Guest future2Bunknown Posted September 25, 2007 Posted September 25, 2007 I have a windows 2003 in workgroup having following symptoms: - if I log on as a *normal* user, once I typed in the credential, it logs me off right after - the logging off window pops up followed by the ctrl-alt-del window. This doesn't always happen but happens 9 out of 10 attemps(or more frequent) - however if I type in my credential again, I can get into the desktop - admin doesn' t have this problem - if I log on as Admin, and in the System properties window, profile, highlight the *normal* user account, the "copy to" and "remove" button is grayed out. - there was once or twice if I unplugged the power completely then log back in as Admin, the above "copy to" and "remove" buttons became availabe again. - newly created profile didn't help - absolutely nothing noticeable in event viewer - if I log in as Admin, then open a RDP session to itself( mstsc / v:localhost), log in as the user in question, it won't ask me for password twice. However, I can't launch certain programs within the session (such as firefox, outlook). They are terminated at some point (for example, I can see the prompt from firefox "restore sessions/new session", but then nothing) - I reset the security policy by importing the setupsec.inf but this didn't help either Any help appreciated.
Guest Jorge Silva Posted September 25, 2007 Posted September 25, 2007 Re: w2k3 logs me off right after user/password Hi check inline: > - if I log on as a *normal* user, once I typed in the credential, it > logs me off right after - the logging off window pops up followed by > the ctrl-alt-del window. This doesn't always happen but happens 9 out > of 10 attemps(or more frequent) Logs are full, or maybe some virus on that machine. > - however if I type in my credential again, I can get into the > desktop So you can log successfully after the second atempt? > - admin doesn' t have this problem That's good, you can use that account to check log errors or if logs are full, or if you have any process (like a virus) that doesn't like the normal user account. > - if I log on as Admin, and in the System properties window, > profile, highlight the *normal* user account, the "copy to" and > "remove" button is grayed out. Can you rename the profile manually, and then try to logon with a new user and check if the same behavior applies. > - there was once or twice if I unplugged the power completely then > log back in as Admin, the above "copy to" and "remove" buttons became > availabe again. Try the rename, if you can rename,you must first talke ownershipt of the folder and subfolders and files.. > - newly created profile didn't help New profile for what user the domain admin or the normal account? > - absolutely nothing noticeable in event viewer > - if I log in as Admin, then open a RDP session to itself( mstsc / > v:localhost), log in as the user in question, it won't ask me for > password twice. However, I can't launch certain programs within the > session (such as firefox, outlook). They are terminated at some point > (for example, I can see the prompt from firefox "restore sessions/new > session", but then nothing) That suggests something wrong with the profile or GPO security. > - I reset the security policy by importing the setupsec.inf but this > didn't help either It doesn't matter if the policy is being applied at domain or OU level, the local GPO is the one that is overwrited by alll others. -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "future2Bunknown" <johnlan@gmail.com> wrote in message news:1190748178.396470.231270@50g2000hsm.googlegroups.com... >I have a windows 2003 in workgroup having following symptoms: > - if I log on as a *normal* user, once I typed in the credential, it > logs me off right after - the logging off window pops up followed by > the ctrl-alt-del window. This doesn't always happen but happens 9 out > of 10 attemps(or more frequent) > - however if I type in my credential again, I can get into the > desktop > - admin doesn' t have this problem > - if I log on as Admin, and in the System properties window, > profile, highlight the *normal* user account, the "copy to" and > "remove" button is grayed out. > - there was once or twice if I unplugged the power completely then > log back in as Admin, the above "copy to" and "remove" buttons became > availabe again. > - newly created profile didn't help > - absolutely nothing noticeable in event viewer > - if I log in as Admin, then open a RDP session to itself( mstsc / > v:localhost), log in as the user in question, it won't ask me for > password twice. However, I can't launch certain programs within the > session (such as firefox, outlook). They are terminated at some point > (for example, I can see the prompt from firefox "restore sessions/new > session", but then nothing) > - I reset the security policy by importing the setupsec.inf but this > didn't help either > > Any help appreciated. >
Guest future2Bunknown Posted September 26, 2007 Posted September 26, 2007 Re: w2k3 logs me off right after user/password Jorge, Thanks for the reply. Please see my reply to your comments: 1. This is a workgroup server therefore no upper level GP will override local policy 2. Second attempt to log on always suceeds 3. If, as I myself suspected and as you pointed out, profile and/or security settings are to blamed, I've replaced both to no avail 4. logs in event has been cleared multiple times during my troubleshooting. And I don't believe there is any other size limit on text-based logs. Plus, all disks have sufficient space 5. I didn't bother to verify if other users have same problem because this is the only account I need to keep and make it workable. But I believe the others don't have this issue. I will try later though and post back. 6. while I can't say 100% sure that I am not hit by virus, I am very confident my compupter is clean. Having worked in security field, I am always cautious what's installed and my computer is well protected. The symptoms don't look like virus either. 7. I do have the userenv.log if you want to see it. On Sep 25, 3:48 pm, "Jorge Silva" <jorgesilva...@hotmail.com> wrote: > Hi check inline: > > > - if I log on as a *normal* user, once I typed in the credential, it > > logs me off right after - the logging off window pops up followed by > > the ctrl-alt-del window. This doesn't always happen but happens 9 out > > of 10 attemps(or more frequent) > > Logs are full, or maybe some virus on that machine. > > > - however if I type in my credential again, I can get into the > > desktop > > So you can log successfully after the second atempt? > > > - admin doesn' t have this problem > > That's good, you can use that account to check log errors or if logs are > full, or if you have any process (like a virus) that doesn't like the normal > user account. > > > - if I log on as Admin, and in the System properties window, > > profile, highlight the *normal* user account, the "copy to" and > > "remove" button is grayed out. > > Can you rename the profile manually, and then try to logon with a new user > and check if the same behavior applies. > > > - there was once or twice if I unplugged the power completely then > > log back in as Admin, the above "copy to" and "remove" buttons became > > availabe again. > > Try the rename, if you can rename,you must first talke ownershipt of the > folder and subfolders and files.. > > > - newly created profile didn't help > > New profile for what user the domain admin or the normal account? > > > - absolutely nothing noticeable in event viewer > > - if I log in as Admin, then open a RDP session to itself( mstsc / > > v:localhost), log in as the user in question, it won't ask me for > > password twice. However, I can't launch certain programs within the > > session (such as firefox, outlook). They are terminated at some point > > (for example, I can see the prompt from firefox "restore sessions/new > > session", but then nothing) > > That suggests something wrong with the profile or GPO security. > > > - I reset the security policy by importing the setupsec.inf but this > > didn't help either > > It doesn't matter if the policy is being applied at domain or OU level, the > local GPO is the one that is overwrited by alll others. > > -- > I hope that the information above helps you. > Have a Nice day. > > Jorge Silva > MCSE, MVP Directory Services"future2Bunknown" <john...@gmail.com> wrote in message > > news:1190748178.396470.231270@50g2000hsm.googlegroups.com... > > >I have a windows 2003 in workgroup having following symptoms: > > - if I log on as a *normal* user, once I typed in the credential, it > > logs me off right after - the logging off window pops up followed by > > the ctrl-alt-del window. This doesn't always happen but happens 9 out > > of 10 attemps(or more frequent) > > - however if I type in my credential again, I can get into the > > desktop > > - admin doesn' t have this problem > > - if I log on as Admin, and in the System properties window, > > profile, highlight the *normal* user account, the "copy to" and > > "remove" button is grayed out. > > - there was once or twice if I unplugged the power completely then > > log back in as Admin, the above "copy to" and "remove" buttons became > > availabe again. > > - newly created profile didn't help > > - absolutely nothing noticeable in event viewer > > - if I log in as Admin, then open a RDP session to itself( mstsc / > > v:localhost), log in as the user in question, it won't ask me for > > password twice. However, I can't launch certain programs within the > > session (such as firefox, outlook). They are terminated at some point > > (for example, I can see the prompt from firefox "restore sessions/new > > session", but then nothing) > > - I reset the security policy by importing the setupsec.inf but this > > didn't help either > > > Any help appreciated.
Guest Jorge Silva Posted September 26, 2007 Posted September 26, 2007 Re: w2k3 logs me off right after user/password Inline > 1. This is a workgroup server therefore no upper level GP will > override local policy Ok. But you can also check local policy. > 2. Second attempt to log on always suceeds Yeah this is the weird part. Never saw something similar, that's why I suggested that may be a Virus problem or GPO restriction. > 3. If, as I myself suspected and as you pointed out, profile and/or > security settings are to blamed, I've replaced both to no avail 1 place less to search ;) > 4. logs in event has been cleared multiple times during my > troubleshooting. And I don't believe there is any other size limit on > text-based logs. Plus, all disks have sufficient space Ok. > 5. I didn't bother to verify if other users have same problem because > this is the only account I need to keep and make it workable. But I > believe the others don't have this issue. I will try later though and > post back. Yes try to create a different account and check with that account (I never know, strange behaviors lead to strange solutions) > 6. while I can't say 100% sure that I am not hit by virus, I am very > confident my compupter is clean. Having worked in security field, I am > always cautious what's installed and my computer is well protected. > The symptoms don't look like virus either. You wan't waste to much time by running the antivirus, just in case. > 7. I do have the userenv.log if you want to see it. Only the things that contains errors or strange things -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "future2Bunknown" <johnlan@gmail.com> wrote in message news:1190816312.730005.167360@22g2000hsm.googlegroups.com... > Jorge, > > Thanks for the reply. Please see my reply to your comments: > > 1. This is a workgroup server therefore no upper level GP will > override local policy > 2. Second attempt to log on always suceeds > 3. If, as I myself suspected and as you pointed out, profile and/or > security settings are to blamed, I've replaced both to no avail > 4. logs in event has been cleared multiple times during my > troubleshooting. And I don't believe there is any other size limit on > text-based logs. Plus, all disks have sufficient space > 5. I didn't bother to verify if other users have same problem because > this is the only account I need to keep and make it workable. But I > believe the others don't have this issue. I will try later though and > post back. > 6. while I can't say 100% sure that I am not hit by virus, I am very > confident my compupter is clean. Having worked in security field, I am > always cautious what's installed and my computer is well protected. > The symptoms don't look like virus either. > 7. I do have the userenv.log if you want to see it. > > On Sep 25, 3:48 pm, "Jorge Silva" <jorgesilva...@hotmail.com> wrote: >> Hi check inline: >> >> > - if I log on as a *normal* user, once I typed in the credential, it >> > logs me off right after - the logging off window pops up followed by >> > the ctrl-alt-del window. This doesn't always happen but happens 9 out >> > of 10 attemps(or more frequent) >> >> Logs are full, or maybe some virus on that machine. >> >> > - however if I type in my credential again, I can get into the >> > desktop >> >> So you can log successfully after the second atempt? >> >> > - admin doesn' t have this problem >> >> That's good, you can use that account to check log errors or if logs are >> full, or if you have any process (like a virus) that doesn't like the >> normal >> user account. >> >> > - if I log on as Admin, and in the System properties window, >> > profile, highlight the *normal* user account, the "copy to" and >> > "remove" button is grayed out. >> >> Can you rename the profile manually, and then try to logon with a new >> user >> and check if the same behavior applies. >> >> > - there was once or twice if I unplugged the power completely then >> > log back in as Admin, the above "copy to" and "remove" buttons became >> > availabe again. >> >> Try the rename, if you can rename,you must first talke ownershipt of the >> folder and subfolders and files.. >> >> > - newly created profile didn't help >> >> New profile for what user the domain admin or the normal account? >> >> > - absolutely nothing noticeable in event viewer >> > - if I log in as Admin, then open a RDP session to itself( mstsc / >> > v:localhost), log in as the user in question, it won't ask me for >> > password twice. However, I can't launch certain programs within the >> > session (such as firefox, outlook). They are terminated at some point >> > (for example, I can see the prompt from firefox "restore sessions/new >> > session", but then nothing) >> >> That suggests something wrong with the profile or GPO security. >> >> > - I reset the security policy by importing the setupsec.inf but this >> > didn't help either >> >> It doesn't matter if the policy is being applied at domain or OU level, >> the >> local GPO is the one that is overwrited by alll others. >> >> -- >> I hope that the information above helps you. >> Have a Nice day. >> >> Jorge Silva >> MCSE, MVP Directory Services"future2Bunknown" <john...@gmail.com> wrote >> in message >> >> news:1190748178.396470.231270@50g2000hsm.googlegroups.com... >> >> >I have a windows 2003 in workgroup having following symptoms: >> > - if I log on as a *normal* user, once I typed in the credential, it >> > logs me off right after - the logging off window pops up followed by >> > the ctrl-alt-del window. This doesn't always happen but happens 9 out >> > of 10 attemps(or more frequent) >> > - however if I type in my credential again, I can get into the >> > desktop >> > - admin doesn' t have this problem >> > - if I log on as Admin, and in the System properties window, >> > profile, highlight the *normal* user account, the "copy to" and >> > "remove" button is grayed out. >> > - there was once or twice if I unplugged the power completely then >> > log back in as Admin, the above "copy to" and "remove" buttons became >> > availabe again. >> > - newly created profile didn't help >> > - absolutely nothing noticeable in event viewer >> > - if I log in as Admin, then open a RDP session to itself( mstsc / >> > v:localhost), log in as the user in question, it won't ask me for >> > password twice. However, I can't launch certain programs within the >> > session (such as firefox, outlook). They are terminated at some point >> > (for example, I can see the prompt from firefox "restore sessions/new >> > session", but then nothing) >> > - I reset the security policy by importing the setupsec.inf but this >> > didn't help either >> >> > Any help appreciated. > >
Guest Cyberstorme Posted September 28, 2007 Posted September 28, 2007 Re: w2k3 logs me off right after user/password I remember seeing this behaviour during the early W2K3 days. I believe the issue was corrected in SP1. Is your system at SP1? "future2Bunknown" wrote: > Jorge, > > Thanks for the reply. Please see my reply to your comments: > > 1. This is a workgroup server therefore no upper level GP will > override local policy > 2. Second attempt to log on always suceeds > 3. If, as I myself suspected and as you pointed out, profile and/or > security settings are to blamed, I've replaced both to no avail > 4. logs in event has been cleared multiple times during my > troubleshooting. And I don't believe there is any other size limit on > text-based logs. Plus, all disks have sufficient space > 5. I didn't bother to verify if other users have same problem because > this is the only account I need to keep and make it workable. But I > believe the others don't have this issue. I will try later though and > post back. > 6. while I can't say 100% sure that I am not hit by virus, I am very > confident my compupter is clean. Having worked in security field, I am > always cautious what's installed and my computer is well protected. > The symptoms don't look like virus either. > 7. I do have the userenv.log if you want to see it. > > On Sep 25, 3:48 pm, "Jorge Silva" <jorgesilva...@hotmail.com> wrote: > > Hi check inline: > > > > > - if I log on as a *normal* user, once I typed in the credential, it > > > logs me off right after - the logging off window pops up followed by > > > the ctrl-alt-del window. This doesn't always happen but happens 9 out > > > of 10 attemps(or more frequent) > > > > Logs are full, or maybe some virus on that machine. > > > > > - however if I type in my credential again, I can get into the > > > desktop > > > > So you can log successfully after the second atempt? > > > > > - admin doesn' t have this problem > > > > That's good, you can use that account to check log errors or if logs are > > full, or if you have any process (like a virus) that doesn't like the normal > > user account. > > > > > - if I log on as Admin, and in the System properties window, > > > profile, highlight the *normal* user account, the "copy to" and > > > "remove" button is grayed out. > > > > Can you rename the profile manually, and then try to logon with a new user > > and check if the same behavior applies. > > > > > - there was once or twice if I unplugged the power completely then > > > log back in as Admin, the above "copy to" and "remove" buttons became > > > availabe again. > > > > Try the rename, if you can rename,you must first talke ownershipt of the > > folder and subfolders and files.. > > > > > - newly created profile didn't help > > > > New profile for what user the domain admin or the normal account? > > > > > - absolutely nothing noticeable in event viewer > > > - if I log in as Admin, then open a RDP session to itself( mstsc / > > > v:localhost), log in as the user in question, it won't ask me for > > > password twice. However, I can't launch certain programs within the > > > session (such as firefox, outlook). They are terminated at some point > > > (for example, I can see the prompt from firefox "restore sessions/new > > > session", but then nothing) > > > > That suggests something wrong with the profile or GPO security. > > > > > - I reset the security policy by importing the setupsec.inf but this > > > didn't help either > > > > It doesn't matter if the policy is being applied at domain or OU level, the > > local GPO is the one that is overwrited by alll others. > > > > -- > > I hope that the information above helps you. > > Have a Nice day. > > > > Jorge Silva > > MCSE, MVP Directory Services"future2Bunknown" <john...@gmail.com> wrote in message > > > > news:1190748178.396470.231270@50g2000hsm.googlegroups.com... > > > > >I have a windows 2003 in workgroup having following symptoms: > > > - if I log on as a *normal* user, once I typed in the credential, it > > > logs me off right after - the logging off window pops up followed by > > > the ctrl-alt-del window. This doesn't always happen but happens 9 out > > > of 10 attemps(or more frequent) > > > - however if I type in my credential again, I can get into the > > > desktop > > > - admin doesn' t have this problem > > > - if I log on as Admin, and in the System properties window, > > > profile, highlight the *normal* user account, the "copy to" and > > > "remove" button is grayed out. > > > - there was once or twice if I unplugged the power completely then > > > log back in as Admin, the above "copy to" and "remove" buttons became > > > availabe again. > > > - newly created profile didn't help > > > - absolutely nothing noticeable in event viewer > > > - if I log in as Admin, then open a RDP session to itself( mstsc / > > > v:localhost), log in as the user in question, it won't ask me for > > > password twice. However, I can't launch certain programs within the > > > session (such as firefox, outlook). They are terminated at some point > > > (for example, I can see the prompt from firefox "restore sessions/new > > > session", but then nothing) > > > - I reset the security policy by importing the setupsec.inf but this > > > didn't help either > > > > > Any help appreciated. > > >
Recommended Posts