Windows XP Logon Error

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hello,

We are having problems as we upgrade to Windows XP Service Pack 2 across our
Enterprise. When certain users login, they receive a pop up message stating
a message similar to the following, which is logged in the system event log
under event ID 26: "Application popup: SAS window: winlogon.exe -
Application Error : The exception unknown software exception (0xc0000409)
occurred in the application at location 0x75979eca."

The pop up window forces the user to click OK or Cancel upon which the
machine reboots.

If the same user attempts to login to a machine with Windows XP SP 1 that
has not been upgraded, they can login fine.

The error occurs before the profile loading begins and before any user
settings are applied through group policy. Just to be sure, we reset the
user profile and disable group policy settings on this computer and for this
user. The results are still the same.

If anyone has seen this error or can offer any advice it would be greatly
appreciated.
 
As this happens only for some users, I'd begin by checking their profiles for
malware or parasites. Ad-Aware or Spybot S&D should be suitable.

The fact that it relates to winlogon.exe but only happens for some users
suggests that some process or other is trying to 'hook into' winlogon. As
the winlogon.exe on SP2 differs from that on SP1, this may be why it fails.
The malware woudl likely be in the "temp" or "temporary internet files"
foders of the profile.

The other possibility is that SP2 didn't install fully, so you're left with
a mixture of the system-components from each. This could be checked by
examining the file sizes and timestamps in the system32 folder. Although if
so this should affect all users.
 
Ian,

Thank you for the suggestions. I should have noted a few more items in my
description:
- The PC's are all "fresh" images - they were not upgrades from SP1. There
is no spyware, malware, viruses, etc. on them.
- I've already tried completely purging and restting the entire user profile.
- SP2 was integrated onto the install CD directly from Microsoft, so it was
installed from scratch, unless of course I have bad media from Microsoft.
 
So it's not in the profile, yet it IS user-specific? Hmmm. That doesn't leave
too much. I assume the user's registry hive is being replaced when you
rebuild the profile, if so that excludes registry problems.

What does that leave, then? User permissions, policies? Not much else I can
think of. Might there be a problem with the ACLs on the hard-disk, such that
certain users can't open some system-files?
 
Hi Mike.

I see you are still struggling with this. What I would try is to have the
user that is having the problem logon to a SP2 domain computer that he has
never logged onto before that other users can logon to. I know you reference
roaming profiles in a past post so I would also disable roaming profile for
the problem user temporarily so that he will only be using a new profile
that the operating system would create for him the first time he logs onto a
computer. If that does not help try adding the user to the local
administrators group on a domain computer temporarily to see if that helps
or not. Check the user's account properties/account - account options in
Active Directory Users and Computers to see if account options are the same
as users that do not have the problem. Beyond that I can not think of much
more and Google did not help as this seems to be an uncommon problem but
would suggest that you also post in the Active Directory newsgroup. Also
enable auditing of system events for success and failure, object access for
failure, process tracking for failure, and privilege use for failure on the
client computer in Local Security Policy to see if any helpful events are
recorded the next time the problem occurs. --- Steve
 
Back
Top