locked
User Logged Out When Logging On RRS feed

  • Question

  • I hope this is a suitable forum to ask this.  I have a strange issue that I'm not sure how to troubleshoot and hope for some advice.

    I have a desktop SOE built using ConfigMgr OSD and its all working well.  On laptops however, on the first logon for the day the users are being immediately logged back off.  If they then log back on, no problem.  It seems to happen when they have logged off the previous evening, but left their computers turned on.  They wake the machine up, log on, and are immediately logged back off.  This doesn't happen if they don't log out at night (the machine still sleeps).

    I can reproduce the problem with many user accounts, so it is not a single user issue.  I can't reproduce the issue by putting the machine to sleep or hibernate manually.

    There are no obvious event log entries that seem relevant.  The workstations, that get the same default settings and group policies and are built from the same Task Sequence, don't seem to have this issue.

    Where do I start in trying to solve this?  I'm stumped.  I'll open a call with Microsoft if I need to.

     

    Tuesday, May 11, 2010 12:26 AM

Answers

All replies

  • Hi,

     

    I would like to suggest you update the BIOS and the hardware drivers first.

     

    If this computer was joined in the domain, you may try to quit the domain to test the issue.

     

    If it does not work, please also test the issue in Safe Mode and Clean Boot.

     

    What are the results?

     

    Regards,


    Arthur Li - MSFT
    Wednesday, May 12, 2010 3:24 AM
  • Thanks Arthur.

    I've already gone down the driver route and can rule them out, or at least the latest versions HP has posted.

    I've updated the BIOS today, a new one was recently released for the particular hardware (HP 6930p).  I'll see what happens tonight.

    Yes - the machine is domain joined.  I will set up a test out of the domain.  I'll also try Safe Mode and Clean Boot.

    The issue can't be reproduced after a reboot or by manaully putting the machine to sleep. I have to log on, log off, then leave the machine overnight, so testing is taking ages.

    I'll update the thread as I work through the tests.

    I guess that since I can reproduce it easily enough that I'll be able to solve this.  Its just a matter of elimination.

    Cheers.

    Thursday, May 13, 2010 7:53 AM
  • Why is this marked as answered?  I've unmarked it as it isn't answered at all and it is silly that folks do this on these forumns ... I've noticed this habit before.

    Anyway, that is my rant.

    Now, on the topic of this issue, I have opened a case with Microsoft after going through all of the above troubleshooting.

    - All drivers and firmware updated and still have the issue

    - On a non-domain machine built manually and not with OSD, I don't have the issue

    - Safe mode, didn't get the issue, but I'm not sure the test I did was valid and should have redone it, but now with a case open with MS I will follow their plan.

    - Microsoft is now collecting various logs and other details about the machine to help find a solution

    I will report back as things progress.

    Friday, May 21, 2010 12:07 AM
  • I am seeing this same problem too.  I've got several different Dell models in the labs I maintain and have encountered this problem with both Windows 7 Enterprise's x86 and x64 versions.  I've tried using the Windows 7-provided drivers straight out-of-the-box and also the most current drivers I can find.  No difference.

    I've only seen this problem show up when the computer is asleep for an extended period of time, at least several hours.  It doesn't always happen every time the computer has been asleep for an extended period, which is making this problem very hard to troubleshoot.

    Saturday, May 22, 2010 8:34 PM
  • This is interesting news .... at least I'm not on my own :-)

    The support engineer I'm working with at Microsoft hasn't found anything in their internal DBs or support forums on this, so we are working through manually building up a machine and installing software and configurations 'one by one'.  Because testing is so hard (time) this might take a while.  He is also talking to the product team.

    I'll update here when I know more.

    BTW - all my machines are HP machines and I'm only using 32bit W7.

