+ Post New Thread
Page 1 of 3 123 LastLast
Results 1 to 15 of 39
Windows 7 Thread, Windows 7 'Welcome' screen hang at login in Technical; I have tried searching for this and found similar, but sufficiently different to believe that the reports were not the ...
  1. #1

    Join Date
    Mar 2010
    Location
    Surrey, UK
    Posts
    120
    Thank Post
    20
    Thanked 3 Times in 3 Posts
    Rep Power
    10

    Windows 7 'Welcome' screen hang at login

    I have tried searching for this and found similar, but sufficiently different to believe that the reports were not the same. So, I post about our problem.

    We are starting to apparently randomly see Windows 7 hang at the 'Welcome' screen when logging in. I do not believe that it is terminal, as I have left a machine over the weekend with the 'Welcome' screen spinning icon constantly rotating only to find the machine fully fit the following Monday. Last this week we left one of the machines for over 5 hours with the icon rotating before we had to crash it out.

    Unfortunately, being random and a small school, the small percentage of times that a machine logs in having the issue and these things do not get reported in a timely manner or simply being grouped under 'machine didn't work', its been difficult to get an exact idea of when this problem started occuring. The ICT servers and clients were a new in the summer, so it was a clean build. However, about a month back, the network topology was changed and it is possible that the issue crept in with this, masked with another issue since probably resolved (no reported re-occurrence) - however, that week was a major update from Microsoft plus Java, Flash, Acrobat all wanted to do their updates, so alot was going on that week.

    The network topology change was a change to the routing. The 4 subnets we originally routed using RRAS on the main server, but this has since changed to doing to routing on a TMG Firewall box as part of Forefront TMG. As a result, default gateways changed and initially we incorrectly has a routing issue with the AD machine having multiple NIC's causing intermittent LDAP failures. This has since been resolved and the AD server just now has the single NIC.

    However, whilst random blank desktops and the like have now gone away, the hang on Welcome screen persists. As routing is now done in TMG, we have all the routing logs available and, apart from IGMP multicast packets to (off the top of my head) 224.0.0.22 being blocked by the firewall, everything seems explainable. No errors as such appear in the Windows machines event logs either.

    I do however have some theories:

    1. The IGMP routing packets are needed for something.
    2. Machines go to standby and there are issues with it cleanly waking up
    3. User error

    A couple of weeks back, by luck, I was in the ICT suite alone running some tests. Then about 7 users appeared wanting an impromptu use of the room which I said that they could. Of the seven or so users, most machines logged in in a matter of ten seconds or so, but two failed (hung with rotating icon at 'Welcome') to log in first time and a second time and one of these a third time. What I noticed from this was that one of the failed users had incorrectly used on at least one occasion used an incorrect password, yet it still hung. This may also corroborate my experience that when a machine hangs at welcome and is then crashed out, the previous users credentials are prompted at next login, not the failed user. I also notice that even log is clean, no evidence of much activity at all, but, possibly all noting a major time change due to coming out of standby.

    Machines are Dell Optiplex running Windows 7 Pro. Latest service patches. They have the fix for slow windows startup due to solid background fixed in April and, unrelated to the issue as the issue occurred before it was installed, they have the new hotfix for preventing the occasional double login prompt.

    Servers are Windows 2008R7 running physical (AD,DNS etc) and virtual (TMG firewall and routing).

    Going back to my theories...

    1. I do not believe that the IGMP:0 multicast packets are anything useful and can legitimately be blocked, hence TMG does this by defaults (I have yet to find a way of enabling these in TMG 2010 otherwise I would have tried this already). However, we had multiple failures in the office last week and I thoroughly cross referenced the firewall/router logs - I believe that our firewall/router logs are a complete list of all intra-subnet requests. On one day, one of the three office machines failed and, checking the router logs, this was the only machine that put out a IGMP:0 multicast request. However, on a different day, all the machines put out the multicast request yet all successfully logged on. So if IGMP:0 is needed, its not critical in some cases, or, the request is being satisfied by something on the same subnet.

    2. I'm slowly trying different permutations of standby and hibernate timeout settings, but am not making too much progress. However, I have had reported that one of the office machines failed to start even after it had been previously rebooted. Am currently trailing some machines with auto shut-down at night but its too early to see if this improves matters.

    3. Whilst I witnessed this happen to the same two users one at least two logon occasions, I have also has this happen to me when logging into the domain admin account.

    Please, any suggestions...

