History: Server has been been in production for 3 years +. Yesterday (Friday) we uninstalled Adobe Acrobat and installed it again. After the system restart the issue below started. We are not sure if this was a cause of the issue or not.
Issue: Winlogon.exe uses 100% CPU and system is unuseable even from startup.
What is installed: Windows 2000 SP4, Citrix XPA SP3 FR3
What we have tried:
-Virus scans
-Malware programs, Adaware, HiJackthis, Spybot etc.
-Uninstalled all sorts of programs, particuarly programs that connect to the server such as Veritas. Uninstalled Adobe Acrobat.
-Unplugged Network cable, system runs fine. No issues with Winlogon.exe.
-Reconnect Network cable, Winlogon immediatly goes to 100% CPU.
-Disconnect Internet from Cisco Ehternet 0 (disable internet to lan) System boots fine and works fine. No issues with winlogon. Able to connect to server with RDP and Citrix Client localy with no issues.
-Reconnect Internet to Cisco Ethernet 0 problem does not return untill a connection from outside is attempted.
-Checked the routers (cisco 2651) ip auditing from outside. No unushall activity or aparant attacks of any kind. All packets and bytes look normal.
-Deleted AltAdder from system. System runs fine.
-Changed IP address of Citrix Server and created new static Nat mapping on Cisco (to totally isolate connection to citrix server for me to test). I was able to connect to the citrix server frominside fine, and outside fine from my machine. System worked ok. Had 2 more people connect from outside and on the third connection the Winlogon process immediatly went to 100% cpu and the server ground to a halt. Did not observe the 3rd connection in Management Console.
-After continued testing, it has been determined that the Winlogon process does not use 100% untill an outside connection to it is attempted.
We are unable to determine the cause of this problem and need some assistance. This is a production Citrix server and downtime is bad thing (isnt it always).
We are bringing up another citrix server to see if it is an issue with the server itself. We are still in the middle of this process. Any advise would be greatly appreciated.
Start Free Trial
