I came into work today to find that our Windows Server 2008 used as a terminal server for the Thin Clients was not loading the users desktops. What I have found out is that when I login via Remote Desktop, after applying user settings, it gets to the stage of 'Preaparing your desktop', but then the screen just goes blue.

I have tried rebooting several times with no luck, and logging in locally at the server with no luck. Does anyone have any suggestions?

I do not think that it could be a virus attack as we run antivirus on the server with OpenDNS filtering. Yesterday a software restriction policy was set up to only allow programs in the following directories to run if that could be the problem, although it was working fine all day yesterday.

  • C:\program files
  • C:\programdata
  • C:\windows

Thank you.


  • Do you need to add some other directories (eg D:\Program Files or C:\Program Files(x86))? Also - check if you have any logon scripts defined which call an executable from a UNC somewhere? I've seen logon script hold-ups cause this blank blue screen issue in Citrix farms. Jul 24, 2012 at 12:31
  • Hi, no everything is on the C drive, and as it's a 32bit installation there is no additional 32bit folders. No logon scripts are set to run. When I sat locally at the server and pressed CTRL ALT DELETE, I was presented with this error: Log on process has failed to create the security options dialog. Could this be a fault with the logon service?
    – Jake
    Jul 24, 2012 at 14:59

1 Answer 1


You should remove that software restriction policy and try again. It's most probably the cause, I guess. (It's always the last thing you changed... :) )

  • Booting in safe mode loads explorer fine, but in normal mode the login doesn't load properly - just the blue screen, so it could be GPO related. However when I press CTRL ALT DELETE I get this error: The logon process has failed to create the security options dialog. So maybe it's a logon service issue?
    – Jake
    Jul 24, 2012 at 15:01
  • Again, this could be a GPO restriction. Remove the GPO.
    – MichelZ
    Jul 24, 2012 at 15:51
  • How can I go about removing the GPO object, as when I boot in safe mode the domain controller cannot be contacted, and when I boot normally I get the blue screen with no desktop etc. I've tried RSAT on Windows 7 but then I get this: The specified domain either does not exist or could not be contacted. Any ideas?
    – Jake
    Jul 24, 2012 at 15:56
  • Software restriction policies are stored in the registry. I assume a computer GPO is used, try to delete this registry key in safe mode: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer
    – MichelZ
    Jul 24, 2012 at 16:00
  • Hi, thank you for your help - that has solved the problem. Cheers.
    – Jake
    Jul 24, 2012 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.