Error on remote system when remote desktop session is ended

Many users are receiving the following error when a remote desktop session is ended. They are unable to remote in again if this error is on the screen. This is causing me to have to go to the remote system and click away the error. Once the error is off the screen they can remote in again. I'm guessing whatever this program is, its restarting it self after the error is gone. This does not happen every single time, but it does happen often.

Users are remoting from a Laptop running windows XP Pro SP2, into a desktop running windows XP Pro SP2. Some do it over a VPN, into the network. Some do it without VPN. Happens either way. They are not using any options when using Remote Desktop. Just using default settings. No /console or anything like that. The clients are using remote desktop version 6.0.

Event Type:      Information
Event Source:      Application Popup
Event Category:      None
Event ID:      26
Date:            1/10/2008
Time:            4:55:31 PM
User:            N/A
Computer:      <removed>
Application popup: SAS window: winlogon.exe - Application Error : The instruction at "0x00000000" referenced memory at "0x00000000". The memory could not be "read".

I have tried the following:
Installed all .net framework updates
Fully updated windows with critical and optional updates.
Run SFC /scannow (did not find anything wrong)
Someone thought it could be Netsky, so I ran a Netsky cleanup tool and it did not find Netsky virus.

If anyone needs any more info, please comment and I'll put it up as soon as possible.

Thank you.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

SAS might be referring to SuperAntiSpyware, as it is loaded under Winlogon.....

Might disable the realtime protection, or even uninstall to test if this is the case.....
SheaDigitalAuthor Commented:
We do not have anything like that running on our systems. Only Symantec AntiVirus corporate 10.
Are the users informed on how to properly end a remote session?

I just want to make sure I have a clear picture..

Are these individual users remote connecting to one common machine? or are these users
each trying to connect to their "own" machine within the same network?

WinXP SP2 is not setup to accept multiple connection, without doing some extra work with
programs and services.
Cloud Class® Course: Python 3 Fundamentals

This course will teach participants about installing and configuring Python, syntax, importing, statements, types, strings, booleans, files, lists, tuples, comprehensions, functions, and classes.

SheaDigitalAuthor Commented:
They each have both a laptop and a desktop. They are not trying to connect to the same machine. They are not logging out, they are just closing remote desktop session. This is what they need to do because they need everything to still be running when they connect again.
I understand.. But are they going to the Start Menu and clicking the DISCONNECT, or just
clicking the X to close the RDP window? I think it matters, not sure, but might be something
to consider.

Also, Is this happening to everyone that is connecting and running the same programs, or
just a few out of many?
Whats nit eh event logs on the system throwing up this error?
SheaDigitalAuthor Commented:
I'll check on the closing with the X vs disconnect. I'm guessing they are closing with the X just based on what I know about them. They probably do not even know that disconnect exists in the start menu. I'll check on that to be sure though.

There are not that many people who work the way these people do. They have a laptop at home and a desktop at work. We do not allow certain data to leave the LAN and so these people have to work off of their desktops via remote desktop when they want to work from home.

Johnb6767, the error in the event log is listed in the question. Its in System.

Now that I think about it, they both may be using Cisco VPN client when this is happening...
I'll try and see if I can setup a test environment this week to test this stuff. I'll post what I find out.

If anyone else has any ideas, please post them and I'll try that too. Thanks.
My comment about the Disconnect is ONLY related to RDP Terminal Server connections. When you
click the start button, it bring up the menu, and instead of there being two options "Log Off" and
"Turn Off Computer" there is "Log Off" and "Disconnect" . Click the disconnect will end the session
but they will remain logged on and programs running., and should be able to reconnect.

IF you are using the Cisco VPN feature, it may be more an issue with timing out and not allowing
them to reconnect as a safty feature. We use Citrix Metaframe and I have to reconnect every two hours. to keep a session active. You may need to look into the time your VPN server allows for a session to exist.

If I understand correctly, the error you are getting is from the applications that are left running, not
so much the connection or the OS, right?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
SheaDigitalAuthor Commented:
The error I am getting is on the screen of the system they are remoting into. The system here at the office.

The error pops up when they disconnect the Remote Desktop Session. They are unable to remote back into the system until that error is clicked away.

After reviewing the VPN idea, I'm starting to think it does not matter. I had it happen just here on the LAN, without using a VPN client at all. Also, the other group of users is only on the LAN too so, the VPN client isn't running at all when this is happening for some people.
Is the above mentioned pattern (in the original ?) seen on a particular set of Hardware?
What about the NIC's & Ver. of their respective Drivers?
Did u checked if the System which is being remotely accessed loosing its Network connectivity?
SheaDigitalAuthor Commented:
That is a good suggestion SunshineVK, I'll try updating the drivers on the NICs and see if that helps. They very well may be loosing their network connectivity.... They are all using similar hardware.
Hi SheaDigital,
Did u manage to get to the Root cause & resolve the above mentioned issue?
SheaDigitalAuthor Commented:
No I'm sorry. This kinda got put on the back burner due to recent projects I've been working on here. I hope to be able to work on this again soon though.
SheaDigitalAuthor Commented:
I found out what SAS is. SAS stands for Secure Authentication Sequence. Someone wrote a very good Wikipidia article on Winlogon and SAS.

So basically it looks like the windows process that handles authentication and login is crashing.
SheaDigitalAuthor Commented:
I'm giving up on this issue. It seems to have gone away. No clue why.

Perhaps a windows patch did it? Dunno.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.