    Interestingly, I also have a colleague with a W2K8R2 machine (stand-alone not in a domain) that seems to have a similar problem.  It is in a ESX environment, but it doesn't sleep at all, and this issue happens to everyone who hits it via RDP except the first person to log on, and unlike the laptops, multiple attemps to log on don't work.  I'm reluctant to say its exactly the same issue, but it is interesting.

     

    Monday, May 24, 2010 12:45 AM
  • @jsc.19:
    When I was looking, I also found some people having this type of problem via RDP with immediate logon then logoff, after which it would let them logon normally.  For those people it appeared that there was a problem with the Desktop Window Manager exiting, possibly because it was trying to do the Aero effects over RDP which Remote Desktop doesn't support.

    I looked through my logs and while I did see some mentions of DWM exiting or complaining about composited themes, there didn't seem to be a relationship between when these error messages showed up in the logs and when my computer went to sleep, woke up, or when I tried logging in.

    I spent a lot of time trying to diagnose things with drivers one-by-one and had no luck.  I'm kind of dubious about the DWM issue to begin with because my understanding is that it is primarily to support Aero effects.  One of my platforms, the Optiplex 170L, has an old Intel 845G chipset that only has XPDM drivers and doesn't support Aero to begin with.

    Monday, May 24, 2010 3:21 PM
  • Just an update.  The case is still progressing with Microsoft.  Its a slow process due to the time that has to elapse to reproduce the issue.  They are currently looking at winlogon.exe and trying to capture some logging around this process.
    Tuesday, June 1, 2010 2:52 AM
  • Just another update because its been a while.  This case is still with Microsoft and we don't have a solution yet.  Another customer has reported the same issue and the same senior engineer has both cases.  Microsoft has been giving me plenty of love, we just haven't been able to find the root cause.  I'll update when I know more.
    Friday, June 18, 2010 1:39 AM
  • I had the same issue and it was a group policy issue on the domain.

    The reason I say this is that if I make the user a "power user" then they can login without any issues. Change them back to Stantard user and as soon as they login, they get logged out.

    Obvioulsy to me, this points to some security/rights issue.

    Anyway, we havent had time to go through the group policies (to prove it was that), so we left the user as a power user and this works fine for our environment. They are still restricted enough.

    Robert

    Monday, June 21, 2010 1:01 AM
  • We have the same issue.  I posted about it on this thread.

    http://social.technet.microsoft.com/Forums/en-US/w7itprogeneral/thread/f8aff1ea-49eb-4fbd-bb06-9b4514a79d73

    This is happening to both admins and non-admins in our environment so giving elevated rights doesn't seem to matter.  To me, it almost seems like the computer is trying to re-establish network connectivity after waking up from sleep or hibernate mode.  Hopefully someone comes up with something on this issue because it seems like an issue that will be creeping up more and more and people migrate to 7.

    Monday, June 21, 2010 1:27 PM
  • Just for the sake of information: We have two customers with the exact same problem. One of the customers opened a support case with Microsoft, but it was never solved.

    I read somewhere on another forum that the cause can be group policies controlling screensavers and/or password when waking up from sleep being applied to both user- and computer at the same time. We did some testing, but found no solution.

     

    Monday, June 21, 2010 2:12 PM
  • All

    An update.  Microsoft has identified the issue.  Its a regression introduced with KB976427.  That code is also included in KB977074 and this issue can be fixed if you remove KB977074.  I assume it would also be fixed by removing KB976427, but I didn't have that installed.  My case with Microsoft is still open, and I would hope it leads to a new update to fix the problem as I need one of the fixes in KB077074 so uninstalling it really isn't a solution (but it does prove where the issue comes from).  I've submitted my business case to Microsoft for them to deal with this and am awaiting the next step.  If you have never opened a case with MS, then a business case is a routine part of getting an issue like this escalated to the product team, its an interesting process, but in my experiance, now they have found the cause of the problem, they will address it.

    I'll post more when I have more.

    James.

     

     

    • Proposed as answer by kubasa Friday, June 25, 2010 3:00 PM
    Friday, June 25, 2010 9:06 AM
  • Opening a case with Microsoft can be very time consuming so I appreciate you sharing what was discovered!
    Friday, June 25, 2010 1:52 PM
  • Thanks for the update, James.  I have KB977074 installed on my machines.  I don't have the time to test removing it right now, but willl try to do so in the next couple days.  I'll report back with what I find.
    Friday, June 25, 2010 6:38 PM
  • I tested out what James mentioned and it completely solved our issue.  I added the uninstall to our image job, re-imaged 4 computers, let them completely finish installing and go into sleep mode.  After they were asleep, I logged in once instead of having to login twice.  Our server admin has setup an uninstall job in WSUS to remove KB977074 so we should be set.  One thing to check off our W7 migration problem list.....
    Friday, June 25, 2010 7:04 PM
  • Uninstalling KB977074 appears to solve the problem for me.
    Wednesday, July 14, 2010 12:01 AM
  • Great news.   We also have this problem (50% of logons right after the first resume from sleep after the last reboot).   We've had a case open with Microsoft for 4 weeks on this and another logon problem after sleep, but they haven't suggested removing KB977074, which I will try today.

    Thanks for sharing your information.

    Wednesday, July 14, 2010 12:03 PM
  • There's always process monitor.  Here's a case of slow logins troubleshooted by Mark:

    http://blogs.technet.com/b/markrussinovich/archive/2010/01/13/3305263.aspx

     

    Wednesday, July 14, 2010 2:43 PM
  • We just completed some testing in a classroom and it seems removing KB977074 is a wonderful thing to do!

    Prior to doing that, the login attempt after resume yesterday was:

    -          20 successful first try

    -          21 logged on, forced off in 3 seconds, then logged on ok

    -          4 invalid userid or password first time, logged on ok second try

    -          5 temporary profile (the network was up for logon, then went down and loading the roaming profile timed out)

    -          2 errors getting to desktop (these resolved as soon as user clicks on dialog to troubleshoot the problem).

    Today with the only change was to remove 977074:

    - 44 Logon first time, no problems

    - 1 temp profile

    Our other problem with our MIT Kerberos realm being invalidated when Kerberos.dll goes to get the SRV records for the KDCNames and the network is not up seems to be fixed or helped by setting the Kerberos parameter FarKdcTimeout=1.  See http://support.microsoft.com/kb/837361 for information on those settings.

    Wednesday, July 14, 2010 3:07 PM
  • Thank you, James, for taking the time to post this information.  I had exactly this problem.  I removed KB077074 a few days ago and the problem has been completely eliminated!

    Bill

    Wednesday, July 14, 2010 3:23 PM
  • James,

     

    Thanks for working with Microsoft Support on this. Did they indicate if/when they would have a patch for this issue?

    Wednesday, July 14, 2010 4:00 PM
  • Thanks! I removed KB977074 using SCE/WSUS and the issue has been resolved. phew!

     

    -Jonathan King

    Thursday, July 15, 2010 12:32 AM
  • Hi Matt

    I have been told I should have a test version of an update this week, MS is finalising regression testing internatlly.  My week is running out here in Australia, but either way, it must be close.

    FYI

    James.

    Friday, July 16, 2010 1:35 AM
  • Great! Thanks for the update James!
    Monday, July 19, 2010 6:55 PM
  • Just wondering if anyone knew if MS had a final patch solution yet for this issue.  We have been faced with this problem in 2 lab areas however I have a questions.  We have many other systems that have this update installed but they do not exhibit the problem.  Does anyone know what the "trigger" is so to speak.  I have the update on my Win7 64bit system and I never have this problem in the morning as well as most PCs on the campus.  However, I have a few computers in two areas that do have the problem.


