Terminal Server periodically slow logins

I have a Window 2003 server configured as a Terminal Server that has about 12 uses login to it, usually no more than 5 at once. Applications run great.
Every so often it will get into a "mode" where logins take a very long time, about 3-4 minutes. I do not see anything out of the ordinary in the eventvwr.

What steps should I take to troubleshoot this? I've read a few FAQs about it online and found nothing.
undy30Asked:
Who is Participating?
 
ee_ai_constructCommented:
PAQ / No Refund
ee ai construct, community support moderator
0
 
undy30Author Commented:
More information. I finally had this happen to me, before it was from users notifying me.

I connect using RDC and put my user credentials in at 8:46. It sits at the blue desktop screen with nothing loaded (actually we use BGInfo which takes a snapshot of system information and displays as background. That was loaded as the wallpaper and had an updated time, so it must have loaded when I connected, i imagine).

10 minutes later at 8:56 I actually get to the desktop. Nothing is out of the ordinary and everything runs fine. Although it did come up with an error report right away, which doesn't normally happen. We do have a lot of print errors in eventvwr, when it works normally even. This was the one that came up:

Reporting queued error: faulting application spoolsv.exe, version 5.2.3790.1830, faulting module ntdll.dll, version 5.2.3790.1830, fault address 0x0001e25f.

Print spooler was working normally when I got connected.

Also in my security audit it didn't say I logon until I can see the desktop (at 8:56), rather than when I actually enter my username/password.

I'm logging in as administrator if it matters.
0
 
undy30Author Commented:
Also. It seems the only fix is to reboot the server. I hear rebooting terminal servers weekly is good but this one was just rebooted yesterday. A solution other than rebooting nightly would be nice.
0
Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

 
undy30Author Commented:
Well I added a scheduled task to reboot the server every morning but 5 hours later it's back to being slow.

This server does have odd errors in the eventvwr about printing.

This server has 23 printers hooked up to it, so narrowing that down will be hard, if it's one driver of a printer.

I will often get the error:
Reporting queued error: faulting application spoolsv.exe, version 5.2.3790.1830, faulting module ntdll.dll, version 5.2.3790.1830, fault address 0x0001e25f.

And a second after that I get:
Fault bucket 186202635.

Print Spooler is running normally.
I heard that a PC can boot slow if it is getting those errors and there are corrupt SPL or SHD files in the C:\windows\system32\spool\drivers\w32x86 folder.

I did have 2 of them:
HPLTCWS1.SPL
HPLTCWS2.SPL

I delete them but they come back after 5 minutes or so. None of my printers have backed up jobs or anything.
0
 
gsgiCommented:
what printers are used in your office - i.e. hp 4050, hp 4000, hp 2100, etc etc etc...

-gsgi
0
 
undy30Author Commented:
I have many printers.
3 HP 8100s, 3 HP 4100s, HP5si, TEC B-572, HP4V, Epson DFX8000, DesignJet 500, HPOJG85X, HP 2200D, HP 3380, and a bunch of desk jets. They're all on 2 print servers, not this box.

3 hours after the server reboots at night, when no one is on, it always gets the same errors in EventVwr:

reporting queued error: faulting application spoolsv.exe, version 5.2.3790.1830, faulting module ntdll.dll, version 5.2.3790.1830, fault address 0x000396d0.

After that I get this error in the string of errors:
Fault bucket 186202635
0
 
gsgiCommented:
I would right click each of the hp laserjets choose properties advanced and have it use the hp lj 4 driver.  The 4000 drivers are known to make spoolsv unstable.
One of those divers is crashing your spooler.

-gsgi

0
 
undy30Author Commented:
Do you mean all of the printers or only the ones using HP4000 drivers? Only the HP4100s are using the 4000 series drivers (although it's the 4100 5e or PCL6 drivers).

We have another terminal server that is using the same drivers and it works fine.
0
 
gsgiCommented:
I use the 4000 drivers with no problems too, just telling what sometimes happens.

I'd switch as many of the hp drivers as I could to the HP lj 4 drivers - that is sort of best practice afaik.
As a matter of fact any of those other printers that are HP lj 4 compatible, i'd switch too.

The pcl6 drivers are also known to be less than perfectly stable.

-Greg
0
 
undy30Author Commented:
I switched all the printers over last night to the standard LJ4 driver. After my morning reboot, at 3am, it is still taking a long time to login. Over 10 minutes.
0
 
gsgiCommented:
http://ts.veranoest.net/ts_printing.htm#printutils

Under Documentation and Best Practice Guides
see
# 135406 - Steps to Manually Remove and Reinstall a Printer Driver - W2K / XP
# Download document "Removing 3th Party printer drivers"

try to dump the old drivers
0
 
undy30Author Commented:
I ran through all of those troubleshooting steps before.

I removed the old drivers and redid them and that didn't help. I still get the error on boot and slow logons in the morning.

I added verbose user logging and debugging to see if that will help tell me the problem. I ran it on both TS servers and the output is identical pretty much (both are logging in from AD as admins using RDC, I don't use roaming profiles).
It happens every morning on one server. So I'll login again on both and compare, when the one server is slow. That should give me some clue. I"ll post back with the results.
0
 
undy30Author Commented:
This is a snippet of my userenv.log file where it "freezes"

USERENV(f28.f30) 08:35:22:833 ImpersonateUser: Failed to impersonate user with 5.
USERENV(f28.f30) 08:35:22:833 GetUserDNSDomainName: Failed to impersonate user
USERENV(920.fe8) 08:35:35:271 LibMain: Process Name:  C:\WINDOWS\system32\userinit.exe
USERENV(6e8.210) 08:41:44:449 UnloadUserProfile: Entering, hProfile = <0x288>
USERENV(6e8.210) 08:41:44:449 UnloadUserProfile: no thread token found, impersonating self.
USERENV(6e8.210) 08:41:44:449 GetInterface: Returning rpc binding handle
USERENV(270.784) 08:41:44:449 IProfileSecurityCallBack: client authenticated.

Any searches don't yeild many results.
0
 
undy30Author Commented:
And this is when I logoff. Nothing between the 10 minute hang.

USERENV(e8.7d0) 08:47:23:096 LibMain: Process Name:  C:\WINDOWS\system32\mobsync.exe
USERENV(d0.cd8) 08:57:23:155 UnloadUserProfile: Entering, hProfile = <0x244>
USERENV(d0.cd8) 08:57:23:155 UnloadUserProfile: no thread token found, impersonating self.
USERENV(d0.cd8) 08:57:23:170 GetInterface: Returning rpc binding handle
USERENV(270.298) 08:57:23:170 IProfileSecurityCallBack: client authenticated.
0
 
undy30Author Commented:
No it hasn't stopped crashing. Although the service never goes down. It just displays a "send error report" message whenever I RDC into it.
0
 
gsgiCommented:
And it crashes no matter which workstation logs in?

-gsgi
0
 
undy30Author Commented:
Correct. It can be from anyone, from any workstation.
0
 
gsgiCommented:
Of these printers:
>3 HP 8100s, 3 HP 4100s, HP5si, TEC B-572, HP4V, Epson DFX8000, DesignJet 500, HPOJG85X, HP 2200D, HP 3380, and a bunch of desk jets. They're all on 2 print
>servers, not this box.
how workstations have many of them installed for local printing?
are these printers on the network or do they print through shared workstations?

-gsgi
0
 
undy30Author Commented:
All of them are networked printers installed on 1 of our 2 print servers.
They are shared out and then workstations and the terminal servers add them.
0
 
gsgiCommented:
So is any RDP printer redirection necessary at all?

If all the printers have a driver on the TS shared off of the Printer Server, then all you may need is to set default printers for each user.

-gsgi

0
 
undy30Author Commented:
I'm not quite sure I understand fully. I'm new to this environment.

All the users connecting using RDP needs access to all of the printers on the network. Also they need access to their local printers, which get installed when they login. Although even if the user has no printers that are local to install, it still takes a long time to login/logoff.
0
 
gsgiCommented:
I am asking this:

Why does a user need to have their "default workstation printer" through the mechanism of terminal server if all the printers are available from the terminal server as ip printers.

For instance, if user1 uses printer1 and user2 uses printer2, and both printer 1 and printer 2 are installed on the terminal server as network printers, then when I log on to terminal server, even if I have NO LOCAL printers, I can print to either printer...  I can even set one of them as default.

Now if I happen to have printer1 defined local, then rdp redirection is going to create another driver for printer 1 and this is unnessary, since it is the case that without any local printer I could still print to printer1.  So in this case rdp redirection should be turned off.

-gsgi
0
 
undy30Author Commented:
This is used for mobile users also who do not have printers installed, but need to print reports to printers inside our network and from TS to their locally connected printers.

A lot of them are not in the state, so we need both network printers and rdp redirection I believe.
I do see your point of duplicate printers. I don't know why that would cause these problems though, considering we have another terminal server which runs perfectly with the same settings.
0
 
gsgiCommented:
The server does do some "work" to create the drivers through rdp redirection, and this would be a way to tell if it is "tripping" when someone logs in with a print driver that is does not like.  If you turn off rpd redirection and it does not slow down, then we know it is related to that.

Do you have enough money in theb budget for $1,400 per server - tricerat makes a great third party printing solution and it might keep your server from crashing.

(Although I this point I am seriously thinking it may be time to reinstall this server that keeps crashing)
Have you removed ALL third party print drivers?
Have you uninstalled and reinstalled the latest service pack?

-gsgi
0
 
gsgiCommented:
please paq / no refund.  this is the thread where I really beg the question, why set up redirection if you don't need it.  I may refer back to this thread.  -gsgi
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.