All has been running normally, this just started to happen with a relatively new SBS 2011 standard Server. I tried to RDP to the server with admin logon credientials, the logon proceeded, there was a quick flash of the welcome screen and then just a black screen with the mouse cursor. The cursor could move around freely but clicking and keyboard commands had no effect. When clicking on the X on the activity bar, it disconnected as normal. I tried logging on via RWW as admin, and the exact same problem.
Email, RWW, OWA and all other services were running normally, and the client never called to say there was a problem. Next morning before going to the client, an odd entry in the monitoring reports was event ids 20 and 4005 with the following:
event id 20
11/1/2011 11:23:55 PM
Attempt to send connect message to Windows video subsystem failed. The relevant status code was 0xd0000001.
event id 4005
11/1/2011 11:23:55 PM
The Windows logon process has unexpectedly terminated.
I went over to the client and tried to log on directly to the server, same situation, just a black screen with white cursor, nothing else. Didnt want to cold reboot the server so I went to a client workstation and was able to RDP from there as admin. No problems there, was able to logon, see the normal desktop and gracefully restart the server. After the restart I was able to log in as admin directly onto the server with out a problem. I immediately checked the event log and saw this:
event id 1511
Source: Microsoft-Windows-User Profiles Service
Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.
This is not good as this is the admin account. All research I have done relates to recreating a profile on a workstation but this is SBS2011
Have been having some continual sharepoint problems as well since the SP1 install that Susan Bradly has submitted bug reports on to microsoft, I dont know if this is related or not but the daily sharepoint errors include:
5586 and 5767 as well as Powershell event id 3276.
Sorry for the long post, I just dont want all these problems to snowball into a huge mess.
Thank you in advance for any assistance.