AppCrash LogonUI.exe After Restart
Windows 2008 Enterprise Terminal Server
Users are unable to logon to Terminal Server. They are stuck at the Welcome circle of death. I see nothing in the event logs so I restart the server. After the restart users can reconnect to TS but I also receive the below error when I log in as administrator:
Problem signature:
Problem Event Name: APPCRASH
Application Name: LogonUI.exe
Application Version: 6.0.6001.18000
Application Timestamp: 47918daf
Fault Module Name: ntdll.dll
Fault Module Version: 6.0.6002.18541
Fault Module Timestamp: 4ec3e3d5
Exception Code: c0000005
Exception Offset: 0006748f
OS Version: 6.0.6002.2.2.0.18.10
Locale ID: 1033
Additional Information 1: 518b
Additional Information 2: 459c9bfea80772efd1c88abce1d3efa6
Additional Information 3: b14a
Additional Information 4: 0dba7d157b2c550e0d58a443c47d82a1
Is this preventing the user from logging in in the first place? If so any suggestions on how to resolve the issue?
January 20th, 2012 7:45am
This really does seem to be the night (here at least) for access denied issues.
To answer your final question first, the easiest way to check (other than logging on as a regular user yourself) is to launch the tsadmin.exe utility and see if users are connecting.
Getting back to the LogonUI.exe issue, do you run a virus scanner of some description on this server? If so, I'd recommend stopping and disabling any related services, logging off and then back on again as a test. It's relatively common - though by no means
the only reason, for this kind of product to cause issues at logon (such as slow logons, user initialisation routines failing, etc).
You might also need to check if there's a system tray agent present as part of the logon process either in the Startup directory or more likely in the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run branch of the registry. If there is, make
sure you either delete the reference or in the case of the registry, you can just add something bogus like ".bak" to the end of the file path in the Data value (and then undo that change when you've finished testing).
If you find your logon session doesn't crash then you're likely going to need to do some checking on your antivirus product to see if there's a hotfix or workaround.
Cheers,
Lain
Free Windows Admin Tool Kit Click here and download it now
January 20th, 2012 7:59am
This really does seem to be the night (here at least) for access denied issues.
To answer your final question first, the easiest way to check (other than logging on as a regular user yourself) is to launch the tsadmin.exe utility and see if users are connecting.
Getting back to the LogonUI.exe issue, do you run a virus scanner of some description on this server? If so, I'd recommend stopping and disabling any related services, logging off and then back on again as a test. It's relatively common - though by no means
the only reason, for this kind of product to cause issues at logon (such as slow logons, user initialisation routines failing, etc).
You might also need to check if there's a system tray agent present as part of the logon process either in the Startup directory or more likely in the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run branch of the registry. If there is, make
sure you either delete the reference or in the case of the registry, you can just add something bogus like ".bak" to the end of the file path in the Data value (and then undo that change when you've finished testing).
If you find your logon session doesn't crash then you're likely going to need to do some checking on your antivirus product to see if there's a hotfix or workaround.
Cheers,
Lain
January 20th, 2012 3:54pm