jazzmaster Posted July 22, 2008 Share Posted July 22, 2008 (edited) Just setup new network, server = brand new Dell server with Server2003R2 , and 10 workstations, again all brand new running XPPro.Server is providing DHCP + DNS , and is also a file server. AD is installed. Network is behind a FW, Server has AV and clients have AV + software FW (AVG SBS edition)Everything works as it should, but sometimes (once in 3 weeks at most) when a user logs in to a workstation, after they enter there details and logon, the logon boxs appears then immediately logs off again (before desktop loads in). So the user has to enter login details again - and this time it logs in fine, always 100% OK the second time. So when the problem appears (as I say its very infrequent) after logging in for the second attempt always works.It happens with different usernames, and different workstations.Anyone ever experienced this?Setup is Router/Modem/FW - Switch - PCsThanks Edited July 22, 2008 by jazzmaster Link to comment Share on other sites More sharing options...
eyeball Posted July 22, 2008 Share Posted July 22, 2008 Yeah i have seen this. Were the workstations cloned? If so did you run something like newsid.exe on them after cloning?Thanks Link to comment Share on other sites More sharing options...
jazzmaster Posted July 22, 2008 Author Share Posted July 22, 2008 Hi there , thanks for reply - no the workstations were not cloned.........they were just taken out the box, installed the latest updates (to SP3), then joined them to the domain...........they are just normal HP workstations with XPPro preinstalled......... Link to comment Share on other sites More sharing options...
eyeball Posted July 22, 2008 Share Posted July 22, 2008 Does it happen in safe mode? And what happens if you leave a pc at the CTRL+ALT+DEL screen for 5 minutes before logging on?Thanks Link to comment Share on other sites More sharing options...
jazzmaster Posted July 22, 2008 Author Share Posted July 22, 2008 It will be hard to get it to do it in safe mode, as its so random, ie you would need to start every PC in safe mode until the problem occured, if you know what I mean...........RE CTRL+ALT+DEL, I have never tried that - and again the problem is so random I would never know if the "5 min wait" has affected the login or if it was a coincidence..........Its almost as if the XP machines are logging in too quickly?? maybe the sever is not processing the login request quick enough (but only sometimes?)..... Link to comment Share on other sites More sharing options...
eyeball Posted July 22, 2008 Share Posted July 22, 2008 (edited) Yeah i think a service or somthing is not getting chance to initialize, try booting up and logging on as quick as possible see if you can replicate the problem.This problem is so annoying and i cant remember for the life of me how i have fixed it in the past BTW does the event viewer log anything worth paying attention to? Edited July 22, 2008 by eyeball Link to comment Share on other sites More sharing options...
cluberti Posted July 22, 2008 Share Posted July 22, 2008 Actually, the last time I saw this problem it was the ATI drivers and winlogon hooks causing the problem. Enable process and login auditing on the domain for your workstations, and when it happens go back to the security logs to trace it back. Link to comment Share on other sites More sharing options...
jazzmaster Posted July 22, 2008 Author Share Posted July 22, 2008 Thanks again for the replys Eyeball and Cluberti.Eyeball: The event viewer hasn't been showing much of interest........yeah its really a minor inconvienience more than anything else, I get the impression the problem isn't going to get "worse".......but it happens when the Server has been on for hours, it really can happen anytime, ie the workstation may have been on for 3 hours, then I will log off and on again through all the usernames, and it may happen after the 20th logon/logoff.Cluberti - Hi there , that makes sense, all workstation has ATI vidcard/drivers - I will enable process and login auditing and trace back the security logs..........and if this is the problem update the drivers?.............although all workstations are buisness network HP PCs (dx2250 range), I would have thought tests would have been done for compatibility with server 2003(R2)........... Link to comment Share on other sites More sharing options...
cluberti Posted July 22, 2008 Share Posted July 22, 2008 Cluberti - Hi there , that makes sense, all workstation has ATI vidcard/drivers - I will enable process and login auditing and trace back the security logs..........and if this is the problem update the drivers?.............although all workstations are buisness network HP PCs (dx2250 range), I would have thought tests would have been done for compatibility with server 2003(R2)...........Actually, you would want to UNINSTALL drivers and ATI software and reinstall with the most minimal driver set possible (no supporting software, reinstall JUST DRIVERS). Link to comment Share on other sites More sharing options...
eyeball Posted July 22, 2008 Share Posted July 22, 2008 Actually, the last time I saw this problem it was the ATI drivers and winlogon hooks causing the problem. Enable process and login auditing on the domain for your workstations, and when it happens go back to the security logs to trace it back.Cluberti, can you explain/remember what was happening when you last saw it? Im genuinely interested Link to comment Share on other sites More sharing options...
cluberti Posted July 22, 2008 Share Posted July 22, 2008 Yeah, one of the ATI .dlls loaded, caused one of the ATI .exes to crash, which caused csrss to fail to load, thus causing winlogon to log the user off (which is apparently expected when this type of crash occurs). This is (one of the many reasons) why Vista / 2008 winlogon doesn't allow hooking anymore. Too many vendors doing things they shouldn't, causing crashes, and causing system instability. Link to comment Share on other sites More sharing options...
eyeball Posted July 22, 2008 Share Posted July 22, 2008 Hmm, thats interesting stuff, wonder why it works second time around and doesnt produce the same error? I wasnt aware Nt 6.0 doesnt allow winlogon hooking so thanks! Link to comment Share on other sites More sharing options...
jazzmaster Posted July 22, 2008 Author Share Posted July 22, 2008 Great advice, after doing a bit of googling after your ATI suggestion, I am now pretty sure thats the problem - and found this which I will try on Thursday and report back:http://forums.techguy.org/windows-nt-2000-...e-event-id.htmlThanks again Link to comment Share on other sites More sharing options...
jazzmaster Posted July 29, 2008 Author Share Posted July 29, 2008 Hi ThereQuick update - yes that cured the problem.......not had to logon twice since got rid of the ATI nonsense!Thanks again Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now