[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now


Terminal Server Logoff Hang Issue

Posted on 2009-02-20
Medium Priority
Last Modified: 2013-11-21
I am having issues with terminal service session hanging for all users on a Windows 2003 member server TS.  I can replicate this 90% of the time.  The TS hangs with the "Loggin off..." message.  

The account I can replicate this with does not have a roaming profile.  I created a new user and tested, and it hangs as well, so it wouldn't seem to be profile related.

I enabled user environment debugging (UserEnvDebugLevel), and nothing is written to the log until the hang ends and the user is logged off, which is contained below.  

If I look at the processes running for the user in TS Manager, there are just two - winlogon.exe and csrss.exe.  

Are there any other tools I can use to analyze what is, or is not, happening?

USERENV(1228.2c4) 13:30:13:773 UnloadUserProfile: Entering, hProfile = <0x2cc>
USERENV(1228.2c4) 13:30:13:783 UnloadUserProfile: no thread token found, impersonating self.
USERENV(1228.2c4) 13:30:13:783 GetInterface: Returning rpc binding handle
USERENV(164.678) 13:30:13:783 IProfileSecurityCallBack: client authenticated.
USERENV(164.678) 13:30:13:783 DropClientContext: Got client token 0000017C, sid = S-1-5-18
USERENV(164.678) 13:30:13:793 MIDL_user_allocate enter
USERENV(164.678) 13:30:13:793 DropClientContext: load profile object successfully made
USERENV(164.678) 13:30:13:793 DropClientContext: Returning 0
USERENV(1228.2c4) 13:30:13:793 UnLoadUserProfile: Calling DropClientToken (as self) succeeded
USERENV(164.a60) 13:30:13:793 IProfileSecurityCallBack: client authenticated.
USERENV(164.a60) 13:30:13:803 UnloadUserProfileP: Entering, hProfile = <0x860>
USERENV(164.a60) 13:30:13:803 UnloadUserProfileP: ImpersonateUser <0000017c>, old token is <00000000>
USERENV(164.a60) 13:30:13:803 GetExclusionListFromRegistry: Policy list is empty, returning user list = <Local Settings;Temporary Internet Files;History;Temp>
USERENV(164.a60) 13:30:13:803 CSyncManager::EnterLock <S-1-5-21-680238085-3737085700-983838587-8136>
USERENV(164.a60) 13:30:13:803 CSyncManager::EnterLock: No existing entry found
USERENV(164.a60) 13:30:13:803 CSyncManager::EnterLock: New entry created
USERENV(164.a60) 13:30:13:813 CHashTable::HashAdd: S-1-5-21-680238085-3737085700-983838587-8136 added in bucket 15
USERENV(164.a60) 13:30:13:813 UnloadUserProfileP: Wait succeeded.  In critical section.
USERENV(164.a60) 13:30:13:813 UnloadUserProfileP:  Didn't unload user profile, Ref Count is 6
USERENV(164.a60) 13:30:13:813 UnloadUserProfileP: About Reverted back to user <00000000>
USERENV(164.a60) 13:30:13:813 CSyncManager::LeaveLock <S-1-5-21-680238085-3737085700-983838587-8136>
USERENV(164.a60) 13:30:13:813 CSyncManager::LeaveLock: Lock released
USERENV(164.a60) 13:30:13:823 CHashTable::HashDelete: S-1-5-21-680238085-3737085700-983838587-8136 deleted
USERENV(164.a60) 13:30:13:823 CSyncManager::LeaveLock: Lock deleted
USERENV(164.a60) 13:30:13:823 UnloadUserProfileP: Leave critical section.
USERENV(164.a60) 13:30:13:823 UnloadUserProfileP: Leaving with a return value of 1
USERENV(164.a60) 13:30:13:823 UnloadUserProfileI: returning 0
USERENV(1228.2c4) 13:30:13:823 UnloadUserProfile: Calling UnloadUserProfileI succeeded
USERENV(164.678) 13:30:13:833 IProfileSecurityCallBack: client authenticated.
USERENV(164.678) 13:30:13:833 ReleaseClientContext: Releasing context
USERENV(164.678) 13:30:13:833 ReleaseClientContext_s: Releasing context
USERENV(164.678) 13:30:13:833 MIDL_user_free enter
USERENV(1228.2c4) 13:30:13:833 ReleaseInterface: Releasing rpc binding handle
USERENV(1228.2c4) 13:30:13:833 UnloadUserProfile: returning 1

Open in new window

Question by:SafetyNet-TC
  • 3

Author Comment

ID: 23696266
I saw this in my research and rejected it because of the fact that I'm testing on an account without a roaming profile.

Nonetheless, I just installed it and it made no difference.  Logoff's still hang.


Author Comment

ID: 23724576
Any other takers?

Expert Comment

ID: 23826631
Checkout any 3rd Party apps that are running when a user logs in. It maybe a task trying to end, but the user doesn't have the rights to do so.

To troubleshoot this I would log in the normal user, then log in on a separate session as Administrator. then manually end a suspect task, then see if the user can log off cleanly. Long winded I know, but may be useful.



Accepted Solution

SafetyNet-TC earned 0 total points
ID: 24118562
This problem went away on it's own.

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The question has been asked on multiple occasions as to how best to do printing in a remote desktop or terminal services environment.   It seems that this particular question has plagued several people and most especially as Terminal Services, as…
On a regular basis I get questions about slow RDP performance, RDP connection problems, strange errors and even BSOD, remote computers freezing or restarting after initiation of a remote session. In a lot of this cases the quick solutions made b…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…
Is your OST file inaccessible, Need to transfer OST file from one computer to another? Want to convert OST file to PST? If the answer to any of the above question is yes, then look no further. With the help of Stellar OST to PST Converter, you can e…

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question