    Thanks for any info you can provide,

    Jeff

    Wednesday, August 4, 2010 12:56 PM
  • Hi Jeff

    The patch exists but is still in internal testing at Microsoft, I was given an ETA of several weeks ago that I would have it, at least a test version, but that hasn't happened.  The support engineer at Microsoft who owns my case updates a couple of times a week letting me know he is keeping in touch with the product team and I'll post here as soon as I have something to report.

    I've seen this before.  Winlogon is an important component so they have to test thoroughly to ensure they don't introduce a new regression, so it can take time.

    Cheers

    James.

     

    Thursday, August 5, 2010 12:38 AM
  • All

    Another update.  Less than an hour after posting above I received the private fix for this issue to test.  I'm doing my testing now.  I'll find out when a public fix will become available if my testing goes OK.

    FYI

    James.

     

    Thursday, August 5, 2010 1:46 AM
  • All

    Microsoft tells me the publicly available version of the fix for this issue will be available in October.  I didn't think to ask why so far away as that time works with my project so isn't a problem for me sorry.

    FYI

    James.

     

    Tuesday, August 10, 2010 5:17 AM
  • Thanks for all the info on this!  Did they tell you at all if there will be a corresponding KB or is this being handled differently?  I guess I'm curious what I should look for in October when they make it available.  Again, thanks for sharing this information!
    Tuesday, August 10, 2010 12:26 PM
  • Hi Kubasa

    Yes.  There will be a KB article also.  In the draft I have it just says "number is not defined yet" but I'll post here as soon as I know more.

    Cheers

    Wednesday, August 11, 2010 12:03 AM
  • jsc.19

    Did the private fix work?

    Any further contact from Microsoft?

    Any chance that we could get the private fix?

    Sunday, September 5, 2010 12:59 PM
  • G'day Aussie_1

    Private fix works

    MS told me October, and that fits my project so I haven't chased them hard on that.

    I can't share it, but open a case with MS.  Since it is a bug, there wouldn't be a charge.

    Cheers

    James.

    Sunday, September 5, 2010 11:52 PM
  • James,

    Thanks for the reply ... I tried opening a case ... but as you know ... Microsoft support it is a maze ... especially for a home use machine. So I couldn't get all the ducks in a row after 15 minutes of trying ... so I'll wait till Oct.

    Monday, September 6, 2010 3:50 AM
  • I'm seeing this same issue.  I looked in the latest updates released this week, and I don't see anything pertaining to it.  Did they get you a KB yet, or give you an exact date of release yet?
    Wednesday, October 13, 2010 5:45 PM
  • We are experiencing much the same and are chomping at the bit for a fix. Our deployment was experiencing the issue on a few isolated machines.  We'd apply the power settings fix, leave and rejoin the domain.  In most cases it fixed it completely, but as we expanded the Win7 deployment to more machines the problem would pop up more often and show up on machines that never had the problem before but the previous fix(es) would not help.

     

    If I do make a case with Microsoft  is there something we should be making reference to saying that there is an unpublished MS fix for it?

    Friday, October 22, 2010 2:09 PM
  • Hi All

    The hotfix is out.  Here is the KB article:

    http://support.microsoft.com/default.aspx?scid=kb;EN-US;2345131

    Cheers

    James.

    • Marked as answer by jsc.19 Monday, October 25, 2010 12:03 AM
    Sunday, October 24, 2010 10:55 PM
  • All,

    Concur the fix is out ... posting another link (for fun I guess) ...

    Request Fix333423 with the link at the top of the page, KB2345131.

    Microsoft will send you an email with the download link. 

    Download, unzip (double click the exe file), and (double) click on the msu file to apply. You will probably need the password in the email to apply the fix ... and the password expires ... so don't wait too long. Restart the system ...

    We'll see how it works ... My system took longer than normal to intialize the first time after the install.

    Monday, October 25, 2010 9:36 PM
  • The hotfix has worked for me. I haven't had a "double logon since October ...
    Monday, December 13, 2010 1:20 AM