XJGPER
asked on
winlogon.exe application error Unable to remote desktop into server
So this morning i come in and i'm unable to remote into the domain using remote desktop. It starts to login then just closes down. It creates 2 events in the app viewer on the server
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 3/27/2007
Time: 10:24:35 AM
User: N/A
Computer: ******
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x0008e89f.
Event Type: Information
Event Source: DrWatson
Event Category: None
Event ID: 4097
Date: 3/27/2007
Time: 10:24:36 AM
User: N/A
Computer: ******
Description:
The application, C:\WINDOWS\system32\winlog
I found one post that suggested a SFC which unfortunately made no difference. I also found a MS article but that also seemed to have no affect on the issue. http://support.microsoft.com/kb/914048
This is a SBS2k3 sp1 box with sp2 installed for exchange. I have not recently installed any updates that might cause this issue that i'm aware of. In fact the last update installed was a few months ago. I was able to remote in yesterday just fine. I've tried rebooting this morning with no success.
I ran spybot this morning for fun but all that was found was a cookie or two. I have yet to run hijack this, however since this machine rarely if ever touches the net i'm not to worried.
Everything else appears to be functioning correctly, i've had no other problems.
Any suggestions?
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 3/27/2007
Time: 10:24:35 AM
User: N/A
Computer: ******
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x0008e89f.
Event Type: Information
Event Source: DrWatson
Event Category: None
Event ID: 4097
Date: 3/27/2007
Time: 10:24:36 AM
User: N/A
Computer: ******
Description:
The application, C:\WINDOWS\system32\winlog
I found one post that suggested a SFC which unfortunately made no difference. I also found a MS article but that also seemed to have no affect on the issue. http://support.microsoft.com/kb/914048
This is a SBS2k3 sp1 box with sp2 installed for exchange. I have not recently installed any updates that might cause this issue that i'm aware of. In fact the last update installed was a few months ago. I was able to remote in yesterday just fine. I've tried rebooting this morning with no success.
I ran spybot this morning for fun but all that was found was a cookie or two. I have yet to run hijack this, however since this machine rarely if ever touches the net i'm not to worried.
Everything else appears to be functioning correctly, i've had no other problems.
Any suggestions?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Last week we modified the ctrl-alt-del logo to display our company logo instead. Those of you familiar with this process know you mess with msgina.dll and create a corresponding reg key. I pushed it out with a login script to all our clients (running winxp), and it works great on those boxes.
It would appear the server decided to take on the new logo as well. Logging in directly at the console worked fine, however it totally destroys remote logins via terminal services. Once i whacked the key that calls on the new logo everything fell into place.
After just a 5 minute look i saw an article that mentioned win2k workstation msgina dll's had a slightly different mem location for the logo then win2k server. I assume the same must be true for xp and win2k3.
Anyways problem solved.
Admins i would like to leave this question up in case someone else runs into thisproblem sometime down the road. However my only option is to delete it since no one answered for me. If you would rather i deleted this instead please let me know.