Just setup new network, server = brand new Dell server with Server2003R2 , and 10 workstations, again all brand new running XPPro.

Server is providing DHCP + DNS , and is also a file server. AD is installed. Network is behind a FW, Server has AV and clients have AV + software FW (AVG SBS edition)

Everything works as it should, but sometimes (once in 3 weeks at most) when a user logs in to a workstation, after they enter there details and logon, the logon boxs appears then immediately logs off again (before desktop loads in). So the user has to enter login details again - and this time it logs in fine, always 100% OK the second time. So when the problem appears (as I say its very infrequent) after logging in for the second attempt always works.

It happens with different usernames, and different workstations.

Anyone ever experienced this?

Setup is Router/Modem/FW - Switch - PCs

Thanks

Yeah i have seen this. Were the workstations cloned? If so did you run something like newsid.exe on them after cloning?

Thanks

Hi there , thanks for reply - no the workstations were not cloned.........they were just taken out the box, installed the latest updates (to SP3), then joined them to the domain...........they are just normal HP workstations with XPPro preinstalled.........

Does it happen in safe mode? And what happens if you leave a pc at the CTRL+ALT+DEL screen for 5 minutes before logging on?
Thanks

It will be hard to get it to do it in safe mode, as its so random, ie you would need to start every PC in safe mode until the problem occured, if you know what I mean...........RE CTRL+ALT+DEL, I have never tried that - and again the problem is so random I would never know if the "5 min wait" has affected the login or if it was a coincidence..........


Its almost as if the XP machines are logging in too quickly?? maybe the sever is not processing the login request quick enough (but only sometimes?).....

Yeah i think a service or somthing is not getting chance to initialize, try booting up and logging on as quick as possible see if you can replicate the problem.
This problem is so annoying and i cant remember for the life of me how i have fixed it in the past


BTW does the event viewer log anything worth paying attention to?

Actually, the last time I saw this problem it was the ATI drivers and winlogon hooks causing the problem. Enable process and login auditing on the domain for your workstations, and when it happens go back to the security logs to trace it back.

Thanks again for the replys Eyeball and Cluberti.

Eyeball: The event viewer hasn't been showing much of interest........yeah its really a minor inconvienience more than anything else, I get the impression the problem isn't going to get "worse".......but it happens when the Server has been on for hours, it really can happen anytime, ie the workstation may have been on for 3 hours, then I will log off and on again through all the usernames, and it may happen after the 20th logon/logoff.

Cluberti - Hi there , that makes sense, all workstation has ATI vidcard/drivers - I will enable process and login auditing and trace back the security logs..........and if this is the problem update the drivers?.............although all workstations are buisness network HP PCs (dx2250 range), I would have thought tests would have been done for compatibility with server 2003(R2)...........

Actually, you would want to UNINSTALL drivers and ATI software and reinstall with the most minimal driver set possible (no supporting software, reinstall JUST DRIVERS).

Cluberti, can you explain/remember what was happening when you last saw it? Im genuinely interested

Yeah, one of the ATI .dlls loaded, caused one of the ATI .exes to crash, which caused csrss to fail to load, thus causing winlogon to log the user off (which is apparently expected when this type of crash occurs). This is (one of the many reasons) why Vista / 2008 winlogon doesn't allow hooking anymore. Too many vendors doing things they shouldn't, causing crashes, and causing system instability.

Hmm, thats interesting stuff, wonder why it works second time around and doesnt produce the same error? I wasnt aware Nt 6.0 doesnt allow winlogon hooking so thanks!

Great advice, after doing a bit of googling after your ATI suggestion, I am now pretty sure thats the problem - and found this which I will try on Thursday and report back:

http://forums.techguy.org/windows-nt-2000-...e-event-id.html

Thanks again

Hi There

Quick update - yes that cured the problem.......not had to logon twice since got rid of the ATI nonsense!

Thanks again