Clean XP installs hang or BSOD at Applying personal settings.

[stanwell]

Hi,

 

I have had this problem for a couple of months and its driving me mad. All of our existing machines appear to be running fine on the network but every time I build a new machine it hangs or BSOD's at "Applying your personal settings". I have had this problem on at least 2 different models of PC, possibly 4 (I can't remember now) - Optiplex 760, Optiplex 790 and also possibly on Optiplex 740 and Optiplex 780 (All of our PC's are Dell). But I have the same models working fine on the network, it's only when I try to install/re-install XP. So forgetting everything that I've done in the last couple of months to try fix it because I can't remember everything, here's what's happened in the last two days.

 

I did the following steps on both of the Optiplex 790's at the same time.

 

1) Set up two Dell Optiplex 790's and installed XP Pro SP3 (using an ISO I downloaded from Microsoft Volume Licensing site).

2) Installed all of the latest drivers (from Dell's website using service tag) except for one of the chipset and the graphics drivers as they needed .NET Framework first. I also upgraded the BIOS at the same time.

3) Installed all available Windows Updates (excluding PowerShell, Windows Search, Browser Choice and Security Essentials or what ever it's called)

4) Installed last two drivers (mentioned in step 2)

6) Formatted D: drive.

5) Installed Adobe Flash Player, Reader and Shockwave from their website.

6) Installed Microsoft Office 2007 Enterprise from CD.

7) Installed Microsoft Updates and installed all of the updates available for Office along with Silverlight

8) Installed a driver from Microsoft Updates. I can't remember the exact name but it was something to do with Intel SOL. (I can probably check the update history if I need to get the name)

9) Installed Adobe CS5 Web Premium from CD.

10) Installed Adobe Acrobat 9 from CD.

11) Joined the computer to our domain and left both machines in the default "Computers" container in AD.

12) Logged in as the domain Administrator account.

- At "Applying your personal settings" one machine rebooted (Probably a BSOD but they are set to reboot instead of displaying it by default) and the other just sat on that screen doing nothing for about 17 hours.

13) Logged in as the local Administrator account and enabled UserEnv logging and Winlogon logging, then rebooted.

14) Logged in as domain Administrator account and both machines logged in successfully... :@

15) Logged out and logged in using my own account (Domain Admins & Administrators). Both machines rebooted.

 

At this point I started using just one of the machines

 

16) Booted with it set to display any BSOD's instead of rebooting.

17) Logged in with my account and got a BSOD (0xC000021A)

18) Booted the same machine and used msconfig to disable all startup programs (then rebooted).

19) Logged in with my account and this time at "Applying your personal settings" I got a winlogon.exe error saying "The instruction at 0x7c911766 referenced memory at something. The memory could not be read".

- When I clicked OK the PC rebooted obviously because winlogon was terminated.

20) On same machine logged in as local Administrator account again.

21) Used msconfig to disable all Non-Microsoft services and rebooted.

22) Logged on with my account and it rebooted again at the same place...

 

As you can see these are clean installs of XP there is no imaging involved and they should only be loading our default policy which is linked to the domain and contains things like password expiry and "Always wait for the network at computer startup and logon".

 

When I originally started having the problem I'm sure I remember that if you managed to get an account to log in by repeatedly deleting the local profile and logging back in until it worked, that account would always be able to log in to that machine in future (or so it appeared). So maybe it could be something to do with generating the user profiles.

 

That's all I can remember right now, may think of other things later. If you need more information just ask

 

Thanks in advance,

 

Dan

[kmount]

How to troubleshoot a "STOP 0xC000021A" error

 

Should help track down what app is causing it.

[stanwell]

Thanks for the reply.

 

Following the instructions you linked I have enabled Dr Watson but it doesn't catch anything on both machines. I've checked the registry key to see if there is a third party GINA DLL and the key doesn't exist so it's using the default DLL. I've tried last known good configuration and that doesn't fix anything either.

 

I've also run sfc /scannow and that made no difference. I just created a new OU and blocked inheritance in group policy, so they're not loading any policies and they still have the problem.

 

I'm going to get a third machine, install XP SP3 from the CD again and put it straight on the domain with no updates or software and see what happens.

[simonhind]

Windows XP is prone to viruses especially if you connected to the internet after login

i suggest you log in locally first to install an antivirus software, don't connect it to a network until you are sure that your network drives don't have viruses

there are so many trojan viruses out there the second you are connected to the internet you machine will get a virus

 

best practive before connecting to a domain or internet is

 

1) for XP integrate SP3 and burn new ISO

2) install antivirus on local machine

3) virus check all drives on server

 

i also see you mentioned that GINA DLL

if you run run sfc /scannow it will not fix the problem, to fix it i suggest you integrate the latest service pack and burn a new ISO image

it is more liekly that either the CD is slightly scratched or GINA.DLL is corrupt on CD

 

VL Keys will not work on standard XP PRO disks you will need to ensure you have an original VLK XP PRO CD and ensure that you have purchased the correct amount of VLK for your network

 

you could also try

 

1.) Reboot the machine

2.) Press F8 to load up the boot options menu for Windows

3.) Select Safe Mode and then select your Windows Installation

4.) After Windows loads into safe mode, it’ll ask if you want to continue working in Safe Mode. Select Yes.

