winlogon.exe application error Unable to remote desktop into server

So this morning i come in and i'm unable to remote into the domain using remote desktop. It starts to login then just closes down. It creates 2 events in the app viewer on the server

Event Type:      Error
Event Source:      Application Error
Event Category:      (100)
Event ID:      1000
Date:            3/27/2007
Time:            10:24:35 AM
User:            N/A
Computer:      ******
Faulting application , version, faulting module unknown, version, fault address 0x0008e89f.

Event Type:      Information
Event Source:      DrWatson
Event Category:      None
Event ID:      4097
Date:            3/27/2007
Time:            10:24:36 AM
User:            N/A
Computer:      ******
The application, C:\WINDOWS\system32\winlogon.exe, generated an application error The error occurred on 03/27/2007 @ 10:24:36.031 The exception generated was c0000005 at address 0008E89F (<nosymbols>)

I found one post that suggested a SFC which unfortunately made no difference. I also found a MS article but that also seemed to have no affect on the issue.

This is a SBS2k3 sp1 box with sp2 installed for exchange. I have not recently installed any updates that might cause this issue that i'm aware of. In fact the last update installed was a few months ago. I was able to remote in yesterday just fine. I've tried rebooting this morning with no success.

I ran spybot this morning for fun but all that was found was a cookie or two. I have yet to run hijack this, however since this machine rarely if ever touches the net i'm not to worried.

Everything else appears to be functioning correctly, i've had no other problems.

Any suggestions?
Who is Participating?
EE_AutoDeleterConnect With a Mentor Commented:
Because you have presented a solution to your own problem which may be helpful to future searches, this question is now PAQed and your points have been refunded.

XJGPERAuthor Commented:
So i finally discovered the issue we were having.

Last week we modified the ctrl-alt-del logo to display our company logo instead. Those of you familiar with this process know you mess with msgina.dll and create a corresponding reg key. I pushed it out with a login script to all our clients (running winxp), and it works great on those boxes.

It would appear the server decided to take on the new logo as well. Logging in directly at the console worked fine, however it totally destroys remote logins via terminal services. Once i whacked the key that calls on the new logo everything fell into place.

After just a 5 minute look i saw an article that mentioned win2k workstation msgina dll's had a slightly different mem location for the logo then win2k server. I assume the same must be true for xp and win2k3.

Anyways problem solved.

Admins i would like to leave this question up in case someone else runs into thisproblem sometime down the road. However my only option is to delete it since no one answered for me. If you would rather i deleted this instead please let me know.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.