Server 2003 SP1 Terminal Server 'Pause' When Users Log Off

Server 2003 SP1 Terminal Server 'Pause' When Users Log Off

Post by Z3Ro » Wed, 28 Jun 2006 06:45:01


We seem to have an issue in our environment whereby when a user logs off,
occasionally it will cause the entire server to pause for a period of 10-30
seconds (sometimes more, but that is extremely rare).

I found the following Support Document for Windows 2000 and Server 2003
Lanman Server and Workstation services as described in the article.

I also found
CmpRegistryLock value from 30 to 60, but this doesn't seem to have had any
effect either.

We previously just had a Windows Server 2003 (no SP1) environment, and at
the beginning of the year moved to a Windows Server 2003 with Service Pack 1
environment (on both Domain Controllers/File Server/Terminal Servers) and
then the problems have arisen.

This issue seems to affect both Admin and Non-Admin Users and seems to
happen when a server has more than 10 users on. I have tried perfmon and
userenv debugging, but as the server 'pauses' there is no output displayed
from either (permon has no data and userenv debugging pauses as well). Any
mouse clicks/keyboard entries are queued and as soon as the user has logged
off, the server is back to normal and any queued commands run.

I've rebuilt our Terminal Servers from scratch again to rule out any issues
with the image, and the problem still seems to exist. During the pauses, the
CPU and Memory aren't high at all (less than 10%) so I'm confident it isn't a
resource issue. I have also tried enabling Disk Write-Caching and Advanced
Performance as per KB32446 but that has had no effect either. We have two
models of IBM Blade Servers - ones with local SCSI drives and ones with local
EIDE drives and both have the issue. I've updated all firmware to the latest
revisions as well, but with no success.

Does anyone have any ideas? Thanks.

Server 2003 SP1 Terminal Server 'Pause' When Users Log Off

Post by Gregg Hil » Thu, 29 Jun 2006 14:24:09

Event Viewer logs? Look for any "userenv" errors.

Gregg Hill


Server 2003 SP1 Terminal Server 'Pause' When Users Log Off

Post by Z3Ro » Sat, 01 Jul 2006 06:37:02

here are no Userenv errors in the event log, however there are lots of
UPHClean information messages.

We are using UPHClean 1.6d on the servers and it generates the following
message for just about every user log off - there are instances where this
message is generated however and the log off time is fine however (but that
only seems to happen when there are only a few users on the server).

Source: UPHClean
Event ID: 1401

The following handles in user profile hive [domain]\[username]
(S-1-5-21-XXXXXXXX) have been remapped because they were preventing the
profile from unloading successfully:

winlogon.exe (700)
HKCU\Software\Classes (0xa9c)

I've replaced the domain, username and SID in the message above. We used to
use UPHClean 1.6d in our previous build (with no SP1) - so I wonder if maybe
SP1 has changed the way that a users HKCR hive is unloaded and that is
causing the occasional delays?

"Gregg Hill" wrote:


Server 2003 SP1 Terminal Server 'Pause' When Users Log Off

Post by Z3Ro » Sat, 01 Jul 2006 07:43:02

've just been doing some more testing and have noticed something very

All of the servers have Dual Xeon processors with Hyper Threading enabled
(i.e Windows Task Manager shows 4 Processors).

When a user logs off, winlogon.exe jumps to 25% of the overall CPU usage
(100% use on one of the processors in Task Manager) and stays at 100% for the
20-30 seconds or so it takes for the logoff to complete and then drops back
down to 0% CPU and all is back to normal.

So I'm guessing that winlogon.exe isn't multi threaded. I have read some MS
KBs about high CPU from winlogon.exe - but that seems to only apply to
Windows 2000 SP4 and Windows 2003 RTM (and not SP1?). Spoolsv.exe seems to
sit at 0% during the logoff however.

The thing that really stumps me now is how does winlogon.exe maxing itself
out to 100% CPU cause all other sessions on the server to pause? Isn't
winlogon.exe only used during login and logoff?

Other things that might be of importance are - the servers are running
Citrix Presentation Server 4.0 with all of the latest Citrix hotfixes (it
occurs with no hotfixes as well). And all of the servers have East-Asian
Language support enabled and Japanese and French IMEs enabled too (which I
think caused us to have a few STOP 0xAB errors earlier in the year which were
fixed with KB910362 thankfully!!).

"gth" wrote: