G
George Rhoads
I distributed 11 hotfixes to a group of 289 XP Pro SP2 systems via SMS last
July. The majority of the computers only installed KB933566 (IE Cumulative
Update), KB935839 (Win32 API), and KB935840 (Schannel). Starting about an
hour after the first reboots, a small number of these systems are giving a
greyed out logon panel when you try to unlock the computer from a password
protected screensaver. The majority of the incidents happened after a timer
invocation of the screensaver (10 minutes by system policy), but there have
been occasions when the user invoked it via Ctrl-Alt-Del - Lock Computer.
When this happens, the user presses Ctrl-Alt-Del to unlock the computer, the
UERID field is blank and greyed out, and the password field is greyed out.
If you hit enter, a logon failure 529 error is generated in the Security
Event Log with a logon type code of 7 (unlock), and the User Name in the
event message is blank. This has been reported on about 15% of the systems
since the original incident. Most people do not experience the incident more
than once or twice, but a small number of computers are seeing it 2 or 3
times a month. The only recovery we have found so far is to power cycle the
machine, so the engineers lose whatever they were working on when they took a
phone call, grabbed a cup of coffee, or whatever. I have not been able to
find anything common between these systems in the Application, Security, or
System event logs at the time of the failure. I have uninstalled one of more
of the hotfixes from computers that have had this problem more than once, but
that has not helped.
I have located two other references to this problem that have suggested
older versions of VNC to be the culprit (most of these computers have version
4.1.2 installed) or a USB mouse (most of these computers still have a PS2
mouse).
July. The majority of the computers only installed KB933566 (IE Cumulative
Update), KB935839 (Win32 API), and KB935840 (Schannel). Starting about an
hour after the first reboots, a small number of these systems are giving a
greyed out logon panel when you try to unlock the computer from a password
protected screensaver. The majority of the incidents happened after a timer
invocation of the screensaver (10 minutes by system policy), but there have
been occasions when the user invoked it via Ctrl-Alt-Del - Lock Computer.
When this happens, the user presses Ctrl-Alt-Del to unlock the computer, the
UERID field is blank and greyed out, and the password field is greyed out.
If you hit enter, a logon failure 529 error is generated in the Security
Event Log with a logon type code of 7 (unlock), and the User Name in the
event message is blank. This has been reported on about 15% of the systems
since the original incident. Most people do not experience the incident more
than once or twice, but a small number of computers are seeing it 2 or 3
times a month. The only recovery we have found so far is to power cycle the
machine, so the engineers lose whatever they were working on when they took a
phone call, grabbed a cup of coffee, or whatever. I have not been able to
find anything common between these systems in the Application, Security, or
System event logs at the time of the failure. I have uninstalled one of more
of the hotfixes from computers that have had this problem more than once, but
that has not helped.
I have located two other references to this problem that have suggested
older versions of VNC to be the culprit (most of these computers have version
4.1.2 installed) or a USB mouse (most of these computers still have a PS2
mouse).