Logon, automatic logoff 3 seconds later
We've been seeing this frequently but not every day. After resume from sleep, a user logs on, the "Welcome" message is displayed, and in 3 or 4 seconds the user is logged off, no messages. Next logon always works.
Is anyone else seeing this? Any ideas of what else to look at (details below)?
Summary
Frequently, but not always, after resume from sleep, a user logs on, the "Welcome" message is displayed, and in 3 or 4 seconds the user is logged off. Next logon always works.
The DNS Client service stopping and starting is curious, so we removed the trigger stop/start triggers that detect a network IP address, but the service still stops and starts on resume from sleep. Some other cases this causes a DNS failure, but here
there were none, and the service was running 2 seconds before the first login attempt.
Note our accounts authenticate via a cross-realm trust to an MIT K5 realm. Domain accounts have a "Kerberos name mapping" to that realm; the AD passwords are random. (Not sure if test domain accounts have the trouble.)
System Event Log
09:29:26 42 Kernel-Power The system is entering sleep
10:17:40 1 Kernel-General The sytstem time changed ... (resume from sleep)
10:17:41 27 e1kexpress Network link is disconnected
10:17:43 32 e1kexpress Network link established at 1Gbps full duplex
10:17:44 27 e1kexpress Network link is disconnected
10:17:47 32 e1kexpress Network link established at 1Gbps full duplex (this is typical, sometimes it happens 3 times)
10:17:50 7036 Service Control Manager, The DSN Client service entered the stop state
10:17:50 7036 Service Control Manager, The DSN Client service entered the running state
10:17:50 7036 Service Control Manager, The Shell Hardware Detection service entered the running state
... (nothing after that until second logon ...)
10:18:13 7001 Winlogon, User Logon Notification for Customer Experience Improvement Program
Security Event Log
10:17:52 4611 A trusted logon process has been registered with the Local Security Authority (computer account xxx)
10:17:52 4648 A logon was attempted using explicit credentials (4648) (user account AD\xxx)
10:17:52 4624 An account was successfully logged on. Logon ID 0x503bf8
10:17:56 4634 An account was logged off, User AD\xx, Logon ID 0x503bf8
No other entries until second try:
10:18:09 4624 An account was successfully logged on. (and stays on!)
Packet captures seem to indicate the first logon (via cross-realm trust to an MIT K5 realm) is successful in getting tickets. We see no SMB traffice to load the roaming profile. In fact, there is almost no traffic between the logon and logoff
events.
June 4th, 2010 9:04pm
Hi,
To troubleshoot the issue, please perform the following steps.
1. Perform a
Clean Boot to check the result.
2. Disable Saving Power function on specific device as a workaround.
a. Click
Start, right click Computer and choose
Properties.
b. Click
Device Manager.
c. Navigate to the network adapter, right click it and choose
Properties.
d. Choose
Power Management tab.
e. Please uncheck
Allow the computer to turn off this device to save power.
f. Restart the computer and test this issue again.
Thanks,
Novak
Free Windows Admin Tool Kit Click here and download it now
June 7th, 2010 10:29am
Thanks very much. I am testing for the issue after a clean boot and with the network adapter "Allow the computer to turn off this device ..." unchecked. So far the problem didn't occur, but two others did so we have a few days of more testing
to do.
June 8th, 2010 4:07pm
Thank you for your update and I’m glad to hear that the issue does not occur now. Please take some time to do more test and I will keep monitoring this issue.
If the issue is not resolved or it reoccurs, please feel free to let me know.
Regards,
Novak
Free Windows Admin Tool Kit Click here and download it now
June 9th, 2010 4:44am
On further testing, we found the problem did occur after clean boot, but we had a system task tha was resetting "Allow the computer to turn off this device to save power".
After much more fiddling, it looks like going back to driver 10.5.1.0 for these Intel 82567LM-3 adapters AND being sure the above setting is off, does the trick.
A note about going back to an older driver is in
http://communities.intel.com/thread/7057.
Also, so far, we are not finding the issue on computers with a Broadcom adapter.
We will continue to evaluate and I'll post results tomorrow or next week. Thanks very much for your help.
June 9th, 2010 11:03pm
We've unfortunately demonstrated the problem on computers with Broadcom adapters, as well as those the Intel driver backed down to 10.5.1.0, so we are looking at GPO/DNS issues. We have another issue with logging on after resume from sleep
(user name or password invalid) and have opened a PSS case for that, so we'll see if a solution there helps this one.
Free Windows Admin Tool Kit Click here and download it now
June 14th, 2010 9:55pm
Is this still an issue? If not, what was the solution?
One of our users (Dell Latitude E6400) who works remotely nearly 100% of the time has reported random disconnects when using a wired connection. It does not appear to be a problem when using wireless.
Based on testing thus far, the problem is either related to the NIC, the port on their switch/hub/router, or a software related issue.
I ran across this entry this morning which may proove to be very useful:
http://www.eventid.net/display.asp?eventid=27&eventno=9895&source=e1express&phase=1
What's interesting is that this problem does not appear to be evident in Windows XP, only Windows 7.
November 23rd, 2010 9:42am
This is a known problem discussed in detail (and with a possible solution) here:
http://social.technet.microsoft.com/Forums/en-US/w7itproinstall/thread/83c1bae2-2335-4fbc-b299-5be2eb621389
Free Windows Admin Tool Kit Click here and download it now
November 23rd, 2010 10:44am
Thanks for the update on this!
I ran across another post covering the issue we're experiencing so I'm linking it here for good measure.
http://social.answers.microsoft.com/Forums/en-US/w7network/thread/a5e0a261-8344-45b2-af3a-75a45332a2ed
It too details multiple symptoms and possible solutions; its not yet clear whether its a combination of changes or singular change that fixes this.
January 20th, 2011 9:45am