session stack in Terminal server when logginh off


recetly sometimes the users session in terminal is stack in the loggng-off proccess.

only force dissconecting the session clearing up the session, what can be the cause(win 2003 R2)?

Who is Participating?
John Gates, CISSPConnect With a Mentor Security ProfessionalCommented:
This will give you the reason for the issue:

You may want to turn on debug logging to troubleshoot - 221833 - How to enable user environment debug logging in retail builds of Windows
can you post the event logs, and also check the processor and memory usage,
Also make sure that there are extra startup applications or services, normally it hangs because when windows is unable to close an application which in turn is accessed by system but initiated by terminal user.
What Kind of Coding Program is Right for You?

There are many ways to learn to code these days. From coding bootcamps like Flatiron School to online courses to totally free beginner resources. The best way to learn to code depends on many factors, but the most important one is you. See what course is best for you.

ymg800Author Commented:

here are the even logs, nothing suspicuse there:(the event occures at 3 pm)

memory and cpu are ok as well..
there user didnt opened any program in the session just tested log-in and off and it stucked...

about the artical, it's saying to "obtain the latest service pack for Windows NT Server version 4.0"

but i have win 2003 r2 so not relevant...

what can i check more?

If you do not have User Profile hive cleanup, get it and it should resolve your issue on the win2k3.
John Gates, CISSPSecurity ProfessionalCommented:
That needs to be installed on the server.  I would still also recommend turning on the logging in case you have an application that is having trouble closing that is not involved in a user profile.

ymg800Author Commented:
dimante, u mean to turn on logg-ng debugging?
John Gates, CISSPSecurity ProfessionalCommented:
From the article:

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756  How to back up and restore the registry in Windows

Use Registry Editor to add or to modify the following registry entry:
Subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry: UserEnvDebugLevel
Value data: 10002 (Hexadecimal)
UserEnvDebugLevel can have the following values:
NONE 0x00000000
NORMAL 0x00000001
VERBOSE 0x00000002
LOGFILE 0x00010000
DEBUGGER 0x00020000
The default value is NORMAL|LOGFILE (0x00010001).

Note To disable logging, select NONE (0x00000000).

You can combine these values. For example, you can combine VERBOSE 0x00000002 and LOGFILE 0x00010000 to get 0x00010002. Therefore, if UserEnvDebugLevel is given a value of 0x00010002, LOGFILE and VERBOSE are both turned on. Combining these values is the same as using an OR statement.
0x00010000 OR 0x00000002 = 0x00010002
Note If you set UserEnvDebugLevel to 0x00030002, the most verbose details are logged in the Userenv.log file.

The log file is written to the %Systemroot%\Debug\UserMode\Userenv.log file. If the Userenv.log file is larger than 300 KB, the file is renamed Userenv.bak, and a new Userenv.log file is created. This action occurs when a user logs on locally or by using Terminal Services, and the Winlogon process starts. However, because the size check only occurs when a user logs on, the Userenv.log file may grow beyond the 300 KB limit.

Although the 300-KB limit cannot be modified, you can set the read-only attribute on the Userenv.bak file, and the Userenv.log file will grow indefinitely. You must only use this method temporarily, remove the read-only attribute on the Userenv.bak file as soon as you are finished troubleshooting.
Back to the top
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.
ymg800Author Commented:
is there a simpler way?

nothing can be writen in the system logs?

thanks a head.
John Gates, CISSPSecurity ProfessionalCommented:
Unfortunately it is not a simple problem.  There are so many things it could be there is no way without logging the interactions to see where the problem is.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.