CHiLL Posted December 11, 2018 Posted December 11, 2018 We have an off bug that's effected a handful of staff over the past couple of weeks. We've had reports that when they have locked their machine, every 10 seconds the password field will have an asterisk entered. When the password field is revealed, it is a lowercase 'a' that has been entered. This will repeat forever until user intervention, with multiple 'a's being entered over time. When the user unlocks their machine, it stops happeneing. It also doesn't happen on the login screen. When we do switch user, it also stops happening. If another use then logs in and locks the machine, it also doesn't happen again. We use Impero, but have ruled that out as it happens even when the Impero service is stopped. (Performed by Impero's direct support) The only other software that we use that can read or input that I'm aware of is Visigo and ClaroRead.
FishCustard Posted December 11, 2018 Posted December 11, 2018 Are all the keyboards the same? Does it happen when a keyboard isn't even plugged in?
CHiLL Posted December 11, 2018 Author Posted December 11, 2018 Different types of keyboard and also happens without a keyboard connected.
David44 Posted December 11, 2018 Posted December 11, 2018 If caps lock is switched on, does an uppercase 'A' appear? If so, then something is acting as a keyboard and typing 'a'. If not, then the 'a' is probably getting there some other way. I can't think what it would be in either scenario but it might help you narrow it down.
CHiLL Posted December 12, 2018 Author Posted December 12, 2018 (edited) If caps lock is switched on, does an uppercase 'A' appear? If so, then something is acting as a keyboard and typing 'a'. If not, then the 'a' is probably getting there some other way. I can't think what it would be in either scenario but it might help you narrow it down. Cheers. Annoyingly we have come to test this using the same user and machine combination...and now it isn't happening. Nothing has changed with the hardware or software as far as we are concerned. This also happened on the previously reported users/computers where it would just stop ocurring by itself. Strange. Edit: Just as a security measure, we have performed anti-virus and anti-malware scans on these affected machines with nothing detected. We've also checked through the Event Logs and not found anything hinting at what could be causing this. Edited December 12, 2018 by CHiLL
Mako Posted December 12, 2018 Posted December 12, 2018 Cheers. Annoyingly we have come to test this using the same user and machine combination...and now it isn't happening. Nothing has changed with the hardware or software as far as we are concerned. This also happened on the previously reported users/computers where it would just stop ocurring by itself. Strange. Have you tried calling the Ghostbusters?
CHiLL Posted December 12, 2018 Author Posted December 12, 2018 Have you tried calling the Ghostbusters? Hmm, this is an old school too.
CHiLL Posted December 13, 2018 Author Posted December 13, 2018 If caps lock is switched on, does an uppercase 'A' appear? If so, then something is acting as a keyboard and typing 'a'. If not, then the 'a' is probably getting there some other way. I can't think what it would be in either scenario but it might help you narrow it down. I can confirm that the case does change when the caps lock is switched on.
elsiegee40 Posted December 13, 2018 Posted December 13, 2018 My first reaction with this kind of thing is to walk the school, tip every keyboard upside down and give it a darn good shake to dislodge debris
David44 Posted December 13, 2018 Posted December 13, 2018 What other USB (or otherwise, I suppose) devices are connected to the computers with this issue? If the case changes with caps lock then the computer is seeing something 'typing' a. Do you have a whiteboard connected? If it only happens on [a certain type of] password prompt screen then could it be some credential offering device? I.e. A bio-metric or card reader that would allow users to login without a password? Even if that isn't what the device is being used for.
CHiLL Posted December 13, 2018 Author Posted December 13, 2018 What other USB (or otherwise, I suppose) devices are connected to the computers with this issue? If the case changes with caps lock then the computer is seeing something 'typing' a. Do you have a whiteboard connected? If it only happens on [a certain type of] password prompt screen then could it be some credential offering device? I.e. A bio-metric or card reader that would allow users to login without a password? Even if that isn't what the device is being used for. It's happened on both office and teacher computers. The only consistency that we can tell so far are: They are staff machines Basic HP USB Keyboard Basic USB Mouse Basic HP slim USB DVD-RW Some have had whiteboards connected (the affected classroom PCs) and some don't (affected office PCs).
Michael Posted December 13, 2018 Posted December 13, 2018 Do you image workstations, or are they running the OEM image?
CHiLL Posted December 13, 2018 Author Posted December 13, 2018 (edited) Do you image workstations, or are they running the OEM image? All of our workstations are imaged with the same reference image (Windows 10 Education 1709 x64, which have had Appx packages removed by using Arthur's script) and it is created/deployed with SCCM and MDT. Edit: Now it has slightly changed it's MO. Instead of typing one 'a', now it's typing two! It has a specific routine too. With the cursor in the password box, it will flash 4 times, pause for about four seconds and then type two a's. Then the process repeats. If the focus is taken away from the password box, no a's are entered in the password box. If I take control of the machine using Impero (with focus in the password box), no a's are entered in the password box. If I release control of the machine with Impero, two a's are entered in the password box. Edited December 13, 2018 by CHiLL
Michael Posted December 13, 2018 Posted December 13, 2018 I know we 'think' it's not Impero, but try removing it from a PC (as a trial), rather than just disabling its key service(s).
CHiLL Posted December 13, 2018 Author Posted December 13, 2018 Update: I don't know if it's just coincidence or if it's the culprit...but I was looking through the list of running processes on the machine and seeing what was what. Any processes that I know aren't in use or not essential I was ending one by one. I found that when I ended notificationAgent.exe, the issue went away. notificationAgent is the agent for NetSupport Notify. I had initially thought little of NetSupport Notify as it's a display box that is shown and shouldn't be inputting characters. Though that got me thinking - when a message is sent using NetSupport to a locked machines - the machine will often 'bing'. I've put this down in the past to it wanting the attention of the user. But what if it was because it had focus and was trying to enter characters? Weird. I need the issue to happen again elsewhere to try this again.
CHiLL Posted December 13, 2018 Author Posted December 13, 2018 (edited) Update: It is NetSupport Notify causing the issue. I tested it on another machine and killing notificationAgent.exe also stopped the issue on that too. I contacted NetSupport and they confirmed that it is a bug in v4.00.0001 and has been fixed in v4.00.0002 which was released on 11/12/2018. Edited December 13, 2018 by CHiLL 3
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now