Solved

Windows won't logoff,

Posted on 2009-04-07
16
418 Views
Last Modified: 2012-05-06
We are facing a problem in one of the labs, its joined to the domain, win XP SP3, teh users can't log off, they try few times to log off but nothing happens, event viewer nothing relevant, they end up hard restarting the machine to login, they login normally but can't log off, what could be causing this?
Any help is highly appreciated,
Ruba
0
Comment
Question by:romari
  • 4
  • 3
  • 3
  • +3
16 Comments
 
LVL 6

Expert Comment

by:vertsyeux
ID: 24084941
Unless one or more files are corrupted, it's likely, some service is failing to stop.. I used to see this alot on Windows 98.. You could try disconnecting the network, any USB devices etc before shutting down.. Also, close down services one at a time by running services.msc and any running applications from task manager.. Failing all that, I have seen registry hacks that make Xp machines shut down faster by telling the OS to terminate processes without waiting.. Past the code below into a text file and rename it anything.reg then run from desktop..

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Control Panel\Desktop]
"AutoEndTasks"="1"
"WaitToKillAppTimeout"="200"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
"WaitToKillServiceTimeout"="200"
0
 
LVL 7

Expert Comment

by:tankergoblin
ID: 24085010
have you tried
 CRTL_ALT_DEL
0
 
LVL 7

Expert Comment

by:tankergoblin
ID: 24085025
if you cannot log off using ctrl-alt-del
then i think the problem exists in the user profile.

If you have the administrative access to the system then have a look at the user profile which might need tweaking.
0
 

Expert Comment

by:kamikazis
ID: 24085051
have you tried this ??

goto run and type

shutdown -l -f -t 05
0
 

Expert Comment

by:kamikazis
ID: 24085060
Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry. Click Start, Run and type REGEDIT. Navigate to:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon]

In the right-pane, change the value of Userinit to "C:\WINDOWS\system32\userinit.exe,"

Type the above value exactly as given, including the comma - exclude the quotes. Also, change the path to userinit.exe appropriately, if Windows is installed in a different drive.
0
 
LVL 11

Expert Comment

by:bmatumbura
ID: 24085136
This can also happen if your computers are infected by some virus (I have forgotten the actual name of the virus). I once attended to such an incident where the virus was running as a service. The service name was something like groupware.exe or something like that.

Use a good antivirus with the latest virus definitions to scan the computers for viruses. I recommend F-Secure Anti-Virus.
0
 

Author Comment

by:romari
ID: 24085359
To: vertsyeux:
If I try just to double click the firle as you said (after coying it to notepad and renaming to end with .reg) , it says this is not a script improt it from the register editor.
When I try to import it in the registery I get : Cannot import  a.reg the Key selected is invalid
0
 
LVL 9

Expert Comment

by:Ramanhp
ID: 24085379
try to check ur system files are intact

start >> run >> cmd

here is this window type >>   sfc /scannow

this will take some time to validate ur system files being intact and corrects them

then simply hardboot ur system and check the log off functionality
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 6

Expert Comment

by:vertsyeux
ID: 24085454
romari, it is possibe that you missed part of it..

Copy below this line
--------------------------
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Control Panel\Desktop]
"AutoEndTasks"="1"
"WaitToKillAppTimeout"="200"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
"WaitToKillServiceTimeout"="200"
---------------------------
Copy above this line             
0
 
LVL 6

Expert Comment

by:vertsyeux
ID: 24085458
..also, make sure the cut&paste doesn't insert any newlines - there should be 8 lines, 2 of them blank
0
 

Author Comment

by:romari
ID: 24094352
Ramanhp: I tried the sfc /scannow it completed and after reboot, the problem still exist.
vertsyeux: I missed to copy the Windows REgistery Editor Version 5.0 the first time, now I copied it and the registery file ran properly, but the problem is still the same.
bmatumbura: I downloaded a very good anti virus/antispyeare but hte system is clean.

It must be a process that can't be terminated, but how to determine that?

Is there any other work around I can try?
0
 
LVL 11

Expert Comment

by:bmatumbura
ID: 24094799
Hi Romari, it might not be a virus per se but could also be some other applications, utilities that come with some hardware like webcams, scanners, etc. (that usually run in the background or in the system tray). You could try and troubleshoot as follows on one such machine (this is what I did when I found out that virus; although the antivirus AVG was up to date it couldn't pick the virus)

1. Launch TaskManager
2. Go to the Processes tab
3. Look for suspicious processes i.e. processes that are not normally available in a basic Windows installation
4. End the process
5. Attempt to shutdown Windows
6. Repeat steps 3 - 5 until Windows can shutdown

You may need to download autoruns from http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx. This will show you all processes that launch when Windows starts, including "hidden" processes and services. It would be a good idea to start with these process in step 3.
0
 
LVL 11

Expert Comment

by:bmatumbura
ID: 24094874
I can assist you in determining suspicious processes:

1. Go to the command prompt
2. Execute the command: tasklist /v > tasks.txt
3. Execute the command: notepad tasks.txt
4. Post the tasks.txt as an attachment here at EE
0
 
LVL 11

Expert Comment

by:bmatumbura
ID: 24094902
Also in Autoruns:

1. Go to the Options menu, click "Hide Microsoft and Windows Entries"
2. Select the File menu, click "Refresh F5"
3. Select the File menu, click "Export..." and save
5. Post the Autorun.txt file as an attachment here at EE
0
 
LVL 9

Expert Comment

by:Ramanhp
ID: 24148796
Start Group Policy Editor (Start > Run > gpedit.msc)
In the left panel, go to User Configuration > Administrative Templates > System > Ctrl+Alt+Del Options
In the right panel, DISABLE 'Remove Logoff'
0
 

Accepted Solution

by:
romari earned 0 total points
ID: 24178124
I used msconfig, and tried to clear a startup item at a time, restart and try to log off, we found a software that was causing this problem, an audio control software, removed it and now can log off and shut down.
Thanks for all your help.
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
For both online and offline retail, the cross-channel business is the most recent pattern in the B2C trade space.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now