Error on remote system when remote desktop session is ended
Many users are receiving the following error when a remote desktop session is ended. They are unable to remote in again if this error is on the screen. This is causing me to have to go to the remote system and click away the error. Once the error is off the screen they can remote in again. I'm guessing whatever this program is, its restarting it self after the error is gone. This does not happen every single time, but it does happen often.
Users are remoting from a Laptop running windows XP Pro SP2, into a desktop running windows XP Pro SP2. Some do it over a VPN, into the network. Some do it without VPN. Happens either way. They are not using any options when using Remote Desktop. Just using default settings. No /console or anything like that. The clients are using remote desktop version 6.0.
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 1/10/2008
Time: 4:55:31 PM
User: N/A
Computer: <removed>
Description:
Application popup: SAS window: winlogon.exe - Application Error : The instruction at "0x00000000" referenced memory at "0x00000000". The memory could not be "read".
I have tried the following:
Installed all .net framework updates
Fully updated windows with critical and optional updates.
Run SFC /scannow (did not find anything wrong)
Someone thought it could be Netsky, so I ran a Netsky cleanup tool and it did not find Netsky virus.
If anyone needs any more info, please comment and I'll put it up as soon as possible.
Thank you.
Users are remoting from a Laptop running windows XP Pro SP2, into a desktop running windows XP Pro SP2. Some do it over a VPN, into the network. Some do it without VPN. Happens either way. They are not using any options when using Remote Desktop. Just using default settings. No /console or anything like that. The clients are using remote desktop version 6.0.
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 1/10/2008
Time: 4:55:31 PM
User: N/A
Computer: <removed>
Description:
Application popup: SAS window: winlogon.exe - Application Error : The instruction at "0x00000000" referenced memory at "0x00000000". The memory could not be "read".
I have tried the following:
Installed all .net framework updates
Fully updated windows with critical and optional updates.
Run SFC /scannow (did not find anything wrong)
Someone thought it could be Netsky, so I ran a Netsky cleanup tool and it did not find Netsky virus.
If anyone needs any more info, please comment and I'll put it up as soon as possible.
Thank you.
ASKER
We do not have anything like that running on our systems. Only Symantec AntiVirus corporate 10.
Are the users informed on how to properly end a remote session?
I just want to make sure I have a clear picture..
Are these individual users remote connecting to one common machine? or are these users
each trying to connect to their "own" machine within the same network?
WinXP SP2 is not setup to accept multiple connection, without doing some extra work with
programs and services.
I just want to make sure I have a clear picture..
Are these individual users remote connecting to one common machine? or are these users
each trying to connect to their "own" machine within the same network?
WinXP SP2 is not setup to accept multiple connection, without doing some extra work with
programs and services.
ASKER
They each have both a laptop and a desktop. They are not trying to connect to the same machine. They are not logging out, they are just closing remote desktop session. This is what they need to do because they need everything to still be running when they connect again.
I understand.. But are they going to the Start Menu and clicking the DISCONNECT, or just
clicking the X to close the RDP window? I think it matters, not sure, but might be something
to consider.
Also, Is this happening to everyone that is connecting and running the same programs, or
just a few out of many?
clicking the X to close the RDP window? I think it matters, not sure, but might be something
to consider.
Also, Is this happening to everyone that is connecting and running the same programs, or
just a few out of many?
Whats nit eh event logs on the system throwing up this error?
ASKER
I'll check on the closing with the X vs disconnect. I'm guessing they are closing with the X just based on what I know about them. They probably do not even know that disconnect exists in the start menu. I'll check on that to be sure though.
There are not that many people who work the way these people do. They have a laptop at home and a desktop at work. We do not allow certain data to leave the LAN and so these people have to work off of their desktops via remote desktop when they want to work from home.
Johnb6767, the error in the event log is listed in the question. Its in System.
Now that I think about it, they both may be using Cisco VPN client when this is happening...
I'll try and see if I can setup a test environment this week to test this stuff. I'll post what I find out.
If anyone else has any ideas, please post them and I'll try that too. Thanks.
There are not that many people who work the way these people do. They have a laptop at home and a desktop at work. We do not allow certain data to leave the LAN and so these people have to work off of their desktops via remote desktop when they want to work from home.
Johnb6767, the error in the event log is listed in the question. Its in System.
Now that I think about it, they both may be using Cisco VPN client when this is happening...
I'll try and see if I can setup a test environment this week to test this stuff. I'll post what I find out.
If anyone else has any ideas, please post them and I'll try that too. Thanks.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
The error I am getting is on the screen of the system they are remoting into. The system here at the office.
The error pops up when they disconnect the Remote Desktop Session. They are unable to remote back into the system until that error is clicked away.
After reviewing the VPN idea, I'm starting to think it does not matter. I had it happen just here on the LAN, without using a VPN client at all. Also, the other group of users is only on the LAN too so, the VPN client isn't running at all when this is happening for some people.
The error pops up when they disconnect the Remote Desktop Session. They are unable to remote back into the system until that error is clicked away.
After reviewing the VPN idea, I'm starting to think it does not matter. I had it happen just here on the LAN, without using a VPN client at all. Also, the other group of users is only on the LAN too so, the VPN client isn't running at all when this is happening for some people.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
That is a good suggestion SunshineVK, I'll try updating the drivers on the NICs and see if that helps. They very well may be loosing their network connectivity.... They are all using similar hardware.
Hi SheaDigital,
Did u manage to get to the Root cause & resolve the above mentioned issue?
Did u manage to get to the Root cause & resolve the above mentioned issue?
ASKER
No I'm sorry. This kinda got put on the back burner due to recent projects I've been working on here. I hope to be able to work on this again soon though.
ASKER
I found out what SAS is. SAS stands for Secure Authentication Sequence. Someone wrote a very good Wikipidia article on Winlogon and SAS.
http://en.wikipedia.org/wiki/Winlogon
So basically it looks like the windows process that handles authentication and login is crashing.
http://en.wikipedia.org/wiki/Winlogon
So basically it looks like the windows process that handles authentication and login is crashing.
ASKER
I'm giving up on this issue. It seems to have gone away. No clue why.
Perhaps a windows patch did it? Dunno.
Perhaps a windows patch did it? Dunno.
Might disable the realtime protection, or even uninstall to test if this is the case.....