Logon, automatic logoff 3 seconds later
We've been seeing this frequently but not every day. After resume from sleep, a user logs on, the "Welcome" message is displayed, and in 3 or 4 seconds the user is logged off, no messages. Next logon always works. Is anyone else seeing this? Any ideas of what else to look at (details below)? Summary Frequently, but not always, after resume from sleep, a user logs on, the "Welcome" message is displayed, and in 3 or 4 seconds the user is logged off. Next logon always works. The DNS Client service stopping and starting is curious, so we removed the trigger stop/start triggers that detect a network IP address, but the service still stops and starts on resume from sleep. Some other cases this causes a DNS failure, but here there were none, and the service was running 2 seconds before the first login attempt. Note our accounts authenticate via a cross-realm trust to an MIT K5 realm. Domain accounts have a "Kerberos name mapping" to that realm; the AD passwords are random. (Not sure if test domain accounts have the trouble.) System Event Log 09:29:26 42 Kernel-Power The system is entering sleep 10:17:40 1 Kernel-General The sytstem time changed ... (resume from sleep) 10:17:41 27 e1kexpress Network link is disconnected 10:17:43 32 e1kexpress Network link established at 1Gbps full duplex 10:17:44 27 e1kexpress Network link is disconnected 10:17:47 32 e1kexpress Network link established at 1Gbps full duplex (this is typical, sometimes it happens 3 times) 10:17:50 7036 Service Control Manager, The DSN Client service entered the stop state 10:17:50 7036 Service Control Manager, The DSN Client service entered the running state 10:17:50 7036 Service Control Manager, The Shell Hardware Detection service entered the running state ... (nothing after that until second logon ...) 10:18:13 7001 Winlogon, User Logon Notification for Customer Experience Improvement Program Security Event Log 10:17:52 4611 A trusted logon process has been registered with the Local Security Authority (computer account xxx) 10:17:52 4648 A logon was attempted using explicit credentials (4648) (user account AD\xxx) 10:17:52 4624 An account was successfully logged on. Logon ID 0x503bf8 10:17:56 4634 An account was logged off, User AD\xx, Logon ID 0x503bf8 No other entries until second try: 10:18:09 4624 An account was successfully logged on. (and stays on!) Packet captures seem to indicate the first logon (via cross-realm trust to an MIT K5 realm) is successful in getting tickets. We see no SMB traffice to load the roaming profile. In fact, there is almost no traffic between the logon and logoff events.
June 4th, 2010 9:04pm

Hi, To troubleshoot the issue, please perform the following steps. 1. Perform a Clean Boot to check the result. 2. Disable Saving Power function on specific device as a workaround. a. Click Start, right click Computer and choose Properties. b. Click Device Manager. c. Navigate to the network adapter, right click it and choose Properties. d. Choose Power Management tab. e. Please uncheck Allow the computer to turn off this device to save power. f. Restart the computer and test this issue again. Thanks, Novak
Free Windows Admin Tool Kit Click here and download it now
June 7th, 2010 10:29am

Thanks very much. I am testing for the issue after a clean boot and with the network adapter "Allow the computer to turn off this device ..." unchecked. So far the problem didn't occur, but two others did so we have a few days of more testing to do.
June 8th, 2010 4:07pm

Thank you for your update and I’m glad to hear that the issue does not occur now. Please take some time to do more test and I will keep monitoring this issue. If the issue is not resolved or it reoccurs, please feel free to let me know. Regards, Novak
Free Windows Admin Tool Kit Click here and download it now
June 9th, 2010 4:44am

On further testing, we found the problem did occur after clean boot, but we had a system task tha was resetting "Allow the computer to turn off this device to save power". After much more fiddling, it looks like going back to driver 10.5.1.0 for these Intel 82567LM-3 adapters AND being sure the above setting is off, does the trick. A note about going back to an older driver is in http://communities.intel.com/thread/7057. Also, so far, we are not finding the issue on computers with a Broadcom adapter. We will continue to evaluate and I'll post results tomorrow or next week. Thanks very much for your help.
June 9th, 2010 11:03pm

We've unfortunately demonstrated the problem on computers with Broadcom adapters, as well as those the Intel driver backed down to 10.5.1.0, so we are looking at GPO/DNS issues. We have another issue with logging on after resume from sleep (user name or password invalid) and have opened a PSS case for that, so we'll see if a solution there helps this one.
Free Windows Admin Tool Kit Click here and download it now
June 14th, 2010 9:55pm

Is this still an issue? If not, what was the solution? One of our users (Dell Latitude E6400) who works remotely nearly 100% of the time has reported random disconnects when using a wired connection. It does not appear to be a problem when using wireless. Based on testing thus far, the problem is either related to the NIC, the port on their switch/hub/router, or a software related issue. I ran across this entry this morning which may proove to be very useful: http://www.eventid.net/display.asp?eventid=27&eventno=9895&source=e1express&phase=1 What's interesting is that this problem does not appear to be evident in Windows XP, only Windows 7.
November 23rd, 2010 9:42am

This is a known problem discussed in detail (and with a possible solution) here: http://social.technet.microsoft.com/Forums/en-US/w7itproinstall/thread/83c1bae2-2335-4fbc-b299-5be2eb621389
Free Windows Admin Tool Kit Click here and download it now
November 23rd, 2010 10:44am

Thanks for the update on this! I ran across another post covering the issue we're experiencing so I'm linking it here for good measure. http://social.answers.microsoft.com/Forums/en-US/w7network/thread/a5e0a261-8344-45b2-af3a-75a45332a2ed It too details multiple symptoms and possible solutions; its not yet clear whether its a combination of changes or singular change that fixes this.
January 20th, 2011 9:45am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics