[solved] xp sp3 install issues - Tech-101 Free Computer Support

jobeard · #1 (**permalink**) 03-09-2010, 02:03 AM

Symptom: Fast User Switch -> logoff ->change user
click any other user than current & enter correct password

Starts to load user preferences & stalls,
hd flashes three times with long pause between and then
the list of all users is shown again.

Only user choice that then works is the original

event log shows

1) Event ID 1001 fault bucket 735336636

2) Event ID 1004 Faulting application winlogon.exe, version 0.0.0.0,
faulting module ntdll.dll fault address 0x0006478e

Blind Dragon · #2 (**permalink**) 03-09-2010, 10:23 AM

So system has xp sp2 and is being upgraded to sp3? Or did error occur after installing sp3?

I keep coming back to this page:
http://support.microsoft.com/kb/828664

jobeard · #3 (**permalink**) 03-09-2010, 11:05 AM

took forever but went very well ... up to a point.

1) "Error on copy of Winspool.DR_" continue or quit

I continued and there were no further errors.
I found the Print Spool Driver (Winspool.DR_) and manually expanded it into the system\ and system32\ dirs where the originals were located

2) During the Final Cleanup (which ran for >30minutes) there was a loop pattern detected using the TaskMgr.
Several minutes of 1-2% cpu followed by a stair-step CPU graph up to 100% and then an abrupt fall back to 1-2%

No choice but had to use the TaskMgr->Shutdown

3) system is running fine and I'm able to get some 41 subsequent updates
loaded via update.microsoft.com->Custom

All user ids can be used and Run As works to access any->anyother;
just fast-user-switch fails.

I'll check out that reference KB and get back ...

TIA.

Blind Dragon · #4 (**permalink**) 03-09-2010, 11:11 AM

The reason I kept thinking that KB was relevant is because -> Fast User Switching Compatibility service depends on TermService (which may be non-existent)

Source: http://technet.microsoft.com/en-us/l...8WS.10%29.aspx

jobeard · #5 (**permalink**) 03-09-2010, 11:18 AM

well, the Fault Bucket fits, but nothing else described therein does :sadly:

I can't see User Profile data being the issue as all users can login, so
ntuser.dat files are ok

I'm surfing for issues re NTDLL.DLL, the failing code

jobeard · #6 (**permalink**) 03-09-2010, 12:13 PM

Quote:

Originally Posted by Blind Dragon

The reason I kept thinking that KB was relevant is because -> Fast User Switching Compatibility service depends on TermService (which may be non-existent)

Source: http://technet.microsoft.com/en-us/l...8WS.10%29.aspx

that's correct, but TS is running w/o any event log entries ....

OOPS; just found this

Event Type: Error
Event Source: TermService
Event Category: None
Event ID: 1036
Date: 3/9/2010
Time: 8:46:56 AM
User: N/A
Computer: LTBEARD
Description:
Terminal Server session creation failed. The relevant status code was 0x102.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

but MS (no so) help(ful) says

Details
ID: 1036
Source: TermService

We're sorry
There is no additional information about this issue in the Error and Event Log Messages or Knowledge Base databases

At least that something else to research

thanks

Blind Dragon · #7 (**permalink**) 03-09-2010, 12:52 PM

Just had another thought - how much RAM is on this system?

Could it be possible that by using fast user switching the available RAM would drop below the 120mb threshold?

=======================

Another thought - Maybe User1 profile isn't releasing certain registry keys for User2 to pick up.
To check that you could try User Profile Hive Cleanup

*the service monitors for logged off users that still have registry hives loaded. When that happens the service determines which application have handles opened to the hives and releases them. It logs the application name and what registry keys were left open. After this the system finishes unloading the profile.

=============================

You could try increasing Virtual Memory. The minimum should be 1/2 installed RAM for each Fast User Switched user. When you "switch", the original user settings, etc are stored into the pagefile for use when you switch back.

jobeard · #8 (**permalink**) 03-09-2010, 03:12 PM

After some searching, there were comments on Remote Desktop

$ netstat -a -o | egrep 3389
TCP ltbeard:3389 0.0.0.0:0 LISTENING 1324

3389 is the RDP port number and
1324 is the PID of the process using it

$ tasklist /svc | egrep 1324
svchost.exe 1324 DcomLaunch, TermService

(that egrep is a linux or cygwin tool; windows users will just have to eyeball or redirect to a file and view the results with notepad)

The above shows RDP (actually TermService) is active so it's not a service issue.

Yet TermService failed??? hmm; I run a tight firewall config (Sunbird PF4 ~ like Comodo) and I began to wonder ... what if the default deny rule was stopping the connection?

I added a rule like

Code:

allow in/out tcp (localLanIp) port 3389

Attempting secondary user login now

loads the user settings
chimes
shows the users configured wallpaper

but fails to show desktop icons or

to launch the Explorer

eventvwr shows

Event Type: Error
Event Source: TermDD
Event Category: None
Event ID: 50
Date: 3/9/2010
Time: 9:34:32 AM
User: N/A
Computer: LTBEARD
Description:
The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 0a 00 02 00 58 00 ......X.
0008: 00 00 00 00 32 00 0a c0 ....2..À
0010: 00 00 00 00 32 00 0a c0 ....2..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 0b 00 00 00 75 73 65 72 ....user
0030: 0d 0a ..

event id 50 TermDD rdp x.224
=====
There have been 3 basic causes for your error:

1. Encryption levels defined on the RDP-TCP connection (or ICA, if appropriate), are set too high for the client to successfully negotiate.
For example, a client set to Low encryption would be unable to connect to a server with High (or now, FIPS compliant) encryption levels defined.
Additionally, XP and XP SP1 clients are currently unable to connect at all if "FIPS compliant" encryption level is set (article in progress on this issue).

To check this, open Terminal Services Configuration (tscc.msc) on the Terminal Server,
select the RDP-Tcp connection, select properties, and view the Encryption settings on the General tab.
Verify that this is set to Client Compatible, or low, and retest the connection (if needed).

2. Another frequent cause of these problems stems from issues with some registry values in the TermService\Parameters registry key.
To this end, could you export the following key: HKLM\System\CurrentControlSet\Services\TermService s\Parameters

After doing this, delete the Certificate, X509 Certificate, and X509 Certificate ID values, and restart the Terminal Server.
These values should be regenerated on reboot (but keep the Exported values just in case).
The X509 Certificate and X509 Certificate ID values have also been known to cause this problem, so delete them as well.
In 9 out of 10 cases this resolves the issue.

3. The third possibility is that some software you are installing is overwriting some of the files needed for the protocol stream.
Schannel.dll, rsaenh.dll, and several others are involved in this process.

=====
(2) fixed all Event Viewer issues
Attempting secondary user login now

loads the user settings
chimes
shows the users configured wallpaper

but fails to show desktop icons or

to launch the Explorer

but I still have

Blind Dragon · #9 (**permalink**) 03-09-2010, 03:18 PM

Wow - what about Run prompt -> explorer.exe

Just curious if that would in fact launch explorer + icons - or would it force another error

jobeard · #10 (**permalink**) 03-09-2010, 03:52 PM

no Taskbar or start button; just an empty desktop with the wallpaper ...
<ctl-alt-del> gets the taskmgr and the only choice there is logoff

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode