asked on

Winlogon and Userdump

Hi, i am troubleshooting some issues we are experiencing logging off/ shutting down terminals and have been using UserModeProcessDumper to monitor the process and provide additional logging.

To confirm it was not our build, i have been using a brand new XP SP3 install and have instructed the app to capture any exceptions created by Winlogon.

I seem to consistantly get Access Violation errors when booting up and shutting down? Is this correct?

The errors seem to point to a null pointer somewhere in Winlogon

Can someone please confirm they also see this? I expected Winlogon to be rock solid.

Thanks

acl-puzz

you mean clients are getting shutdown automatically?if this is correct try follwing

use this gpo path shown in picture attached and delete administrator from it apply and ok and issue gpupdate command

rs.JPG

Jonesey007

ASKER

Hi thanks for reply acl-puzz

Sorry i didnt explain myself very well
We have been experiencing 21A BSODs at shutdown on our build. They are pretty rare and unfortunatly, they have not been leaving any dump files (probably because it is a user mode crash, not kernel)
On our build we modify the GINA so i assumed it had something to do with that. I loaded on UserModeProcessDump and wasnt suprised so see Access Denied errors so thought id check a retail version of XP and to my suprise the errors were still there.
It looks as if there is Null pointer code withing the Winlogon 5.1.2600.5512 application.
I was just wondering if this is to be expected, it could be corrupting some memory which is causing my problem, i was just wondering if an expert here could confirm there are Null pointer errors in Winlogon and tell me if this is expected behaviour.

Thanks

Pete

ASKER CERTIFIED SOLUTION

acl-puzz

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Jonesey007

ASKER

Not really what i was after, but thanks for the help