Winlogon.exe uses 100% CPU

  • Thread starter Thread starter Lasse
  • Start date Start date
L

Lasse

Guest
Hi

We have a Server 2003 R2 SP2 with Terminal Services that's causing some
problems. We have around 80 users using the server and each have a RDP
connection that automatically starts a program on the server.

Suddenly today the server more or less stopped responding and the only thing
I
could find was Winlogon.exe using 100% CPU time but I can't figure out WHY?
I logged off all the users and then the problem disappeared.

I suspect it might be our GPO logon script, but the only thing it does is
check if you logon to the Terminal Server and then it runs the following line:
rundll32 printui.dll,PrintUIEntry /Xs /y /n"Printername"
 
Re: Winlogon.exe uses 100% CPU

Anything errors or warnings in the EventLog on the server?
Is your spooler service running, or is it crashing and restarting
continously?
Since this problem started suddenly today, what was changed on the
server yesterday? Windows Update? Application upgrade? New printer
driver? Or maybe just a reboot, which enabled changes made earlier?

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?TGFzc2U=?= <Lasse@discussions.microsoft.com> wrote on 01
nov 2007 in microsoft.public.windows.terminal_services:

> Hi
>
> We have a Server 2003 R2 SP2 with Terminal Services that's
> causing some problems. We have around 80 users using the server
> and each have a RDP connection that automatically starts a
> program on the server.
>
> Suddenly today the server more or less stopped responding and
> the only thing I
> could find was Winlogon.exe using 100% CPU time but I can't
> figure out WHY? I logged off all the users and then the problem
> disappeared.
>
> I suspect it might be our GPO logon script, but the only thing
> it does is check if you logon to the Terminal Server and then it
> runs the following line: rundll32 printui.dll,PrintUIEntry /Xs
> /y /n"Printername"
 
Re: Winlogon.exe uses 100% CPU

Hi Vera

The only thing I get in the EventLog is this:
"Execution of GPO scripts has timed out and have been terminated."

And that event is why I suspect my GPO script for being the cause of the
problem.


"Vera Noest [MVP]" wrote:

> Anything errors or warnings in the EventLog on the server?
> Is your spooler service running, or is it crashing and restarting
> continously?
> Since this problem started suddenly today, what was changed on the
> server yesterday? Windows Update? Application upgrade? New printer
> driver? Or maybe just a reboot, which enabled changes made earlier?
>
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> ___ please respond in newsgroup, NOT by private email ___
>
> =?Utf-8?B?TGFzc2U=?= <Lasse@discussions.microsoft.com> wrote on 01
> nov 2007 in microsoft.public.windows.terminal_services:
>
> > Hi
> >
> > We have a Server 2003 R2 SP2 with Terminal Services that's
> > causing some problems. We have around 80 users using the server
> > and each have a RDP connection that automatically starts a
> > program on the server.
> >
> > Suddenly today the server more or less stopped responding and
> > the only thing I
> > could find was Winlogon.exe using 100% CPU time but I can't
> > figure out WHY? I logged off all the users and then the problem
> > disappeared.
> >
> > I suspect it might be our GPO logon script, but the only thing
> > it does is check if you logon to the Terminal Server and then it
> > runs the following line: rundll32 printui.dll,PrintUIEntry /Xs
> > /y /n"Printername"
>
 
Re: Winlogon.exe uses 100% CPU

OK, so what was changed in the script, or the way it executes?
You'll have to post the *complete* script, exactly as it is.
Have you tried to run the script interactively?

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
*----------- Please reply in newsgroup -------------*

=?Utf-8?B?TGFzc2U=?= <Lasse@discussions.microsoft.com> wrote on 02
nov 2007:

> Hi Vera
>
> The only thing I get in the EventLog is this:
> "Execution of GPO scripts has timed out and have been
> terminated."
>
> And that event is why I suspect my GPO script for being the
> cause of the problem.
>
>
> "Vera Noest [MVP]" wrote:
>
>> Anything errors or warnings in the EventLog on the server?
>> Is your spooler service running, or is it crashing and
>> restarting continously?
>> Since this problem started suddenly today, what was changed on
>> the server yesterday? Windows Update? Application upgrade? New
>> printer driver? Or maybe just a reboot, which enabled changes
>> made earlier?
>>
>> _________________________________________________________
>> Vera Noest
>> MCSE, CCEA, Microsoft MVP - Terminal Server
>> TS troubleshooting: http://ts.veranoest.net
>> ___ please respond in newsgroup, NOT by private email ___
>>
>> =?Utf-8?B?TGFzc2U=?= <Lasse@discussions.microsoft.com> wrote on
>> 01 nov 2007 in microsoft.public.windows.terminal_services:
>>
>> > Hi
>> >
>> > We have a Server 2003 R2 SP2 with Terminal Services that's
>> > causing some problems. We have around 80 users using the
>> > server and each have a RDP connection that automatically
>> > starts a program on the server.
>> >
>> > Suddenly today the server more or less stopped responding and
>> > the only thing I
>> > could find was Winlogon.exe using 100% CPU time but I can't
>> > figure out WHY? I logged off all the users and then the
>> > problem disappeared.
>> >
>> > I suspect it might be our GPO logon script, but the only
>> > thing it does is check if you logon to the Terminal Server
>> > and then it runs the following line: rundll32
>> > printui.dll,PrintUIEntry /Xs /y /n"Printername"
 
Re: Winlogon.exe uses 100% CPU

Nothing was changed. I made a fresh installation of the server last week and
made the GPO script at the same time. The server is running with the latest
MS updates.
The users started using the server on monday and thursdag the error occured.
Nothing was changed in the script during the week, it's just the only thing I
can relate to the problem. Our normal AD logon script checks if the user is
logging onto the Terminal server, if that's the case then it exits the logon
script.

I have created different GPO scripts for different OU's, the only difference
in the scripts are the printername.

Here is the GPO script:
@ECHO OFF
IF %COMPUTERNAME%==TERMINAL (GOTO check) ELSE (GOTO end)
GOTO end

:check
IF EXIST "C:\Documents And Settings\%Username%\default.txt" (GOTO start)
ELSE (GOTO missing)
GOTO missing

:start
rundll32 printui.dll,PrintUIEntry /Xs /y /n"Printername"
GOTO net

:missing
ECHO %USERNAME% >> "C:\Documents And Settings\%USERNAME%\default.txt"
GOTO net

:net
NET USE M: \\Server\Data
GOTO pdf

:pdf
IF EXIST "C:\Documents And Settings\%Username%\pdf.txt" (GOTO end) ELSE
(GOTO pdf_install)
GOTO end

:pdf_install
CALL Regedit /s "\\Server\Data\Settings\PDF.reg"
ECHO %USERNAME% >> "C:\Documents And Settings\%USERNAME%\pdf.txt"
GOTO end
:end

"Vera Noest [MVP]" wrote:

> OK, so what was changed in the script, or the way it executes?
> You'll have to post the *complete* script, exactly as it is.
> Have you tried to run the script interactively?
>
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> *----------- Please reply in newsgroup -------------*
>
> =?Utf-8?B?TGFzc2U=?= <Lasse@discussions.microsoft.com> wrote on 02
> nov 2007:
>
> > Hi Vera
> >
> > The only thing I get in the EventLog is this:
> > "Execution of GPO scripts has timed out and have been
> > terminated."
> >
> > And that event is why I suspect my GPO script for being the
> > cause of the problem.
> >
> >
> > "Vera Noest [MVP]" wrote:
> >
> >> Anything errors or warnings in the EventLog on the server?
> >> Is your spooler service running, or is it crashing and
> >> restarting continously?
> >> Since this problem started suddenly today, what was changed on
> >> the server yesterday? Windows Update? Application upgrade? New
> >> printer driver? Or maybe just a reboot, which enabled changes
> >> made earlier?
> >>
> >> _________________________________________________________
> >> Vera Noest
> >> MCSE, CCEA, Microsoft MVP - Terminal Server
> >> TS troubleshooting: http://ts.veranoest.net
> >> ___ please respond in newsgroup, NOT by private email ___
> >>
> >> =?Utf-8?B?TGFzc2U=?= <Lasse@discussions.microsoft.com> wrote on
> >> 01 nov 2007 in microsoft.public.windows.terminal_services:
> >>
> >> > Hi
> >> >
> >> > We have a Server 2003 R2 SP2 with Terminal Services that's
> >> > causing some problems. We have around 80 users using the
> >> > server and each have a RDP connection that automatically
> >> > starts a program on the server.
> >> >
> >> > Suddenly today the server more or less stopped responding and
> >> > the only thing I
> >> > could find was Winlogon.exe using 100% CPU time but I can't
> >> > figure out WHY? I logged off all the users and then the
> >> > problem disappeared.
> >> >
> >> > I suspect it might be our GPO logon script, but the only
> >> > thing it does is check if you logon to the Terminal Server
> >> > and then it runs the following line: rundll32
> >> > printui.dll,PrintUIEntry /Xs /y /n"Printername"
>
 
Re: Winlogon.exe uses 100% CPU

Hi,

Which session was the winlogon.exe process that was
consuming all of the CPU running in? You can see
the session id column if you turn it on in task manager.

From this it will give you an idea if the problem may
have been related to a particular user or not. For example,
if it was the winlogon.exe running in session 63 you would
look at which user was currently running in that session.

The problem may have gone away as soon as the user
logged off thereby ending the instance of winlogon.

See the following article for help troubleshooting winlogon:

How to trace Winlogon activity in Windows Server 2003,
Windows XP, Windows 2000, and Windows NT

http://support.microsoft.com/kb/232575/en-us

There are many articles that directly/indirectly relate to
winlogon since it is such a core part of windows. I would
recommend you research articles in the knowledgebase
and/or contact microsoft PSS for assistance if the problem
persists.

Please reply with more details and we will provide further
suggestions if possible.

Thank you.

-TP

Lasse wrote:
> Hi
>
> We have a Server 2003 R2 SP2 with Terminal Services that's causing
> some problems. We have around 80 users using the server and each have
> a RDP connection that automatically starts a program on the server.
>
> Suddenly today the server more or less stopped responding and the
> only thing I
> could find was Winlogon.exe using 100% CPU time but I can't figure
> out WHY?
> I logged off all the users and then the problem disappeared.
>
> I suspect it might be our GPO logon script, but the only thing it
> does is check if you logon to the Terminal Server and then it runs
> the following line: rundll32 printui.dll,PrintUIEntry /Xs /y
> /n"Printername"
 
Re: Winlogon.exe uses 100% CPU

Mmm, if it isn't the script itself, it seems to be something with
the application of your GPO, given the EventID that you see.
Are the users subjected to many different GPO's when logging into
this server?

Check this out:

250842 - Troubleshooting Group Policy Application Problems
http://support.microsoft.com/?kbid=250842

but follow TP's recommendations as well.

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?TGFzc2U=?= <Lasse@discussions.microsoft.com> wrote on 02
nov 2007 in microsoft.public.windows.terminal_services:

> Nothing was changed. I made a fresh installation of the server
> last week and made the GPO script at the same time. The server
> is running with the latest MS updates.
> The users started using the server on monday and thursdag the
> error occured. Nothing was changed in the script during the
> week, it's just the only thing I can relate to the problem. Our
> normal AD logon script checks if the user is logging onto the
> Terminal server, if that's the case then it exits the logon
> script.
>
> I have created different GPO scripts for different OU's, the
> only difference in the scripts are the printername.
>
> Here is the GPO script:
> @ECHO OFF
> IF %COMPUTERNAME%==TERMINAL (GOTO check) ELSE (GOTO end)
> GOTO end
>
>:check
> IF EXIST "C:\Documents And Settings\%Username%\default.txt"
> (GOTO start) ELSE (GOTO missing)
> GOTO missing
>
>:start
> rundll32 printui.dll,PrintUIEntry /Xs /y /n"Printername"
> GOTO net
>
>:missing
> ECHO %USERNAME% >> "C:\Documents And
> Settings\%USERNAME%\default.txt" GOTO net
>
>:net
> NET USE M: \\Server\Data
> GOTO pdf
>
>:pdf
> IF EXIST "C:\Documents And Settings\%Username%\pdf.txt" (GOTO
> end) ELSE (GOTO pdf_install)
> GOTO end
>
>:pdf_install
> CALL Regedit /s "\\Server\Data\Settings\PDF.reg"
> ECHO %USERNAME% >> "C:\Documents And
> Settings\%USERNAME%\pdf.txt" GOTO end
>:end
>
> "Vera Noest [MVP]" wrote:
>
>> OK, so what was changed in the script, or the way it executes?
>> You'll have to post the *complete* script, exactly as it is.
>> Have you tried to run the script interactively?
>>
>> _________________________________________________________
>> Vera Noest
>> MCSE, CCEA, Microsoft MVP - Terminal Server
>> TS troubleshooting: http://ts.veranoest.net
>> *----------- Please reply in newsgroup -------------*
>>
>> =?Utf-8?B?TGFzc2U=?= <Lasse@discussions.microsoft.com> wrote on
>> 02 nov 2007:
>>
>> > Hi Vera
>> >
>> > The only thing I get in the EventLog is this:
>> > "Execution of GPO scripts has timed out and have been
>> > terminated."
>> >
>> > And that event is why I suspect my GPO script for being the
>> > cause of the problem.
>> >
>> >
>> > "Vera Noest [MVP]" wrote:
>> >
>> >> Anything errors or warnings in the EventLog on the server?
>> >> Is your spooler service running, or is it crashing and
>> >> restarting continously?
>> >> Since this problem started suddenly today, what was changed
>> >> on the server yesterday? Windows Update? Application
>> >> upgrade? New printer driver? Or maybe just a reboot, which
>> >> enabled changes made earlier?
>> >>
>> >> _________________________________________________________
>> >> Vera Noest
>> >> MCSE, CCEA, Microsoft MVP - Terminal Server
>> >> TS troubleshooting: http://ts.veranoest.net
>> >> ___ please respond in newsgroup, NOT by private email ___
>> >>
>> >> =?Utf-8?B?TGFzc2U=?= <Lasse@discussions.microsoft.com> wrote
>> >> on 01 nov 2007 in
>> >> microsoft.public.windows.terminal_services:
>> >>
>> >> > Hi
>> >> >
>> >> > We have a Server 2003 R2 SP2 with Terminal Services that's
>> >> > causing some problems. We have around 80 users using the
>> >> > server and each have a RDP connection that automatically
>> >> > starts a program on the server.
>> >> >
>> >> > Suddenly today the server more or less stopped responding
>> >> > and the only thing I
>> >> > could find was Winlogon.exe using 100% CPU time but I
>> >> > can't figure out WHY? I logged off all the users and then
>> >> > the problem disappeared.
>> >> >
>> >> > I suspect it might be our GPO logon script, but the only
>> >> > thing it does is check if you logon to the Terminal Server
>> >> > and then it runs the following line: rundll32
>> >> > printui.dll,PrintUIEntry /Xs /y /n"Printername"
 
Back
Top