Application error at logoff - real headache

[woody]

Ever since we set up two new suites of PCs in september, we've been getting random application error messages at log off. These are occuring on every PC since we ghosted an image to the lot. This is what I've pulled from the application event log:

 

Application popup: Explorer.EXE - Application Error : The instruction at "0x019d1da0" referenced memory at "0x019d1da0". The memory could not be "read".

 

Click on OK to terminate the program

Click on CANCEL to debug the program

 

I've also had this which may be related:

 

Windows saved user NCTC\user registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

 

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

 

Any ideas how to solve this?

[robert.mabbutt]

Just a thought, after ghosting did you run newSid?

 

Regards

Robert

[woody]

We run sysprep on the original before we ghosted it so we could change the ip addresses on first boot-up etc. What is newSID?

[robert.mabbutt]

Each comp has its own Computer Security Identifier but if ghosting then it ghosts the Computer Security Identifier. I don't know if running Sysprep stops this because on first boot a Computer Security Identifier will be created.

 

What we normally do is created an image of a pc we want then ghost to all machines Run NewSid and install Sophos. I can send ya the programs read me if ya want. Might explain it better than me

 

EDIT:! http://www.microsoft.com/technet/sysinternals/Utilities/NewSid.mspx Found the link for it! thought that might be easier

[Nij.UK]

I thought that is what SYSPREP did. It gets rid of the computers SID and after ghosting like you have mentioned the SID is created on first boot.

 

This is how we have always dont it, and ive never had any issues..

 

Can someone confirm to me that SYSPREP does remove the computers SID

[Ric_]

Sysprep should generate a new SID at startup but there is an option to prevent this from happening IIRC. I don't think that this is the problem though.

 

Have you tried running a registry cleaner over one of the workstations?

[chrbb]

Are there two threads the same?

I had this problem with a laptop, googled it and found google pop up blocker and toolbar to be a possible culprit. Uninstalled it no further probs.

[Ric_]

Are there two threads the same?

 

Other post (now locked) can be found at http://edugeek.net/index.php?name=Forums&file=viewtopic&t=5467

[woody]

I will try to run a reg cleaner over one of the PCs, but I will be surprised if it's that. The original PC we set up was from scratch, with no use at all other than installing the necessary apps. but will try the reg cleaner anyway.