User account logs off just after logon, administrator accounts do not have logon problems
Does anyone know why a user account would logoff instantly after logon but administrator accounts do not have any problems logging on? This is in the security log: An account was successfully logged on. Subject:Security ID:NULL SIDAccount Name:-Account Domain:-Logon ID:0x0 Logon Type:3 New Logon:Security ID:ANONYMOUS LOGONAccount Name:ANONYMOUS LOGONAccount Domain:NT AUTHORITYLogon ID:0xc034791Logon GUID:{00000000-0000-0000-0000-000000000000} Process Information:Process ID:0x0Process Name:- Network Information:Workstation Name: (I deleted it)Source Network Address:(I deleted it)Source Port:3500 Detailed Authentication Information:Logon Process:NtLmSsp Authentication Package:NTLMTransited Services:-Package Name (NTLM only):NTLM V1Key Length:0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request.- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.- Transited services indicate which intermediate services have participated in this logon request.- Package name indicates which sub-protocol was used among the NTLM protocols.- Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Then this follows: An account was logged off. Subject:Security ID:ANONYMOUS LOGONAccount Name:ANONYMOUS LOGONAccount Domain:NT AUTHORITYLogon ID:0xc034791 Logon Type:3 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
February 19th, 2008 4:48pm

Hi What is your general network setup? Is the machine domain-joined? Does the same thing happend with newly created standard accounts?
Free Windows Admin Tool Kit Click here and download it now
February 20th, 2008 12:00pm

I am not sure what you mean by general network setup. This PC is joined to a domain. Yes, this was a newly created local standard account. It also happens to a domain account with only user rights. However a domain user with administrator rights will login fine. There are three other test computers without this problem. This particaular one has more programs installed than the other three. Could a 3rd party program be causing this problem? If yes, is there a waytofind out which one would be causing it? I guess I could start uninstalling one by one and test after each uninstall.
February 20th, 2008 3:23pm

Hi Robert, The event log indicates that it was a network logon (logon type: 3) but not interactive logon. I would like to confirm if the issue persists when attempting to logon the system locally (interactive logon). Meanwhile, we can perform a clean boot in Windows Vista to disable third party program so that we can narrow down the cause of the issue. To do so, please refer to the KB article 929135 (http://support.microsoft.com/kb/929135). Hope it helps. Sincerely, Joson Zhou Microsoft Online Community Support
Free Windows Admin Tool Kit Click here and download it now
February 21st, 2008 9:53am

Hi,I am encountering the exact same problem as WhiteWolf.Although I can fix the issue by doing an IISreet /restart. After issueng this command with elevated rights. Users are able to log back in. But after a while we encounter the exact same problem.This isn't a permanent problem, but its a very annoying problem because sometimes it happenes 2-3 times a day, and other times it can run 2 weeks without a problem.Is their any way to know what is causing this behaviour on a Terminal Server 2008?Any help is welcome, and I really hope someone can enlighten me from the problem. Its annoying and i have tried many different things to try to solve it without success.As a side note:- Terminal Server aint the DC, and our Licence Server is on the Terminal Server itself. We have chosen forest as scope, cause with domain as scope, TS showed an error, because then we should have the license server on our DC. But even without it changed it also gave the same error.Greetz and many thx,Gunther
August 27th, 2009 4:33pm

I too, had the same problem. It turned out what I feared since beginning! My computer was not logging me off. I opened Start/Run and typed "logoff" (without quotes) and now my son can log onto his account. I have made a shortcut of this command on the desktop since my usual "Shutdown" takes too long and I have a fast shutdown shortcut but none of them logs my account off! Thanks and yes, IE 8 is also having problems but there are alternate browsers and office suites.
Free Windows Admin Tool Kit Click here and download it now
October 15th, 2010 12:38am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics