Client login on TS triggers msiexec.exe problem

[Guest Kjell]

Hi

 

I'm having this wierd problem with my TS Win2003 Std Ed

 

Some but not all clients triggers 1, 2 or 3 processes of msiexec.exe when

login in with remote desktop (mstsc.exe).

This might be a completely normally behaivour, but the pattern I have makes

it a problem, and I've never seen this before.

 

1. The msiexec.exe locks up 50-70% of the resources,making it into a severe

lagging situation for all.

 

2. It never stops, the same host machine (client) will trigger the same set

of msiexec.exe running for identical period of time every *** time it's login

in, it doesn't matter if I'm login in using a domain account or a local

account, it's the client machine that triggers it.

 

3. The clients machines having this problem sticks to it's own time perios,

some has a 20 min running of the msiexec.exe, other makes it into a 10 min

run, it's pretty much the identical time period at every login attempt, and

this is individual to each host machine (client)

 

4. Other host machine NEVER triggers the msiexec.exe no matter how I try.

 

I cannot see any pattern on our client machines, they are all WinXP pro,

some with SP2 + some extra, other with SP2 and all extra, and some with SP3

and extra.

 

I've searched the internet for any topic about msiexec.exe running by itself

but to no luck

 

This behaivour started about 4-6 weeks ago so it has not been like this

since day one, I beleive it started about after I run a couple of cycles of

Microsoft update on the server.

 

Does anyone have any clue to what could be causing this?

Please, I would be very happy to find a solution.

 

 

Kjell

[Guest Patrick Rouse]

RE: Client login on TS triggers msiexec.exe problem

 

Does this happen on the RDP Host (Terminal Server) or on the client machine?

If it's happening when users logon to a Terminal Server, it's because

something in the shadow key of the registry is newer than what is in HKCU.

You can view entries in the shadow key at:

 

hklm\software\microsoft\windows nt\CurrentVersion\Terminal Server\Install

 

Items are entered into this key when a session is placed in install mode via

any setup.exe, add/remove programs or "change user /install". This is the

mechanism used to propagate settings to all users when an administrator

installs a program. The problem is that most administrators are unaware of

this, and perform some action while in install mode that unintentionally

affects users.

 

Another thing that can cause this is an application that gets installed, the

system is install mode but after a reboot the administrator opens the

application the first time and runonce or launching the application causes

msiexec to complete the setup. In cases like this you'll need to put the

system in install mode when you open the problematic application for the

first time as an administrator, so the settings can be propagated to the

shadow key.

 

 

--

Patrick C. Rouse

Microsoft MVP - Terminal Server

Systems Consultant

Quest Software, Provision Networks Division

Virtual Client Solutions

http://www.provisionnetworks.com

 

 

"Kjell" wrote:

> Hi

>

> I'm having this wierd problem with my TS Win2003 Std Ed

>

> Some but not all clients triggers 1, 2 or 3 processes of msiexec.exe when

> login in with remote desktop (mstsc.exe).

> This might be a completely normally behaivour, but the pattern I have makes

> it a problem, and I've never seen this before.

>

> 1. The msiexec.exe locks up 50-70% of the resources,making it into a severe

> lagging situation for all.

>

> 2. It never stops, the same host machine (client) will trigger the same set

> of msiexec.exe running for identical period of time every *** time it's login

> in, it doesn't matter if I'm login in using a domain account or a local

> account, it's the client machine that triggers it.

>

> 3. The clients machines having this problem sticks to it's own time perios,

> some has a 20 min running of the msiexec.exe, other makes it into a 10 min

> run, it's pretty much the identical time period at every login attempt, and

> this is individual to each host machine (client)

>

> 4. Other host machine NEVER triggers the msiexec.exe no matter how I try.

>

> I cannot see any pattern on our client machines, they are all WinXP pro,

> some with SP2 + some extra, other with SP2 and all extra, and some with SP3

> and extra.

>

> I've searched the internet for any topic about msiexec.exe running by itself

> but to no luck

>

> This behaivour started about 4-6 weeks ago so it has not been like this

> since day one, I beleive it started about after I run a couple of cycles of

> Microsoft update on the server.

