Solved: Winlogon.exe causes 99 percent CPU usage

Create Account

Windows 2000

Questions

Followers

Top Experts

mei_liu

Winlogon.exe causes 99 percent CPU usage

We are running terminal server 2000, and have seen few occasions where winlogon.exe takes up 99 percent CPU time. It slows down all of the other applications. This process can't not be killed from the task manager because the system uses it. Could anyone tell us how we could avoid having this issue again?

Any help would be greatly appreciated. Thanks in advance!

Zero AI Policy

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

Fatal_Exception🇺🇸

This could be the result of spyware (although I am not sure how it could get on your TS).. In particular VX2.Betterinternet..

You could try Spybot and Adaware to try to remove it...

Also, look for a registry entry :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Guardian , delete this branch that loaded the XXX.dll

mei_liu

ASKER

We don't have VX2.Betterinternet on the system, nor do we have Guardian under the registry. What else could be the cause?

Thanks

Fatal_Exception🇺🇸

What is strange is that winlogon is only supposed to run at logon.. Is this an Application TS server..??

Perhaps you might want to ck this out..::

Important Update 01.03.2004 by reger24:

If winlogon.exe is running in your system and it"s exe-file is in c:\winnt or c:\windows (%systemroot%) with a filesize of 17,424 Byte you should terminate that process and remove it"s autostart entry because it could be the worm W32.Netsky.D.

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

mei_liu

ASKER

Yes, we are running under TS server environment, and we do have winlogon.exe under %systemroot% directory. The file size is 176,912 bytes. The file version is 5.0.2195.1600. What I can see is the number of winlogon.exe sessions that it shows under the task manager equals to the number of users we have logged into the TS server. If users need to log into TS server using this file, how could we simply remove this file from the system? When we do have problems with this file, we only had problem with one session of this file. Is there any other solutions to it?

Thanks

gemarti🇺🇸

I was searching for another problem and ran across this thread...maybe this will help:

Spooler Failure Causes High CPU Usage in the Winlogon.exe and Spoolsv.exe Processes on a Windows 2000 Terminal Server
http://support.microsoft.com/?kbid=822834

mei_liu

ASKER

Thanks. I am still observing it to see if spooler is really the cause.

Thanks

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

gemarti🇺🇸

Okay....I'm around most of the time if a question comes up.

Fatal_Exception🇺🇸

mei_liu

ASKER

Thanks for everyone's help. This issue hasn't come up, and none of the answers really applied to our situation. Could anyone help us to close this question?

Thanks

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

Fatal_Exception🇺🇸

Ask a 0 pts question in Community Support for closure..

mei_liu

ASKER

Community Support staff,

Could you please assign 0 point to this question? Please see the reasons above.

Thanks

mei_liu

ASKER

Please also close this question for now.

Thanks

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

ASKER CERTIFIED SOLUTION

CetusMOD🇳🇱

membership

Signing up is free and takes 30 seconds. No credit card required.

Create Account

Windows 2000

Questions

Followers

Top Experts

Windows 2000 is an operating system for use on both client and server computers. It is the successor to Windows NT 4.0, and is the last version of Microsoft Windows to display the "Windows NT" designation. Four editions of Windows 2000 were released (Professional, Server, Advanced Server, and Datacenter Server) that shared a core set of features, including many system utilities such as the Microsoft Management Console. All versions of the operating system support NTFS 3.0, Encrypting File System, as well as basic and dynamic disk storage. The Windows 2000 Server family includes support for Active Directory services, Distributed File System and fault-redundant storage volumes.