  2. #2

    Join Date
    Mar 2010
    Location
    Surrey, UK
    Posts
    120
    Thank Post
    20
    Thanked 3 Times in 3 Posts
    Rep Power
    10
    Forgot to mention...

    Do not believe performance is an issue. Have logged in all 21 ICT machines sucessfully when performing performance testing.

    Network switches indicate every link is error free so do not believe anything is being lost in physical network transmission.

  3. #3

    SYNACK's Avatar
    Join Date
    Oct 2007
    Posts
    11,193
    Thank Post
    875
    Thanked 2,720 Times in 2,303 Posts
    Blog Entries
    11
    Rep Power
    781
    First things first, enable verbose messages on startup and logon in group policy so that you can easily see which phase of the logon process it is hanging at. Second try to get the pings working as IGMP pings are used to determine link speed between the client and host, if this method fails then it may put the client into slow link mode and not process certain policies.

    When we have had random issues with logons hanging at applying user settings it has been to do with corrupted profiles. If there are any cached corrupted profiles on the systems or it is faulting during the download then this could cause such a hangup.

    Did you go with routing via TMG as a solution to add additional security? A propper layer 3 switch would probably be much faster for handeling internal traffic if one is avalible.

  4. Thanks to SYNACK from:

    ianh64 (16th November 2010)

  5. #4

    Join Date
    Mar 2010
    Location
    Surrey, UK
    Posts
    120
    Thank Post
    20
    Thanked 3 Times in 3 Posts
    Rep Power
    10
    Thanks for the prompt reply. My main priority is to get the IGMP requests working, but the only documentation I have seen for this is on older versions of TMG/ISA and the TMG forums are not the most frequented.

    Interesting the bit about IGMP being used for link speed. Had not found any reference until now of IGMP packets being important at Windows login so will perceiver with getting these enabled on TMG.

    As for TMG doing the routing, its down to cost and simplicity. We already had it and appears to be more than up to the job for which we need.

  6. #5

    SYNACK's Avatar
    Join Date
    Oct 2007
    Posts
    11,193
    Thank Post
    875
    Thanked 2,720 Times in 2,303 Posts
    Blog Entries
    11
    Rep Power
    781
    As per this Configure the Forefront TMG 2010 to allow DPM 2010 communication - WSSRA ping is still an allowed protocol under TMG 2010 so you should just be able to create an allow rule that lets ping through from any of the internal source networks to any of the internal source networks under the locations. You must specify ping as it looks not to be included by default under the all protocols set (sure I read this somewhere).

    Here is a ref on slow link detection http://support.microsoft.com/kb/227260 they may have cleaned up the implementation in Server 2008 but it could still be hanging around.
    Last edited by SYNACK; 16th November 2010 at 12:48 PM.

  7. #6
    mounters's Avatar
    Join Date
    Mar 2006
    Location
    Northumberland
    Posts
    199
    Thank Post
    22
    Thanked 70 Times in 59 Posts
    Rep Power
    29
    Yes I've had this issue, I had a case open with MS about it but we never really got anywhere with it, we eventually narrowed it down to the corruption of the windows repository. To test if this is the fault you have then try disabling WMI service and then restart the PC to see if the logon nolonger hangs.

    To repair any PCs showing the issue I stopped the WMI service and then renamed the repository folder (C:\Windows\System32\wbem\repository) to repository.old and then restarted the PC, this rebuilds the repository. To prevent the issues from reoccuring I found that disabling RSoP logging through a GPO stopped the error from reappearing. Never did anymore investigation into the problem after this.

  8. Thanks to mounters from:

    ianh64 (16th November 2010)

  9. #7

    Join Date
    Mar 2010
    Location
    Surrey, UK
    Posts
    120
    Thank Post
    20
    Thanked 3 Times in 3 Posts
    Rep Power
    10
    Hi Synack

    Im a bit confused. Reading both the articles you passed about ping and slow link detection/DPM, are you sure these are not talking about ICMP rather than IGMP? If slow link detection uses ICMP PING, then I don't see how that can be the issue as ICMP ping works fine across subnets.

    Thanks

  10. #8

    Join Date
    Mar 2010
    Location
    Surrey, UK
    Posts
    120
    Thank Post
    20
    Thanked 3 Times in 3 Posts
    Rep Power
    10
    mounters

    How often were you getting this? Was it random or specific to particular PC's or user account?

    Our problem appear not to need any repair as a reboot 99/100 usually cures the issue without any need to stop WMI. Still interested though - what is RSoP logging and how do I disable it - found plenty of info about World Series of Poker

  11. #9
    mounters's Avatar
    Join Date
    Mar 2006
    Location
    Northumberland
    Posts
    199
    Thank Post
    22
    Thanked 70 Times in 59 Posts
    Rep Power
    29
    It was generally random machines, we think it was when machines were uncleanly shutdown by pupils as it was only in suites we saw it and not on staff laptops.

    RSoP - Resultant Set of Policy Microsoft Corporation

    To disable through GPO: Computer Config -> Policies -> Administrative Templates -> System -> Group Policy -> Turn off resultant set of policy logging

  12. Thanks to mounters from:

    ianh64 (16th November 2010)

  13. #10

    Join Date
    Sep 2007
    Posts
    90
    Thank Post
    7
    Thanked 32 Times in 17 Posts
    Rep Power
    20
    Since a few weeks we have seen this issue too on random computers. There are quiet a few similarities between your environment and ours:
    We too use Dell Optiplex (from 745 to 780 ) running Windows 7 Pro, we use 2008R2 servers and Forefront TMG.

    To get a hanging computer to respond again i've done the following:
    -Start services.msc on another computer, connect to the computer in question,
    -Check that the "Multimedia Class scheduler" and/or the "Shell Hardware Detection" service are running.
    You may find that although set to start automatically, they're not running. Starting them immediatly makes
    the computer respond again and continue to the login screen.

    To permanently fix it, i've had success with:
    -Start a command prompt as Administrator
    -Type "netsh interface tcp set global autotuninglevel=disabled"
    -reboot

    I have no clue whatsoever what these things have to do with each other or why these services
    do not start (no indications or errors in eventlog) but this is what fixes it for us.

  14. Thanks to rvdmast from:

    ianh64 (17th November 2010)

  15. #11

    Join Date
    Mar 2010
    Location
    Surrey, UK
    Posts
    120
    Thank Post
    20
    Thanked 3 Times in 3 Posts
    Rep Power
    10
    rvdmast

    Thanks for the input. Looks promising with similar setup and problem only starting a few weeks back.

    Unfortunately coincidental, but Microsoft did a big set of updates which came through for us overnight Tue/Wed of that week. It was that Wednesday when I had reports of machines hanging, but it may have happened earlier. At that point, everything was blamed on the updates even though they should have completed during the night and rebooted the machines. Made worse were updates which also started coming through from Adobe and Java. I changed the frequency of updates and it still occurred, even after I went through each machine to ensure that all the updates had installed and machine cleanly rebooted. The good news is that after this is resolved, I should be able to reinstate the automatic updates.

    Unfortunately, we did have a random login issue due to the topology change and incorrect multi NIC on AD server (left over from previous topology) but this is now resolved. So I think this issue is hazed with that, lack of pertinent reporting from staff - "some machines machine crashed yesterday and also last week".

    I have always had suspicions with the updates that came along that week. Irrespective of the root cause which we may never know, I now have two concrete avenues to explore irrespective of the underlying cause. I have told the school to leave alone any machine hanging and to phone me so that I can come in and see if I can recover the machine without a reboot.
    Last edited by ianh64; 17th November 2010 at 08:17 AM.

  16. #12
    chazzy2501's Avatar
    Join Date
    Jan 2008
    Location
    South West
    Posts
    1,801
    Thank Post
    215
    Thanked 265 Times in 215 Posts
    Rep Power
    68
    I did slowly fluff up my network by blocking incoming IGMP via GPO for all PCs, windows uses this for netbios etc, What I found after random machines were not processing their logons properly it turned out that some of my older switches ARP tables were filling up! I enabled IGMP and the problem went away! I was using wireshark and could see thousands of request being sent from PCs but none of them were answering.

    On a side note to fixing my problems and I'm not 100% on networking, I was confused to see that windows it's self keeps ARP records?

  17. #13

    Join Date
    Mar 2010
    Location
    Surrey, UK
    Posts
    120
    Thank Post
    20
    Thanked 3 Times in 3 Posts
    Rep Power
    10
    We had it happen again on two machines last week. Unfortunately they were not enabled for remote management so I was unable to interrogate them when hung. I have now enabled remote management so next time, I will hopefully get some more positive info.

    But I have rolled out the autotuninglevel=disabled to the office machines and two ICT machines and will continue to monitor - will probably roll out to half the ICT machines in a few days and see if the problem is confined to remaining half with autotuning on.

