w2k3 logs me off right after user/password

[Guest future2Bunknown]

I have a windows 2003 in workgroup having following symptoms:

- if I log on as a *normal* user, once I typed in the credential, it

logs me off right after - the logging off window pops up followed by

the ctrl-alt-del window. This doesn't always happen but happens 9 out

of 10 attemps(or more frequent)

- however if I type in my credential again, I can get into the

desktop

- admin doesn' t have this problem

- if I log on as Admin, and in the System properties window,

profile, highlight the *normal* user account, the "copy to" and

"remove" button is grayed out.

- there was once or twice if I unplugged the power completely then

log back in as Admin, the above "copy to" and "remove" buttons became

availabe again.

- newly created profile didn't help

- absolutely nothing noticeable in event viewer

- if I log in as Admin, then open a RDP session to itself( mstsc /

v:localhost), log in as the user in question, it won't ask me for

password twice. However, I can't launch certain programs within the

session (such as firefox, outlook). They are terminated at some point

(for example, I can see the prompt from firefox "restore sessions/new

session", but then nothing)

- I reset the security policy by importing the setupsec.inf but this

didn't help either

 

Any help appreciated.

[Guest Jorge Silva]

Re: w2k3 logs me off right after user/password

 

Hi check inline:

> - if I log on as a *normal* user, once I typed in the credential, it

> logs me off right after - the logging off window pops up followed by

> the ctrl-alt-del window. This doesn't always happen but happens 9 out

> of 10 attemps(or more frequent)

 

Logs are full, or maybe some virus on that machine.

> - however if I type in my credential again, I can get into the

> desktop

So you can log successfully after the second atempt?

> - admin doesn' t have this problem

That's good, you can use that account to check log errors or if logs are

full, or if you have any process (like a virus) that doesn't like the normal

user account.

> - if I log on as Admin, and in the System properties window,

> profile, highlight the *normal* user account, the "copy to" and

> "remove" button is grayed out.

Can you rename the profile manually, and then try to logon with a new user

and check if the same behavior applies.

> - there was once or twice if I unplugged the power completely then

> log back in as Admin, the above "copy to" and "remove" buttons became

> availabe again.

Try the rename, if you can rename,you must first talke ownershipt of the

folder and subfolders and files..

> - newly created profile didn't help

New profile for what user the domain admin or the normal account?

> - absolutely nothing noticeable in event viewer

> - if I log in as Admin, then open a RDP session to itself( mstsc /

> v:localhost), log in as the user in question, it won't ask me for

> password twice. However, I can't launch certain programs within the

> session (such as firefox, outlook). They are terminated at some point

> (for example, I can see the prompt from firefox "restore sessions/new

> session", but then nothing)

That suggests something wrong with the profile or GPO security.

> - I reset the security policy by importing the setupsec.inf but this

> didn't help either

It doesn't matter if the policy is being applied at domain or OU level, the

local GPO is the one that is overwrited by alll others.

 

--

I hope that the information above helps you.

Have a Nice day.

 

Jorge Silva

MCSE, MVP Directory Services

"future2Bunknown" <johnlan@gmail.com> wrote in message

news:1190748178.396470.231270@50g2000hsm.googlegroups.com...

>I have a windows 2003 in workgroup having following symptoms:

> - if I log on as a *normal* user, once I typed in the credential, it

> logs me off right after - the logging off window pops up followed by

> the ctrl-alt-del window. This doesn't always happen but happens 9 out

> of 10 attemps(or more frequent)

> - however if I type in my credential again, I can get into the

> desktop

> - admin doesn' t have this problem

> - if I log on as Admin, and in the System properties window,

> profile, highlight the *normal* user account, the "copy to" and

> "remove" button is grayed out.

> - there was once or twice if I unplugged the power completely then

> log back in as Admin, the above "copy to" and "remove" buttons became

> availabe again.

> - newly created profile didn't help

> - absolutely nothing noticeable in event viewer

> - if I log in as Admin, then open a RDP session to itself( mstsc /

> v:localhost), log in as the user in question, it won't ask me for

> password twice. However, I can't launch certain programs within the

> session (such as firefox, outlook). They are terminated at some point

> (for example, I can see the prompt from firefox "restore sessions/new

> session", but then nothing)

> - I reset the security policy by importing the setupsec.inf but this

> didn't help either

>

> Any help appreciated.

>

[Guest future2Bunknown]

Re: w2k3 logs me off right after user/password

 

Jorge,

 

Thanks for the reply. Please see my reply to your comments:

 

1. This is a workgroup server therefore no upper level GP will

override local policy

2. Second attempt to log on always suceeds

3. If, as I myself suspected and as you pointed out, profile and/or

security settings are to blamed, I've replaced both to no avail

4. logs in event has been cleared multiple times during my

troubleshooting. And I don't believe there is any other size limit on

text-based logs. Plus, all disks have sufficient space

5. I didn't bother to verify if other users have same problem because

this is the only account I need to keep and make it workable. But I

believe the others don't have this issue. I will try later though and

post back.

6. while I can't say 100% sure that I am not hit by virus, I am very

confident my compupter is clean. Having worked in security field, I am

always cautious what's installed and my computer is well protected.

The symptoms don't look like virus either.

7. I do have the userenv.log if you want to see it.

 

On Sep 25, 3:48 pm, "Jorge Silva" <jorgesilva...@hotmail.com> wrote:

> Hi check inline:

>

> > - if I log on as a *normal* user, once I typed in the credential, it

> > logs me off right after - the logging off window pops up followed by

> > the ctrl-alt-del window. This doesn't always happen but happens 9 out

> > of 10 attemps(or more frequent)

>

> Logs are full, or maybe some virus on that machine.

>

> > - however if I type in my credential again, I can get into the

> > desktop

>

> So you can log successfully after the second atempt?

>

> > - admin doesn' t have this problem

>

> That's good, you can use that account to check log errors or if logs are

> full, or if you have any process (like a virus) that doesn't like the normal

> user account.

>

> > - if I log on as Admin, and in the System properties window,

> > profile, highlight the *normal* user account, the "copy to" and

> > "remove" button is grayed out.

>

> Can you rename the profile manually, and then try to logon with a new user

> and check if the same behavior applies.

>

> > - there was once or twice if I unplugged the power completely then

> > log back in as Admin, the above "copy to" and "remove" buttons became

> > availabe again.

>

> Try the rename, if you can rename,you must first talke ownershipt of the

> folder and subfolders and files..

>

> > - newly created profile didn't help

>

> New profile for what user the domain admin or the normal account?

>

> > - absolutely nothing noticeable in event viewer

> > - if I log in as Admin, then open a RDP session to itself( mstsc /

> > v:localhost), log in as the user in question, it won't ask me for

> > password twice. However, I can't launch certain programs within the

> > session (such as firefox, outlook). They are terminated at some point

> > (for example, I can see the prompt from firefox "restore sessions/new

> > session", but then nothing)

>

> That suggests something wrong with the profile or GPO security.

>

> > - I reset the security policy by importing the setupsec.inf but this

> > didn't help either

>

> It doesn't matter if the policy is being applied at domain or OU level, the

> local GPO is the one that is overwrited by alll others.

>

> --

> I hope that the information above helps you.

> Have a Nice day.

>

> Jorge Silva

> MCSE, MVP Directory Services"future2Bunknown" <john...@gmail.com> wrote in message

>

> news:1190748178.396470.231270@50g2000hsm.googlegroups.com...

>

> >I have a windows 2003 in workgroup having following symptoms:

> > - if I log on as a *normal* user, once I typed in the credential, it

> > logs me off right after - the logging off window pops up followed by

> > the ctrl-alt-del window. This doesn't always happen but happens 9 out

> > of 10 attemps(or more frequent)

> > - however if I type in my credential again, I can get into the

> > desktop

> > - admin doesn' t have this problem

> > - if I log on as Admin, and in the System properties window,

> > profile, highlight the *normal* user account, the "copy to" and

> > "remove" button is grayed out.

> > - there was once or twice if I unplugged the power completely then

> > log back in as Admin, the above "copy to" and "remove" buttons became

> > availabe again.

> > - newly created profile didn't help

> > - absolutely nothing noticeable in event viewer

> > - if I log in as Admin, then open a RDP session to itself( mstsc /

> > v:localhost), log in as the user in question, it won't ask me for

> > password twice. However, I can't launch certain programs within the

> > session (such as firefox, outlook). They are terminated at some point

> > (for example, I can see the prompt from firefox "restore sessions/new

> > session", but then nothing)

> > - I reset the security policy by importing the setupsec.inf but this

> > didn't help either

>

> > Any help appreciated.

[Guest Jorge Silva]

Re: w2k3 logs me off right after user/password

 

Inline

> 1. This is a workgroup server therefore no upper level GP will

> override local policy

Ok. But you can also check local policy.

> 2. Second attempt to log on always suceeds

Yeah this is the weird part. Never saw something similar, that's why I

suggested that may be a Virus problem or GPO restriction.

> 3. If, as I myself suspected and as you pointed out, profile and/or

> security settings are to blamed, I've replaced both to no avail

1 place less to search ;)

> 4. logs in event has been cleared multiple times during my

> troubleshooting. And I don't believe there is any other size limit on

> text-based logs. Plus, all disks have sufficient space

Ok.

> 5. I didn't bother to verify if other users have same problem because

> this is the only account I need to keep and make it workable. But I

> believe the others don't have this issue. I will try later though and

> post back.

Yes try to create a different account and check with that account (I never

know, strange behaviors lead to strange solutions)

> 6. while I can't say 100% sure that I am not hit by virus, I am very

> confident my compupter is clean. Having worked in security field, I am

> always cautious what's installed and my computer is well protected.

> The symptoms don't look like virus either.

You wan't waste to much time by running the antivirus, just in case.

> 7. I do have the userenv.log if you want to see it.

Only the things that contains errors or strange things

 

--

I hope that the information above helps you.

Have a Nice day.

 

Jorge Silva

MCSE, MVP Directory Services

"future2Bunknown" <johnlan@gmail.com> wrote in message

news:1190816312.730005.167360@22g2000hsm.googlegroups.com...

> Jorge,

>

> Thanks for the reply. Please see my reply to your comments:

>

> 1. This is a workgroup server therefore no upper level GP will

> override local policy

> 2. Second attempt to log on always suceeds

> 3. If, as I myself suspected and as you pointed out, profile and/or

> security settings are to blamed, I've replaced both to no avail

> 4. logs in event has been cleared multiple times during my

> troubleshooting. And I don't believe there is any other size limit on

> text-based logs. Plus, all disks have sufficient space

> 5. I didn't bother to verify if other users have same problem because

> this is the only account I need to keep and make it workable. But I

> believe the others don't have this issue. I will try later though and

> post back.

> 6. while I can't say 100% sure that I am not hit by virus, I am very

> confident my compupter is clean. Having worked in security field, I am

> always cautious what's installed and my computer is well protected.

> The symptoms don't look like virus either.

> 7. I do have the userenv.log if you want to see it.

>

> On Sep 25, 3:48 pm, "Jorge Silva" <jorgesilva...@hotmail.com> wrote:

>> Hi check inline:

>>

>> > - if I log on as a *normal* user, once I typed in the credential, it

>> > logs me off right after - the logging off window pops up followed by

>> > the ctrl-alt-del window. This doesn't always happen but happens 9 out

>> > of 10 attemps(or more frequent)

>>

>> Logs are full, or maybe some virus on that machine.

>>

>> > - however if I type in my credential again, I can get into the

>> > desktop

>>

>> So you can log successfully after the second atempt?

>>

>> > - admin doesn' t have this problem

>>

>> That's good, you can use that account to check log errors or if logs are

>> full, or if you have any process (like a virus) that doesn't like the

>> normal

>> user account.

>>

>> > - if I log on as Admin, and in the System properties window,

>> > profile, highlight the *normal* user account, the "copy to" and

>> > "remove" button is grayed out.

>>

>> Can you rename the profile manually, and then try to logon with a new

>> user

>> and check if the same behavior applies.

>>

>> > - there was once or twice if I unplugged the power completely then

>> > log back in as Admin, the above "copy to" and "remove" buttons became

>> > availabe again.

>>

>> Try the rename, if you can rename,you must first talke ownershipt of the

>> folder and subfolders and files..

>>

>> > - newly created profile didn't help

>>

>> New profile for what user the domain admin or the normal account?

>>

>> > - absolutely nothing noticeable in event viewer

>> > - if I log in as Admin, then open a RDP session to itself( mstsc /

>> > v:localhost), log in as the user in question, it won't ask me for

>> > password twice. However, I can't launch certain programs within the

>> > session (such as firefox, outlook). They are terminated at some point

>> > (for example, I can see the prompt from firefox "restore sessions/new

>> > session", but then nothing)

>>

>> That suggests something wrong with the profile or GPO security.

>>

>> > - I reset the security policy by importing the setupsec.inf but this

>> > didn't help either

>>

>> It doesn't matter if the policy is being applied at domain or OU level,

>> the

>> local GPO is the one that is overwrited by alll others.

>>

>> --

>> I hope that the information above helps you.

>> Have a Nice day.

>>

>> Jorge Silva

>> MCSE, MVP Directory Services"future2Bunknown" <john...@gmail.com> wrote

>> in message

>>

>> news:1190748178.396470.231270@50g2000hsm.googlegroups.com...

>>

>> >I have a windows 2003 in workgroup having following symptoms:

>> > - if I log on as a *normal* user, once I typed in the credential, it

>> > logs me off right after - the logging off window pops up followed by

>> > the ctrl-alt-del window. This doesn't always happen but happens 9 out

>> > of 10 attemps(or more frequent)

>> > - however if I type in my credential again, I can get into the

>> > desktop

>> > - admin doesn' t have this problem

>> > - if I log on as Admin, and in the System properties window,

>> > profile, highlight the *normal* user account, the "copy to" and

>> > "remove" button is grayed out.

>> > - there was once or twice if I unplugged the power completely then

>> > log back in as Admin, the above "copy to" and "remove" buttons became

>> > availabe again.

>> > - newly created profile didn't help

>> > - absolutely nothing noticeable in event viewer

>> > - if I log in as Admin, then open a RDP session to itself( mstsc /

>> > v:localhost), log in as the user in question, it won't ask me for

>> > password twice. However, I can't launch certain programs within the

>> > session (such as firefox, outlook). They are terminated at some point

>> > (for example, I can see the prompt from firefox "restore sessions/new

>> > session", but then nothing)

>> > - I reset the security policy by importing the setupsec.inf but this

>> > didn't help either

>>

>> > Any help appreciated.

>

>

[Guest Cyberstorme]

Re: w2k3 logs me off right after user/password

 

I remember seeing this behaviour during the early W2K3 days. I believe the

issue was corrected in SP1. Is your system at SP1?

 

"future2Bunknown" wrote:

> Jorge,

>

> Thanks for the reply. Please see my reply to your comments:

>

> 1. This is a workgroup server therefore no upper level GP will

> override local policy

> 2. Second attempt to log on always suceeds

> 3. If, as I myself suspected and as you pointed out, profile and/or

> security settings are to blamed, I've replaced both to no avail

> 4. logs in event has been cleared multiple times during my

> troubleshooting. And I don't believe there is any other size limit on

> text-based logs. Plus, all disks have sufficient space

> 5. I didn't bother to verify if other users have same problem because

> this is the only account I need to keep and make it workable. But I

> believe the others don't have this issue. I will try later though and

> post back.

> 6. while I can't say 100% sure that I am not hit by virus, I am very

> confident my compupter is clean. Having worked in security field, I am

> always cautious what's installed and my computer is well protected.

> The symptoms don't look like virus either.

> 7. I do have the userenv.log if you want to see it.

>

> On Sep 25, 3:48 pm, "Jorge Silva" <jorgesilva...@hotmail.com> wrote:

> > Hi check inline:

> >

> > > - if I log on as a *normal* user, once I typed in the credential, it

> > > logs me off right after - the logging off window pops up followed by

> > > the ctrl-alt-del window. This doesn't always happen but happens 9 out

> > > of 10 attemps(or more frequent)

> >

> > Logs are full, or maybe some virus on that machine.

> >

> > > - however if I type in my credential again, I can get into the

> > > desktop

> >

> > So you can log successfully after the second atempt?

> >

> > > - admin doesn' t have this problem

> >

> > That's good, you can use that account to check log errors or if logs are

> > full, or if you have any process (like a virus) that doesn't like the normal

> > user account.

> >

> > > - if I log on as Admin, and in the System properties window,

> > > profile, highlight the *normal* user account, the "copy to" and

> > > "remove" button is grayed out.

> >

> > Can you rename the profile manually, and then try to logon with a new user

> > and check if the same behavior applies.

> >

> > > - there was once or twice if I unplugged the power completely then

> > > log back in as Admin, the above "copy to" and "remove" buttons became

> > > availabe again.

> >

> > Try the rename, if you can rename,you must first talke ownershipt of the

> > folder and subfolders and files..

> >

> > > - newly created profile didn't help

> >

> > New profile for what user the domain admin or the normal account?

> >

> > > - absolutely nothing noticeable in event viewer

> > > - if I log in as Admin, then open a RDP session to itself( mstsc /

> > > v:localhost), log in as the user in question, it won't ask me for

> > > password twice. However, I can't launch certain programs within the

> > > session (such as firefox, outlook). They are terminated at some point

> > > (for example, I can see the prompt from firefox "restore sessions/new

> > > session", but then nothing)

> >

> > That suggests something wrong with the profile or GPO security.

> >

> > > - I reset the security policy by importing the setupsec.inf but this

> > > didn't help either

> >

> > It doesn't matter if the policy is being applied at domain or OU level, the

> > local GPO is the one that is overwrited by alll others.

> >

> > --

> > I hope that the information above helps you.

> > Have a Nice day.

> >

> > Jorge Silva

> > MCSE, MVP Directory Services"future2Bunknown" <john...@gmail.com> wrote in message

> >

> > news:1190748178.396470.231270@50g2000hsm.googlegroups.com...

> >

> > >I have a windows 2003 in workgroup having following symptoms:

> > > - if I log on as a *normal* user, once I typed in the credential, it

> > > logs me off right after - the logging off window pops up followed by

> > > the ctrl-alt-del window. This doesn't always happen but happens 9 out

> > > of 10 attemps(or more frequent)

> > > - however if I type in my credential again, I can get into the

> > > desktop

> > > - admin doesn' t have this problem

> > > - if I log on as Admin, and in the System properties window,

> > > profile, highlight the *normal* user account, the "copy to" and

> > > "remove" button is grayed out.

> > > - there was once or twice if I unplugged the power completely then

> > > log back in as Admin, the above "copy to" and "remove" buttons became

> > > availabe again.

> > > - newly created profile didn't help

> > > - absolutely nothing noticeable in event viewer

> > > - if I log in as Admin, then open a RDP session to itself( mstsc /

> > > v:localhost), log in as the user in question, it won't ask me for

> > > password twice. However, I can't launch certain programs within the

> > > session (such as firefox, outlook). They are terminated at some point

> > > (for example, I can see the prompt from firefox "restore sessions/new

> > > session", but then nothing)

> > > - I reset the security policy by importing the setupsec.inf but this

> > > didn't help either

> >

> > > Any help appreciated.

>

>

>