>

> Does anyone have any clue to what could be causing this?

> Please, I would be very happy to find a solution.

>

>

> Kjell

[Guest Kjell]

RE: Client login on TS triggers msiexec.exe problem

 

Thanks Patrick for your input.

 

It's on the TS that the process is being triggered.

it's 1, 2 or sometimes 3 lines of msiexec that is running in SYSTEM account

but only one of them has heavily as 50-70%

 

 

Do I need to put the TS in install mode before I run for example Microsoft

Update?

I thought that Win2003 TS changed into install mode by itself if no users

was logged on and I'm running for example MS update from the console.

 

is this correct or not?

 

 

Is there any "General process" I can do to set it all staight at once.

 

I'm finding your input very interesting, well, nothing I tried so far makes

any differences.

 

bear in mind, I can see a clear pattern that the login profile (user

account) has nothing to do with it, it's purely something between the host

and the TS

 

On of the machine I can use for testing this problem is not triggering this

problem at all, no matter which account I'm using to "remote desktop" to the

TS

 

But I have machines built before and after this machine having this problem!

 

Can you tell me more on how to examine the shadow key section, what to look

for to verify if this really is the problem etc.

 

 

Kjell

 

 

"Patrick Rouse" wrote:

> Does this happen on the RDP Host (Terminal Server) or on the client machine?

> If it's happening when users logon to a Terminal Server, it's because

> something in the shadow key of the registry is newer than what is in HKCU.

> You can view entries in the shadow key at:

>

> hklm\software\microsoft\windows nt\CurrentVersion\Terminal Server\Install

>

> Items are entered into this key when a session is placed in install mode via

> any setup.exe, add/remove programs or "change user /install". This is the

> mechanism used to propagate settings to all users when an administrator

> installs a program. The problem is that most administrators are unaware of

> this, and perform some action while in install mode that unintentionally

> affects users.

>

> Another thing that can cause this is an application that gets installed, the

> system is install mode but after a reboot the administrator opens the

> application the first time and runonce or launching the application causes

> msiexec to complete the setup. In cases like this you'll need to put the

> system in install mode when you open the problematic application for the

> first time as an administrator, so the settings can be propagated to the

> shadow key.

>

>

> --

> Patrick C. Rouse

> Microsoft MVP - Terminal Server

> Systems Consultant

> Quest Software, Provision Networks Division

> Virtual Client Solutions

> http://www.provisionnetworks.com

>

>

> "Kjell" wrote:

>

> > Hi

> >

> > I'm having this wierd problem with my TS Win2003 Std Ed

> >

> > Some but not all clients triggers 1, 2 or 3 processes of msiexec.exe when

> > login in with remote desktop (mstsc.exe).

> > This might be a completely normally behaivour, but the pattern I have makes

> > it a problem, and I've never seen this before.

> >

> > 1. The msiexec.exe locks up 50-70% of the resources,making it into a severe

> > lagging situation for all.

> >

> > 2. It never stops, the same host machine (client) will trigger the same set

> > of msiexec.exe running for identical period of time every *** time it's login

> > in, it doesn't matter if I'm login in using a domain account or a local

> > account, it's the client machine that triggers it.

> >

> > 3. The clients machines having this problem sticks to it's own time perios,

> > some has a 20 min running of the msiexec.exe, other makes it into a 10 min

> > run, it's pretty much the identical time period at every login attempt, and

> > this is individual to each host machine (client)

> >

> > 4. Other host machine NEVER triggers the msiexec.exe no matter how I try.

> >

> > I cannot see any pattern on our client machines, they are all WinXP pro,

> > some with SP2 + some extra, other with SP2 and all extra, and some with SP3

> > and extra.

> >

> > I've searched the internet for any topic about msiexec.exe running by itself

> > but to no luck

> >

> > This behaivour started about 4-6 weeks ago so it has not been like this

> > since day one, I beleive it started about after I run a couple of cycles of

> > Microsoft update on the server.

> >

> > Does anyone have any clue to what could be causing this?

> > Please, I would be very happy to find a solution.

> >

> >

> > Kjell

[Guest Patrick Rouse]

RE: Client login on TS triggers msiexec.exe problem

 

2003 goes into install mode automatically anytime an administrator launches

setup.exe or an installation via add/remove programs.

 

You could use process explorer to see what is spawning msiexec, or look in

the shadow key for anyting that might be using runonce.

 

If you have more than one TS, you could compare the entries in the shadow

key of the two machines, to see what's different.

 

The shadow key is NOT a requirement, as some consultants completely delete

the entries in this key and script the required entries into HKCU at logon.

This is most common with Login Consultants Solution4 Framework. This however

does require a very good understanding of how your applications work.

 

You could also logon as a new administrative account, go into install mode

and let msiexec complete the installation of whatever program is triggering

this installation. After it's done, switch to execute mode via "change user

/execute"

 

 

 

--

Patrick C. Rouse

Microsoft MVP - Terminal Server

Systems Consultant

Quest Software, Provision Networks Division

Virtual Client Solutions

http://www.provisionnetworks.com

 

 

"Kjell" wrote:

> Thanks Patrick for your input.

>

> It's on the TS that the process is being triggered.

> it's 1, 2 or sometimes 3 lines of msiexec that is running in SYSTEM account

> but only one of them has heavily as 50-70%

>

>

> Do I need to put the TS in install mode before I run for example Microsoft

> Update?

> I thought that Win2003 TS changed into install mode by itself if no users

> was logged on and I'm running for example MS update from the console.

>

> is this correct or not?

>

>

> Is there any "General process" I can do to set it all staight at once.

>

> I'm finding your input very interesting, well, nothing I tried so far makes

> any differences.

>

> bear in mind, I can see a clear pattern that the login profile (user

> account) has nothing to do with it, it's purely something between the host

> and the TS

>

> On of the machine I can use for testing this problem is not triggering this

> problem at all, no matter which account I'm using to "remote desktop" to the

> TS

>

> But I have machines built before and after this machine having this problem!

>

> Can you tell me more on how to examine the shadow key section, what to look

> for to verify if this really is the problem etc.

>

>

> Kjell

>

>

> "Patrick Rouse" wrote:

>

> > Does this happen on the RDP Host (Terminal Server) or on the client machine?

> > If it's happening when users logon to a Terminal Server, it's because

> > something in the shadow key of the registry is newer than what is in HKCU.

> > You can view entries in the shadow key at:

> >

> > hklm\software\microsoft\windows nt\CurrentVersion\Terminal Server\Install

> >

> > Items are entered into this key when a session is placed in install mode via

> > any setup.exe, add/remove programs or "change user /install". This is the

> > mechanism used to propagate settings to all users when an administrator

> > installs a program. The problem is that most administrators are unaware of

> > this, and perform some action while in install mode that unintentionally

> > affects users.

> >

> > Another thing that can cause this is an application that gets installed, the

> > system is install mode but after a reboot the administrator opens the

> > application the first time and runonce or launching the application causes

> > msiexec to complete the setup. In cases like this you'll need to put the

> > system in install mode when you open the problematic application for the

> > first time as an administrator, so the settings can be propagated to the

> > shadow key.

> >

> >

> > --

> > Patrick C. Rouse

> > Microsoft MVP - Terminal Server

> > Systems Consultant

> > Quest Software, Provision Networks Division

> > Virtual Client Solutions

> > http://www.provisionnetworks.com

> >

> >

> > "Kjell" wrote:

> >

> > > Hi

> > >

> > > I'm having this wierd problem with my TS Win2003 Std Ed

> > >

> > > Some but not all clients triggers 1, 2 or 3 processes of msiexec.exe when

> > > login in with remote desktop (mstsc.exe).

> > > This might be a completely normally behaivour, but the pattern I have makes

> > > it a problem, and I've never seen this before.

> > >

> > > 1. The msiexec.exe locks up 50-70% of the resources,making it into a severe

> > > lagging situation for all.

> > >

> > > 2. It never stops, the same host machine (client) will trigger the same set

> > > of msiexec.exe running for identical period of time every *** time it's login

> > > in, it doesn't matter if I'm login in using a domain account or a local

> > > account, it's the client machine that triggers it.

> > >

> > > 3. The clients machines having this problem sticks to it's own time perios,

> > > some has a 20 min running of the msiexec.exe, other makes it into a 10 min

> > > run, it's pretty much the identical time period at every login attempt, and

> > > this is individual to each host machine (client)

> > >

> > > 4. Other host machine NEVER triggers the msiexec.exe no matter how I try.

> > >

> > > I cannot see any pattern on our client machines, they are all WinXP pro,

> > > some with SP2 + some extra, other with SP2 and all extra, and some with SP3

> > > and extra.

> > >

> > > I've searched the internet for any topic about msiexec.exe running by itself

> > > but to no luck

> > >

> > > This behaivour started about 4-6 weeks ago so it has not been like this

> > > since day one, I beleive it started about after I run a couple of cycles of

> > > Microsoft update on the server.

> > >

> > > Does anyone have any clue to what could be causing this?

> > > Please, I would be very happy to find a solution.

> > >

> > >

> > > Kjell

[Guest Kjell]

RE: Client login on TS triggers msiexec.exe problem

 

Thanks Patrick

 

I'll try your suggestions the coming days, now it's time to hit the sack

(00:22)

 

 

Kjell

 

 

"Patrick Rouse" wrote:

> 2003 goes into install mode automatically anytime an administrator launches

> setup.exe or an installation via add/remove programs.

>

> You could use process explorer to see what is spawning msiexec, or look in

> the shadow key for anyting that might be using runonce.

>

> If you have more than one TS, you could compare the entries in the shadow

> key of the two machines, to see what's different.

>

> The shadow key is NOT a requirement, as some consultants completely delete

> the entries in this key and script the required entries into HKCU at logon.

> This is most common with Login Consultants Solution4 Framework. This however

> does require a very good understanding of how your applications work.

>

> You could also logon as a new administrative account, go into install mode

> and let msiexec complete the installation of whatever program is triggering

> this installation. After it's done, switch to execute mode via "change user

> /execute"

>

>

>

> --

> Patrick C. Rouse

> Microsoft MVP - Terminal Server

> Systems Consultant

> Quest Software, Provision Networks Division

> Virtual Client Solutions

> http://www.provisionnetworks.com

>

>

> "Kjell" wrote:

>

> > Thanks Patrick for your input.

> >

> > It's on the TS that the process is being triggered.

> > it's 1, 2 or sometimes 3 lines of msiexec that is running in SYSTEM account

> > but only one of them has heavily as 50-70%

> >

> >

> > Do I need to put the TS in install mode before I run for example Microsoft

> > Update?

> > I thought that Win2003 TS changed into install mode by itself if no users

> > was logged on and I'm running for example MS update from the console.

> >

> > is this correct or not?

> >

> >

> > Is there any "General process" I can do to set it all staight at once.

> >

> > I'm finding your input very interesting, well, nothing I tried so far makes

> > any differences.

> >

> > bear in mind, I can see a clear pattern that the login profile (user

> > account) has nothing to do with it, it's purely something between the host

> > and the TS

> >

> > On of the machine I can use for testing this problem is not triggering this

> > problem at all, no matter which account I'm using to "remote desktop" to the

> > TS

> >

> > But I have machines built before and after this machine having this problem!

> >

> > Can you tell me more on how to examine the shadow key section, what to look

> > for to verify if this really is the problem etc.

> >

> >

> > Kjell

> >

> >

> > "Patrick Rouse" wrote:

> >

> > > Does this happen on the RDP Host (Terminal Server) or on the client machine?

> > > If it's happening when users logon to a Terminal Server, it's because

> > > something in the shadow key of the registry is newer than what is in HKCU.

> > > You can view entries in the shadow key at:

> > >

> > > hklm\software\microsoft\windows nt\CurrentVersion\Terminal Server\Install

> > >

> > > Items are entered into this key when a session is placed in install mode via

> > > any setup.exe, add/remove programs or "change user /install". This is the

> > > mechanism used to propagate settings to all users when an administrator

> > > installs a program. The problem is that most administrators are unaware of

> > > this, and perform some action while in install mode that unintentionally

> > > affects users.

> > >

> > > Another thing that can cause this is an application that gets installed, the

> > > system is install mode but after a reboot the administrator opens the

> > > application the first time and runonce or launching the application causes

> > > msiexec to complete the setup. In cases like this you'll need to put the

> > > system in install mode when you open the problematic application for the

> > > first time as an administrator, so the settings can be propagated to the

> > > shadow key.

> > >

> > >

> > > --

> > > Patrick C. Rouse

> > > Microsoft MVP - Terminal Server

> > > Systems Consultant

> > > Quest Software, Provision Networks Division

> > > Virtual Client Solutions

> > > http://www.provisionnetworks.com

> > >

> > >

> > > "Kjell" wrote:

> > >

> > > > Hi

> > > >

> > > > I'm having this wierd problem with my TS Win2003 Std Ed

> > > >

> > > > Some but not all clients triggers 1, 2 or 3 processes of msiexec.exe when

> > > > login in with remote desktop (mstsc.exe).

> > > > This might be a completely normally behaivour, but the pattern I have makes

> > > > it a problem, and I've never seen this before.

> > > >

> > > > 1. The msiexec.exe locks up 50-70% of the resources,making it into a severe

> > > > lagging situation for all.

> > > >

> > > > 2. It never stops, the same host machine (client) will trigger the same set

> > > > of msiexec.exe running for identical period of time every *** time it's login

> > > > in, it doesn't matter if I'm login in using a domain account or a local

> > > > account, it's the client machine that triggers it.

> > > >

> > > > 3. The clients machines having this problem sticks to it's own time perios,

> > > > some has a 20 min running of the msiexec.exe, other makes it into a 10 min

> > > > run, it's pretty much the identical time period at every login attempt, and

> > > > this is individual to each host machine (client)

> > > >

> > > > 4. Other host machine NEVER triggers the msiexec.exe no matter how I try.

> > > >

> > > > I cannot see any pattern on our client machines, they are all WinXP pro,

> > > > some with SP2 + some extra, other with SP2 and all extra, and some with SP3

> > > > and extra.

> > > >

> > > > I've searched the internet for any topic about msiexec.exe running by itself

> > > > but to no luck

> > > >

> > > > This behaivour started about 4-6 weeks ago so it has not been like this

> > > > since day one, I beleive it started about after I run a couple of cycles of

> > > > Microsoft update on the server.

> > > >

> > > > Does anyone have any clue to what could be causing this?

> > > > Please, I would be very happy to find a solution.

> > > >

> > > >

> > > > Kjell

[Guest Kjell]

RE: Client login on TS triggers msiexec.exe problem

 

Hi

 

There are a few things I do not understand in the concept of shadow key and

my problem.

 

First let me point out. I'm NOT using roaming profiles......

it's even more scaring, half the users are still running lokal accounts on

the TS

 

I do have 2 TS, one for accounting and one for production dep.

apart of maybe 3-4 users they do not host the same set of users.

I do not understand why the shadow key section in these 2 TS should be at

all the same as suggested by several articles in this topic?

They got completely different sets of applications installed since they are

ment to do 2 different things for mostly 2 different set of users...

 

Another thing that bugs the ** out of me: HKCU is the part of win-registry

where user profile settings are, especially the currently logged on user,

right...

How is this affecting the H/W machine running the RDP (remote desktop)

session?, or actually how can the H/W machine running remote desktop affect

the HKCU on the TS

I have several machines, some having this problem other is not, I'm logging

in using the same account on the TS, meaning I'm loading up the same HKCU

from different client machines (WinXP)......

 

I thought that the only interaction between WinXP running the RDP against a

TS and the TS was redirection of printers and some network shares/drives,

and clipboard and maybe a couple of other things, but the shadow key in my

eyes is more of settings for Installed applications on the TS and a way to

propagate this to/from all user profiles on the same TS by using time stamps.

 

Meaning in my world: I should get the same error/problem no matter which H/W

(WinXP) am using as long as I'm using the same account on the TS when loging

in.

 

but I'm not, my problem follows the H/W (winXP) i choose, not the login

account.....

 

Can you confirm that the shadow key functionality in fact is affected by the

client machine H/W (WinXp).

 

 

PS

I tried login in using an extra Domain admin account and while in the

desktop session changing the mode into "install" in order to let the msiexec

do whatever it is suppose to do. no difference. it took like 20 mins until

msiexec disappeared from processes, I changed the mode back to "execute"

logged off and the logged on again, still the same problem, msiexec got

loaded again and it took 20 mins.

 

 

Kjell

 

"Patrick Rouse" wrote:

> 2003 goes into install mode automatically anytime an administrator launches

> setup.exe or an installation via add/remove programs.

>

> You could use process explorer to see what is spawning msiexec, or look in

> the shadow key for anyting that might be using runonce.

>

> If you have more than one TS, you could compare the entries in the shadow

> key of the two machines, to see what's different.

>

> The shadow key is NOT a requirement, as some consultants completely delete

> the entries in this key and script the required entries into HKCU at logon.

> This is most common with Login Consultants Solution4 Framework. This however

> does require a very good understanding of how your applications work.

>

> You could also logon as a new administrative account, go into install mode

> and let msiexec complete the installation of whatever program is triggering

> this installation. After it's done, switch to execute mode via "change user

> /execute"

>

>

>

> --

> Patrick C. Rouse

> Microsoft MVP - Terminal Server

> Systems Consultant

> Quest Software, Provision Networks Division

> Virtual Client Solutions

> http://www.provisionnetworks.com

>

>

> "Kjell" wrote:

>

> > Thanks Patrick for your input.

> >

> > It's on the TS that the process is being triggered.

> > it's 1, 2 or sometimes 3 lines of msiexec that is running in SYSTEM account

> > but only one of them has heavily as 50-70%

> >

> >

> > Do I need to put the TS in install mode before I run for example Microsoft

> > Update?

> > I thought that Win2003 TS changed into install mode by itself if no users

> > was logged on and I'm running for example MS update from the console.

> >

> > is this correct or not?

> >

> >

> > Is there any "General process" I can do to set it all staight at once.

> >

> > I'm finding your input very interesting, well, nothing I tried so far makes

> > any differences.

> >

> > bear in mind, I can see a clear pattern that the login profile (user

> > account) has nothing to do with it, it's purely something between the host

> > and the TS

> >

> > On of the machine I can use for testing this problem is not triggering this

> > problem at all, no matter which account I'm using to "remote desktop" to the

> > TS

> >

> > But I have machines built before and after this machine having this problem!

> >

> > Can you tell me more on how to examine the shadow key section, what to look

> > for to verify if this really is the problem etc.

> >

> >

> > Kjell

> >

> >

> > "Patrick Rouse" wrote:

> >

> > > Does this happen on the RDP Host (Terminal Server) or on the client machine?

> > > If it's happening when users logon to a Terminal Server, it's because

> > > something in the shadow key of the registry is newer than what is in HKCU.

> > > You can view entries in the shadow key at:

> > >

> > > hklm\software\microsoft\windows nt\CurrentVersion\Terminal Server\Install

> > >

> > > Items are entered into this key when a session is placed in install mode via

> > > any setup.exe, add/remove programs or "change user /install". This is the

> > > mechanism used to propagate settings to all users when an administrator

> > > installs a program. The problem is that most administrators are unaware of

> > > this, and perform some action while in install mode that unintentionally

> > > affects users.

> > >

> > > Another thing that can cause this is an application that gets installed, the

> > > system is install mode but after a reboot the administrator opens the

> > > application the first time and runonce or launching the application causes

> > > msiexec to complete the setup. In cases like this you'll need to put the

> > > system in install mode when you open the problematic application for the

> > > first time as an administrator, so the settings can be propagated to the

> > > shadow key.

> > >

> > >

> > > --

> > > Patrick C. Rouse

> > > Microsoft MVP - Terminal Server

> > > Systems Consultant

> > > Quest Software, Provision Networks Division

> > > Virtual Client Solutions

> > > http://www.provisionnetworks.com

> > >

> > >

> > > "Kjell" wrote:

> > >

> > > > Hi

> > > >

> > > > I'm having this wierd problem with my TS Win2003 Std Ed

> > > >

> > > > Some but not all clients triggers 1, 2 or 3 processes of msiexec.exe when

> > > > login in with remote desktop (mstsc.exe).

> > > > This might be a completely normally behaivour, but the pattern I have makes

> > > > it a problem, and I've never seen this before.

> > > >

> > > > 1. The msiexec.exe locks up 50-70% of the resources,making it into a severe

> > > > lagging situation for all.

> > > >

> > > > 2. It never stops, the same host machine (client) will trigger the same set

> > > > of msiexec.exe running for identical period of time every *** time it's login

> > > > in, it doesn't matter if I'm login in using a domain account or a local

> > > > account, it's the client machine that triggers it.

> > > >

> > > > 3. The clients machines having this problem sticks to it's own time perios,

> > > > some has a 20 min running of the msiexec.exe, other makes it into a 10 min

> > > > run, it's pretty much the identical time period at every login attempt, and

> > > > this is individual to each host machine (client)

> > > >

> > > > 4. Other host machine NEVER triggers the msiexec.exe no matter how I try.

> > > >

> > > > I cannot see any pattern on our client machines, they are all WinXP pro,

> > > > some with SP2 + some extra, other with SP2 and all extra, and some with SP3

> > > > and extra.

> > > >

> > > > I've searched the internet for any topic about msiexec.exe running by itself

> > > > but to no luck

> > > >

> > > > This behaivour started about 4-6 weeks ago so it has not been like this

> > > > since day one, I beleive it started about after I run a couple of cycles of

> > > > Microsoft update on the server.

> > > >

> > > > Does anyone have any clue to what could be causing this?

> > > > Please, I would be very happy to find a solution.

> > > >

> > > >

> > > > Kjell

[Guest Kjell]

RE: Client login on TS triggers msiexec.exe problem

 

Hey Patrick :-)

 

I think I'm getting closer on this now.

 

I tried the Process Explorer idea of yours and after several trials I

managed to trap the msiexec process while it scan through the shadow keys.

 

I cannot say if it just went trough it comparing timestamp or if it actually

tried to accomplish anything like install/upgrade.

 

There's a really huge section under software named "Hewlett-Packard", it

contains literly hundreds of subkeys with strange Hex-like names.

 

It takes the process several minutes to go trough this section alone....

 

So, i was wonder; is it safe to:

1. Export the whole "Hewlett-Packard" section into a file

2. Delete the same from reg.

3. Reboot server and see whats changed.

 

Maybe there's a chance that the lagging part is gone, if not, or if anything

seems malfunctioning re-import the section again and reboot.

 

Maybe I could try re-importing it after setting the Date back 2 years.

 

 

Do you think this is safe actions?

or at least not directly stupid to do.

 

Kjell

 

 

"Patrick Rouse" wrote:

> 2003 goes into install mode automatically anytime an administrator launches

> setup.exe or an installation via add/remove programs.

>

> You could use process explorer to see what is spawning msiexec, or look in

> the shadow key for anyting that might be using runonce.

>

> If you have more than one TS, you could compare the entries in the shadow

> key of the two machines, to see what's different.

>

> The shadow key is NOT a requirement, as some consultants completely delete

> the entries in this key and script the required entries into HKCU at logon.

> This is most common with Login Consultants Solution4 Framework. This however

> does require a very good understanding of how your applications work.

>

> You could also logon as a new administrative account, go into install mode

> and let msiexec complete the installation of whatever program is triggering

> this installation. After it's done, switch to execute mode via "change user

> /execute"

>

>

>

> --

> Patrick C. Rouse

> Microsoft MVP - Terminal Server

> Systems Consultant

> Quest Software, Provision Networks Division

> Virtual Client Solutions

> http://www.provisionnetworks.com

>

>

> "Kjell" wrote:

>

> > Thanks Patrick for your input.

> >

> > It's on the TS that the process is being triggered.

> > it's 1, 2 or sometimes 3 lines of msiexec that is running in SYSTEM account

> > but only one of them has heavily as 50-70%

> >

> >

> > Do I need to put the TS in install mode before I run for example Microsoft

> > Update?

> > I thought that Win2003 TS changed into install mode by itself if no users

> > was logged on and I'm running for example MS update from the console.

> >

> > is this correct or not?

> >

> >

> > Is there any "General process" I can do to set it all staight at once.

> >

> > I'm finding your input very interesting, well, nothing I tried so far makes

> > any differences.

> >

> > bear in mind, I can see a clear pattern that the login profile (user

> > account) has nothing to do with it, it's purely something between the host

> > and the TS

> >

> > On of the machine I can use for testing this problem is not triggering this

> > problem at all, no matter which account I'm using to "remote desktop" to the

> > TS

> >

> > But I have machines built before and after this machine having this problem!

> >

> > Can you tell me more on how to examine the shadow key section, what to look

> > for to verify if this really is the problem etc.

> >

> >

> > Kjell

> >

> >

> > "Patrick Rouse" wrote:

> >

> > > Does this happen on the RDP Host (Terminal Server) or on the client machine?

> > > If it's happening when users logon to a Terminal Server, it's because

> > > something in the shadow key of the registry is newer than what is in HKCU.

> > > You can view entries in the shadow key at:

> > >

> > > hklm\software\microsoft\windows nt\CurrentVersion\Terminal Server\Install

> > >

> > > Items are entered into this key when a session is placed in install mode via

> > > any setup.exe, add/remove programs or "change user /install". This is the

> > > mechanism used to propagate settings to all users when an administrator

> > > installs a program. The problem is that most administrators are unaware of

> > > this, and perform some action while in install mode that unintentionally

> > > affects users.

> > >

> > > Another thing that can cause this is an application that gets installed, the

> > > system is install mode but after a reboot the administrator opens the

> > > application the first time and runonce or launching the application causes

> > > msiexec to complete the setup. In cases like this you'll need to put the

> > > system in install mode when you open the problematic application for the

> > > first time as an administrator, so the settings can be propagated to the

> > > shadow key.

> > >

> > >

> > > --

> > > Patrick C. Rouse

> > > Microsoft MVP - Terminal Server

> > > Systems Consultant

> > > Quest Software, Provision Networks Division

> > > Virtual Client Solutions

> > > http://www.provisionnetworks.com

> > >

> > >

> > > "Kjell" wrote:

> > >

> > > > Hi

> > > >

> > > > I'm having this wierd problem with my TS Win2003 Std Ed

> > > >

> > > > Some but not all clients triggers 1, 2 or 3 processes of msiexec.exe when

> > > > login in with remote desktop (mstsc.exe).

> > > > This might be a completely normally behaivour, but the pattern I have makes

> > > > it a problem, and I've never seen this before.

> > > >

> > > > 1. The msiexec.exe locks up 50-70% of the resources,making it into a severe

> > > > lagging situation for all.

> > > >

> > > > 2. It never stops, the same host machine (client) will trigger the same set

> > > > of msiexec.exe running for identical period of time every *** time it's login

> > > > in, it doesn't matter if I'm login in using a domain account or a local

> > > > account, it's the client machine that triggers it.

> > > >

> > > > 3. The clients machines having this problem sticks to it's own time perios,

> > > > some has a 20 min running of the msiexec.exe, other makes it into a 10 min

> > > > run, it's pretty much the identical time period at every login attempt, and

> > > > this is individual to each host machine (client)

> > > >

> > > > 4. Other host machine NEVER triggers the msiexec.exe no matter how I try.

> > > >

> > > > I cannot see any pattern on our client machines, they are all WinXP pro,

> > > > some with SP2 + some extra, other with SP2 and all extra, and some with SP3

> > > > and extra.

> > > >

> > > > I've searched the internet for any topic about msiexec.exe running by itself

> > > > but to no luck

> > > >

> > > > This behaivour started about 4-6 weeks ago so it has not been like this

> > > > since day one, I beleive it started about after I run a couple of cycles of

> > > > Microsoft update on the server.

> > > >

> > > > Does anyone have any clue to what could be causing this?

> > > > Please, I would be very happy to find a solution.

> > > >

> > > >

> > > > Kjell