winlogon.exe hangs causing 100% CPU

On a corporate network we support was have 26+ Terminal Servers, running on NT4 server & metaframe 1.8 They have all been working fine for over 5 years+. Recently a few servers have started to experience a problem where by the WINLOGON.EXE process takes up to 100% CPU and the server performance degrades to an unusable level. The only way to resolve this problem is to reboot the server - not easy when anywhere up to 30 users are using it (might not seem like many but it is to the client).

All servers are service packed to up to SP6.

We have tried both of these numerous times:
http://support.citrix.com/forums/thread.jspa?messageID=64357&fromSearchPage=trueﭥ
http://support.microsoft.com/kb/243840/en-us but they haven't helped.

We have already gone down a few routes namely:
Printer drivers problems - hasn't help
LMREPL.exe & Directory Replication. Some (at my company & client (all Techies)) believe this may be the problem - hasn't helped.
Profile rebuilds. We have rebuilt one sites profiles but the problem is still occurring.
Spy ware etc. All servers are clean as a whistle after running spybot and AdAware.

This is causing the client more and more problems as well as a lot of work for me & my team. There is an upgrade for the client to Win2k3 (software and hardware) coming but the client is talking about postponing until the above problems are resolved. As much as I want to say to the client just upgrade we all need to understand (and try to fix) the problem before the upgrade.

Any help would be great!
Thanks
pappaslim
LVL 13
Mark GalvinManaging Director / Principal ConsultantAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

bbaoIT ConsultantCommented:
please download Process Explorer from the following site and use it to determine which process is calling winlogon.exe by analysing the process tree given by the utility.

Process Explorer
http://www.sysinternals.com/Utilities/ProcessExplorer.html

hope it helps,
bbao
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Networking

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.