up vote 3 down vote favorite
share [g+] share [fb]

Our uses randomly get a solid blue screen (desktop background colored blue, not BSOD) when logging into our 2008 Terminal Server. There is no TaskBar, no desktop icons, CTRL+ALT+Delete doesn't work, and no mouse events occur. The only way to end the session is to restart their terminal, or for someone to login as an admin and end their session.

I have discovered that logging in as an admin and ending the process net.exe that is running under that user's profile will end the blue screen and load the users session.

What is net.exe, and why is it randomly giving my users a solid blue screen when they login?

Here's what I know:

  • Server is Windows Server 2008
  • Server is a virtual server
  • Disabled our group policy on our test account and the same thing still happens
  • Happens about 1 in every 4 logins
  • Nothing out of ordinary gets logged in the event viewer
link|improve this question
71% accept rate
feedback

1 Answer

up vote 4 down vote accepted

Net.exe is the program used to map drives, mess with users, and do other network related tasks. It's usually run in logon scripts to map drives. Check your login scripts on the server that are run through startup, logon registry key, user logon script in AD, and local and domain group policies. You'll likely find something in there that's running amock at logon.

If that yields nothing, use autoruns to see what else is running at logon that may be causing issues. It would probably be benficial to disable everything not Microsoft in the logon tab and only reenable necessary processes 1by1 until you find the issue.

link|improve this answer
We do have a login script which maps some network drives. I disabled it and haven't been able to get the blue screen again, so I think you're right. All it does is net use G: /del; net use g: \\server\fileshare. Do you know if there's a way to add a timeout to login scripts? Or if there's a better way to map the network drive? – Rachel Sep 16 '11 at 16:28
1  
It might help to change the first command to net use g: /delete /y so it forces it to delete. It may be stuck waiting for user input and scripts are probably hidden by group policy so the user can never respond. – Jason Berg Sep 16 '11 at 16:42
Thank you so much, I never would have guessed this. That appears to be the case because I have not been able to get a blue screen since adding that. I recall occasionally getting prompted to hit y/n to close a mapped connection when logging in, so it must be that the login script runs prior to the shell, and stops the shell from loading until the prompt disappears. – Rachel Sep 16 '11 at 17:48
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.