hang is due to inability to see the WAN (should logon using cache though...) Not having the splash screen lets us see all the drivers are being loaded properly. Event viewer logs a shutdown of the event service then a restart when the machine is power cycled.

When it's hung, it does not respond to ping (I don't think we've tried Control-alt-delete yet... I'll do that next lockup <G>) We have an APC web enabled power strip we use to reset them once hung since the machines are in a locked rack at each remote location.

My question is this - what can I do to enable more logging to find out what's going on? Does anyone know what I can check? Where to look?

I'm kinda at a loss and appreciate ANY help. Sorry for the long-winded email, but I wanted to be as through as possible.

Thanks.

[Net Man]

Anyone have any ideas? I'm not looking for a miracle fix but if someone know a way to at least turn on more logging, that would be wonderful.

[cluberti]

Hmmm - so they get all the way to the background, but the winlogon dialog box doesn't appear. It almost sounds like the network stack didn't come up, but the winlogon box should display regardless of this unless there's some blocking going on here.

If you've got the ability to send keystrokes via PS2 emulation to the machines, I'd say getting a complete dump of one of them when the problem occurs would be a good next step, as a dump might tell us what's happening in the kernel and in usermode when the box hangs up like that.

[Net Man]

Thanks for the reply.

Hmmm - so they get all the way to the background, but the winlogon dialog box doesn't appear. It almost sounds like the network stack didn't come up, but the winlogon box should display regardless of this unless there's some blocking going on here.

Exactly. No logon box. Before we turned on /SOS, the animated scroll bar would simply stop before the screen would display the login window. Adding the /SOS, it now goes to from text mode to graphics mode but hangs on the blue backgroud with the O/S build infomation.

If you've got the ability to send keystrokes via PS2 emulation to the machines, I'd say getting a complete dump of one of them when the problem occurs would be a good next step, as a dump might tell us what's happening in the kernel and in usermode when the box hangs up like that.

I can create the registry keys from here to enable debugging. Will it create any problems to enable the dump feature on all computers (even ones that don't hang) or should this only be done on a few workstations?

Thanks again for your help.

[cluberti]

I can create the registry keys from here to enable debugging. Will it create any problems to enable the dump feature on all computers (even ones that don't hang) or should this only be done on a few workstations?

I'd create them only on machines you'll actually be testing on.

[donpedroso]

Hi!

Have anyone found a solution to this problem?

I have the same issue - occasionaly Win Xp just hangs on startup (where te progressbar moves around). Then it's necessary to hard reset the PC and try again - sometimes it takes couple of retires, sometimes 10.

Couple of times I have used Rescure disc to reinstall Windows - that usually helps for some time, butthen problem comes back.

I have started to wonder if Symantec Norton 360 has something to do with it - maybe that starts early enough to ruin things?

[cluberti]

Startup is roughly kernel and smss/system process, splash screen, loading drivers (boot then other device and service drivers), loading critical services, then background wallpaper/color shows, load more services and modules/exes, display winlogon dialog box, finish loading things in background (startup items from registry, delayed services, etc).

That's why /SOS is helpful, but only if you know how to read it and have an idea of "what comes next", as the last thing displayed is not always what isn't working .

[Net Man]

I do have some sort of update on this... I turned on boot logging on all locations. However, it did not give any additional info. I compared a recent lock-up to a normal boot and there were no differences.

What we did was ask approx 1/3 of the users to reboot in the afternoon instead of morning. (We have a VERY leaky app that almost requires a daily reboot... Believe me - I don't like it either <grin>) This made our situation MUCH better. '

So, here is my theory to what happens if anyone can share their thoughts...

XP BOOT START

load kernel & drivers

start network

discover/connect to domain controller

notify Domain Controllers we are online

display wallpaper/desktop

start login process/control-alt-delete

For us, I feel the communication is being interrupted during the discover/connect to domain controller. XP is waiting for some type of confirmation from the DC which never comes and causes a lockup.

Any experts care to share their thoughts?

[Net Man]

I have started to wonder if Symantec Norton 360 has something to do with it - maybe that starts early enough to ruin things?

Can you disable the Norton services to see if that's blocking network traffic?

[donpedroso]

Now I did have a longer streak of failures - more than 5 retries

Here are some logs:

WindowsUpdateCrash.txt

ntbtlog.txt

Would be grateful if someone managed to understand them.

(Seems that it was about bad Windows upgrade)