5.) Start >> Run >> “regedit” (without the quotes). Press Enter.

6.) Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\

WindowsNT\CurrentVersion\Winlogon

7.) Look for the GinaDLL Key

8.) Select and delete this key. DO NOT delete the entire Winlogon folder of keys.

9.) Close Regedit and reboot the machine

[stanwell]

Windows XP is prone to viruses especially if you connected to the internet after login

i suggest you log in locally first to install an antivirus software, don't connect it to a network until you are sure that your network drives don't have viruses

there are so many trojan viruses out there the second you are connected to the internet you machine will get a virus

 

best practive before connecting to a domain or internet is

 

1) for XP integrate SP3 and burn new ISO

2) install antivirus on local machine

3) virus check all drives on server

 

i also see you mentioned that GINA DLL

if you run run sfc /scannow it will not fix the problem, to fix it i suggest you integrate the latest service pack and burn a new ISO image

it is more liekly that either the CD is slightly scratched or GINA.DLL is corrupt on CD

 

VL Keys will not work on standard XP PRO disks you will need to ensure you have an original VLK XP PRO CD and ensure that you have purchased the correct amount of VLK for your network

 

you could also try

 

1.) Reboot the machine

2.) Press F8 to load up the boot options menu for Windows

3.) Select Safe Mode and then select your Windows Installation

4.) After Windows loads into safe mode, it’ll ask if you want to continue working in Safe Mode. Select Yes.

5.) Start >> Run >> “regedit” (without the quotes). Press Enter.

6.) Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\

WindowsNT\CurrentVersion\Winlogon

7.) Look for the GinaDLL Key

8.) Select and delete this key. DO NOT delete the entire Winlogon folder of keys.

9.) Close Regedit and reboot the machine

 

Thanks for your reply.

 

My CD already has SP3, I didn't slipstream it though I downloaded it as an ISO from the Microsoft Volume Licensing website. My CD isn't scratched, I burned it specifically for building these machines to make sure I didn't have a bad disc. It's definitely a VLK version of XP and not a standard disc and i do have enough licenses for the network.

 

I mentioned the GINA DLL because I was instructed to check the registry key you have mentioned from the TechNet article posted by kmount. But the key doesn't exist anyway. As for the antivirus, I can try that but I think I might be making "some" progress at the moment.

 

Progress update:

I logged in a user and watched the machine BSOD and reboot. I then moved that user along with 3 others into the OU I created with blocked inheritance and logged in again. All 4 of the accounts logged in perfectly without any errors. So I moved 2 of the accounts back to their original OU's and logged them back in and once again I had a BSOD. So it definitely has something to do with a user policy.

 

As mentioned in my last post I have just installed XP using the same CD on a third machine (also an Optiplex 790) and installed the Ethernet driver but NOTHING else. Put it on the domain and logged in some users (which have their normal policies) and they all logged in without any problems... So all I can think of is that there must be a policy which is conflicting with a driver/software/update. So I'm now going to attempt to narrow down the user policies and see if I can find the one which is causing the problem.

 

Thanks,

Dan

[stanwell]

It appears to be "Always wait for the network at computer startup and logon" which is causing the problem. Which kind of makes sense as I said in my first post, one of the machines hung for about 17 hours at applying personal settings. But now the question is what is crashing or hanging all the time? I feel like I'm back at square one... All I've managed to do is verify that something it's waiting for is hanging or crashing, duh... I already knew that! So I'm back to looking for a needle in a hay stack, any more ideas?

 

Thanks,

Dan

[simonhind]

have you get up

1) Profile Path & Home Location setup

2) folder redirection

3) ensured computer is located in correct location in "active directory Users and Computers"

4) correct policy in "Member of"

5) after login do network shares appear ?

5) cleared DHCP cache on PC

 

try enforcing group policy, restart PC and try again

[stanwell]

Dr Watson has finally caught something: DrWatson.txt

 

I will carry on with this on Monday.

 

Thanks,

 

Dan

[simonhind]

have you tried the following ?

 

1) replaced SDRAM

2) IDE Cables

 

the logs shows its not loading ntdll, kernel32, USERENV

 

i suggest you download this

Download Windows Symbol Packages

 

and some of the issues on the log are related to .net framework

download .net framework 3.5

[stanwell]

Sorry for leaving this post so long. The last couple of weeks have been so busy I just haven't had time to sit down and work on this problem.

 

Today I was told about a machine which has been running on the network with no problems for a long time, which has suddenly started rebooting when somebody tries to log in. It appears to have exactly the same issue as we are having with clean images. So I enabled logging etc and found that "Internet Explorer Branding" was the problem; It's throwing a 0xc0000005 error. Whilst trying various things I had the same error several times. I then created an OU with blocked inheritance, manually linked all of our policies except for the one containing our proxy settings and moved one test user into that OU. I then managed to log in to that account with no problems. So I logged out and just to confirm, I logged in with another user which has the proxy policy applied and all of a sudden the same error occurred but in a different place! This time it was in shortcut preferences! I've attached part of the two logs here: Winlogon Snippets.txt

Thanks,

 

Dan

[stanwell]

I think I've finally solved it! It appears to have been caused by Authenticode Settings which had been left in an old policy. According to the description the Authenticode Settings only work with IE 6.

 

Thanks for the help,

 

Dan