• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1964
  • Last Modified:

Error on remote system when remote desktop session is ended

Many users are receiving the following error when a remote desktop session is ended. They are unable to remote in again if this error is on the screen. This is causing me to have to go to the remote system and click away the error. Once the error is off the screen they can remote in again. I'm guessing whatever this program is, its restarting it self after the error is gone. This does not happen every single time, but it does happen often.

Users are remoting from a Laptop running windows XP Pro SP2, into a desktop running windows XP Pro SP2. Some do it over a VPN, into the network. Some do it without VPN. Happens either way. They are not using any options when using Remote Desktop. Just using default settings. No /console or anything like that. The clients are using remote desktop version 6.0.

Event Type:      Information
Event Source:      Application Popup
Event Category:      None
Event ID:      26
Date:            1/10/2008
Time:            4:55:31 PM
User:            N/A
Computer:      <removed>
Description:
Application popup: SAS window: winlogon.exe - Application Error : The instruction at "0x00000000" referenced memory at "0x00000000". The memory could not be "read".

I have tried the following:
Installed all .net framework updates
Fully updated windows with critical and optional updates.
Run SFC /scannow (did not find anything wrong)
Someone thought it could be Netsky, so I ran a Netsky cleanup tool and it did not find Netsky virus.


If anyone needs any more info, please comment and I'll put it up as soon as possible.

Thank you.
0
SheaDigital
Asked:
SheaDigital
  • 8
  • 3
  • 2
  • +1
2 Solutions
 
johnb6767Commented:
SAS might be referring to SuperAntiSpyware, as it is loaded under Winlogon.....

Might disable the realtime protection, or even uninstall to test if this is the case.....
0
 
SheaDigitalAuthor Commented:
We do not have anything like that running on our systems. Only Symantec AntiVirus corporate 10.
0
 
MshineCommented:
Are the users informed on how to properly end a remote session?

I just want to make sure I have a clear picture..

Are these individual users remote connecting to one common machine? or are these users
each trying to connect to their "own" machine within the same network?

WinXP SP2 is not setup to accept multiple connection, without doing some extra work with
programs and services.
0
Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
SheaDigitalAuthor Commented:
They each have both a laptop and a desktop. They are not trying to connect to the same machine. They are not logging out, they are just closing remote desktop session. This is what they need to do because they need everything to still be running when they connect again.
0
 
MshineCommented:
I understand.. But are they going to the Start Menu and clicking the DISCONNECT, or just
clicking the X to close the RDP window? I think it matters, not sure, but might be something
to consider.

Also, Is this happening to everyone that is connecting and running the same programs, or
just a few out of many?
0
 
johnb6767Commented:
Whats nit eh event logs on the system throwing up this error?
0
 
SheaDigitalAuthor Commented:
I'll check on the closing with the X vs disconnect. I'm guessing they are closing with the X just based on what I know about them. They probably do not even know that disconnect exists in the start menu. I'll check on that to be sure though.

There are not that many people who work the way these people do. They have a laptop at home and a desktop at work. We do not allow certain data to leave the LAN and so these people have to work off of their desktops via remote desktop when they want to work from home.

Johnb6767, the error in the event log is listed in the question. Its in System.

Now that I think about it, they both may be using Cisco VPN client when this is happening...
I'll try and see if I can setup a test environment this week to test this stuff. I'll post what I find out.

If anyone else has any ideas, please post them and I'll try that too. Thanks.
0
 
MshineCommented:
My comment about the Disconnect is ONLY related to RDP Terminal Server connections. When you
click the start button, it bring up the menu, and instead of there being two options "Log Off" and
"Turn Off Computer" there is "Log Off" and "Disconnect" . Click the disconnect will end the session
but they will remain logged on and programs running., and should be able to reconnect.

IF you are using the Cisco VPN feature, it may be more an issue with timing out and not allowing
them to reconnect as a safty feature. We use Citrix Metaframe and I have to reconnect every two hours. to keep a session active. You may need to look into the time your VPN server allows for a session to exist.

If I understand correctly, the error you are getting is from the applications that are left running, not
so much the connection or the OS, right?
0
 
SheaDigitalAuthor Commented:
The error I am getting is on the screen of the system they are remoting into. The system here at the office.

The error pops up when they disconnect the Remote Desktop Session. They are unable to remote back into the system until that error is clicked away.

After reviewing the VPN idea, I'm starting to think it does not matter. I had it happen just here on the LAN, without using a VPN client at all. Also, the other group of users is only on the LAN too so, the VPN client isn't running at all when this is happening for some people.
0
 
SunshineVKCommented:
Is the above mentioned pattern (in the original ?) seen on a particular set of Hardware?
What about the NIC's & Ver. of their respective Drivers?
Did u checked if the System which is being remotely accessed loosing its Network connectivity?
0
 
SheaDigitalAuthor Commented:
That is a good suggestion SunshineVK, I'll try updating the drivers on the NICs and see if that helps. They very well may be loosing their network connectivity.... They are all using similar hardware.
0
 
SunshineVKCommented:
Hi SheaDigital,
Did u manage to get to the Root cause & resolve the above mentioned issue?
0
 
SheaDigitalAuthor Commented:
No I'm sorry. This kinda got put on the back burner due to recent projects I've been working on here. I hope to be able to work on this again soon though.
0
 
SheaDigitalAuthor Commented:
I found out what SAS is. SAS stands for Secure Authentication Sequence. Someone wrote a very good Wikipidia article on Winlogon and SAS.

http://en.wikipedia.org/wiki/Winlogon

So basically it looks like the windows process that handles authentication and login is crashing.
0
 
SheaDigitalAuthor Commented:
I'm giving up on this issue. It seems to have gone away. No clue why.

Perhaps a windows patch did it? Dunno.
0

Featured Post

Receive 1:1 tech help

Solve your biggest tech problems alongside global tech experts with 1:1 help.

  • 8
  • 3
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now