Search

Windows 2003 Terminal Server Freezing At User Logoff?

Saturday, 12 April 2008 by Michel Roth

Today I ran into this article (actually one of the Provision Networks developers pointed this one out to me) that reads like CSI: Terminal Server. The author of the article explains how they found the cause of SP1 and SP2 2003 Terminal Servers freezing at logoff. The article is very informative in that it shows how the author went about troubleshooting this issue, down to the monitoring of kernel stack traces. The symptom of the problem that was investigated is that:

"when a user logs into or out of a session (seems more pronounced on logoff), ALL users connected to the server experience a ~5-20 second hang. The hang is described as follows:

Application in the session (i.e. Outlook and Word) stop accepting keyboard input. When the hang subsides, the typed characters show up all at once.
If applications are moved, they do not redraw
Cannot click the start menu
If the user was running performance monitor (in an attempt to diagnose), there would be a gap in the perfmon data that directly correlated to the hang duration

Customer has found that during the timeframe of the hang, Winlogon.exe (in session 0) is showing 25% CPU usage."

To me this sounds like a problem that I have encountered several times before. I've seen many causes of this, including supposed hotfixes and service packs (that needlessly to say, did not solve the problem(. I kind of faith in this hotfix though. An associated Microsoft support article has been created. It mentions that this problem occurs because of the way that Windows Server 2003 Service Pack 1 (SP1) or Service Pack 2 (SP2) cleans up user registry information. When a user logs off, there is a five-second delay before Windows Server 2003 SP1 or SP2 flushes the user registry hive. If the terminal server experiences heavy registry activity, the cached registry information on the terminal server may increase significantly. For example, this behavior may occur when a program scans the user profile during the logoff process. When the terminal server experiences heavy registry activity, it takes Windows longer to flush the data.

Read Closing the loop: CPU spike in winlogon.exe.