  18. #14

    Join Date
    Mar 2010
    Location
    Surrey, UK
    Posts
    120
    Thank Post
    20
    Thanked 3 Times in 3 Posts
    Rep Power
    10
    Its just been reported to me today that two of the office machines hung yesterday morning even though I had applied the autotuning=disabled/reboot fix which is unfortunate. The day after was too late to check anything but one also hung today so I took the opportunity to remotely interrogate.

    Whilst it responds to ping requests in a timely manner, remote management fails with error 1722, "Windows was unable to open service control manager database on office1... RPC Server is unavailable". I also tried to remotely reboot this machine and again, it failed, this time with error (53). I checked that the other machine that hung yesterday that it was still remotely manageable and could be rebooted using exactly the same commands which it did, so it would appear that when machine is hung at 'Welcome' screen, something is not quite right on it/to it.

    I have now enabled verbose logging and will see what that reveals in future hangs.

    Could lack of RPC availability when machine is in this state be any form of clue? ie, are there any known issues that may prevent some services, such as RPC from apparently starting or being unavailable?

  19. #15

    Join Date
    Mar 2010
    Location
    Surrey, UK
    Posts
    120
    Thank Post
    20
    Thanked 3 Times in 3 Posts
    Rep Power
    10

    Multimedia Class Scheduler not running

    I had the same machine hang this morning. I was able to look through the log slightly more extended files and found the following. This seems to correlate with rvdmast's comment about checking "Multimedia Class scheduler" and/or the "Shell Hardware Detection".

    There was very little activity when the system started up - the user hit keyboard to bring machine out of sleep at about 08:20 then started to login at about 08:25. There are a few events but significantly, very shortly before events log went quiet, the Multimedia Class Scheduler stopped with the following event log.

    Any ideas would be appreciated on how to work out whether this service stopping is legitimate or what is causing this to stop. Unfortunately disabling autotuning had no effect but multimedia class scheduler being stopped seems to be in common with rvdmasts experience, even though on a previous attempt, I was unable to remotely connect to services to start it. Whether it is the cause of the hang in this case, but with rvsmast, they were able to kick the machine back in to life by restarting the service.

    Code:
    Log Name:      System
    Source:        Service Control Manager
    Date:          24/11/2010 08:25:24
    Event ID:      7036
    Task Category: None
    Level:         Information
    Keywords:      Classic
    User:          N/A
    Computer:      office1.xyz.school
    Description:
    The Multimedia Class Scheduler service entered the stopped state.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
        <EventID Qualifiers="16384">7036</EventID>
        <Version>0</Version>
        <Level>4</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8080000000000000</Keywords>
        <TimeCreated SystemTime="2010-11-24T08:25:24.742931100Z" />
        <EventRecordID>24742</EventRecordID>
        <Correlation />
        <Execution ProcessID="464" ThreadID="5252" />
        <Channel>System</Channel>
        <Computer>office1.xyz.school</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="param1">Multimedia Class Scheduler</Data>
        <Data Name="param2">stopped</Data>
        <Binary>4D004D004300530053002F0031000000</Binary>
      </EventData>
    </Event>

    Machines are Dell Optiplex 380 running Windows 7 Professional Dell OEM. This particular machine was rebuilt from Dell's recovery disc, other machines with same/similar issue were as shipped from Dell but all with Windows updates applied.

    I guess I need to see if there are any recommended updates for drivers etc. Other forums indicate hangs possibly associated to this service stopping, some associated with hibernate/sleep.

    I may try completely disabling sleep mode, not ideal.
    Last edited by ianh64; 24th November 2010 at 09:58 AM. Reason: Added machine info

SHARE:
+ Post New Thread
Page 1 of 3 123 LastLast

Similar Threads

  1. Theme on the Login Screen
    By FN-GM in forum Windows
    Replies: 7
    Last Post: 19th March 2010, 02:23 PM
  2. Windows 2003 RM CC3 Server Hang
    By brahma in forum Windows Server 2000/2003
    Replies: 5
    Last Post: 26th January 2010, 09:30 AM
  3. Windows Vista Login Screen / Users
    By DaveMurphy in forum Windows
    Replies: 1
    Last Post: 9th December 2009, 10:51 PM
  4. Windows Server 2008 Login Screen
    By eddyc in forum Windows Server 2008
    Replies: 8
    Last Post: 14th May 2009, 04:27 PM
  5. Windows XP Login Screen
    By kerrymoralee9280 in forum Windows
    Replies: 16
    Last Post: 13th May 2008, 10:03 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •