Logon UI error message (XP SP1)

Topic

New Reply

Hi all,

I leave my machine on all the time, and lock the workstation (WIN+L) when I leave the PC overnight. But when I log on again the next day I usually get several message boxes all saying “The Windows logon UI has encountered an error..”etc. I click OK and I find an identical box behind the one I just dismissed. There can be anywhere from one to 10 of these boxes when I log on.

Nothing actually appears to be wrong with the system, the logon works fine, and a quick scan of the MSKB hasn’t revealed anything..

Just wondering if anyone knows how I could cure it??

Reply | Quote

Replies

I don’t ever “lock” my machine, so I don’t know about its behaviour while in this condition. Do you have any scheduled tasks or activities either on this machine or another on a LAN, trying to access the machine? Looks like some software is trying to perform a function during the time the machine is locked. Do you have overnight defrag, backup, virus scans, that kind of stuff?

Reply | Quote

I don’t ever “lock” my machine, so I don’t know about its behaviour while in this condition. Do you have any scheduled tasks or activities either on this machine or another on a LAN, trying to access the machine? Looks like some software is trying to perform a function during the time the machine is locked. Do you have overnight defrag, backup, virus scans, that kind of stuff?

Reply | Quote

Try this–it should stop them with no downside to you:

HKEY LOCAL MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon

In the right pane scroll down to UIHost and verify that it reads
logonui.exe and under Userinit that it reads:
C:WINDOWSsystem32userinit.exe,

SMBP

Reply | Quote

Try this–it should stop them with no downside to you:

HKEY LOCAL MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon

In the right pane scroll down to UIHost and verify that it reads
logonui.exe and under Userinit that it reads:
C:WINDOWSsystem32userinit.exe,

SMBP

Reply | Quote

Is there any chance some other person or process is attempting to access your computer overnight, for example, to do a backup? Just wondering if those message indicate actual logon attempts, or what?

Reply | Quote

Is there any chance some other person or process is attempting to access your computer overnight, for example, to do a backup? Just wondering if those message indicate actual logon attempts, or what?

Reply | Quote

Do you have hibernation or any other power saving settings turned on?

DaveA I am so far behind, I think I am First
Genealogy....confusing the dead and annoying the living

Reply | Quote

Thanks for the replies!

To Bigaldoc: I Don’t have anything scheduled other than a weekly virusscan, and the usual Windows Update service. I get the message every day when I log in, but not if I simply lock the PC and come back 1/2 hour later..

To SMBP: I have both of those reg entires correct, although the userinit entry had a comma at the end, which I’ve removed.

To jscher2000: I am the only person who has login access to the PC, but it is on the uni network. Nobody should be trying to login remotely, and the uni servers don’t talk to my PC for backups etc, as I run separate from their control!

TO DaveA: I have the power setting set to turn off my monitor after 2 hours, no standby or hibernation active.

Reply | Quote

I don’t use what I think you’re talking about when you say “usual Windows update” service. If that means the automatic service, I’d turn it OFF and see if the problem persists. Could be. Even though you say there should be nothing going on network-wise, there could be, without your knowledge. Have you looked in MSCONFIG to see what’s starting up when your computer is booted? The fact that the problem doesn’t happen over a SHORT time would lead me to think that it’s one of these two items.

Reply | Quote

Hi Al,

I’m loathe to turn off the automatic windows update, as the inconvenience of getting the endless stream of patches manually outweighs the problem of this error message… But I’ll turn off the windows update service over the weekend and see what happens on Monday..

As for boot items, I’ve checked and not spotted anything out of the ordinary.

Thanks for the advice, I’ll get back to you on Monday with the result of my experiment!!

Mark.

Reply | Quote

Well I switched off the critical updates service over the weekend and the error still occurred.

I should have mentioned that I use this machine as a web server and FTP server, so there is incoming connections on a regular basis. I can gather from the responses here that the error may be to do with incoming requests, but this has only started happening in the last month or two, the machine has been running the web server and FTP server for years without these errors….

Reply | Quote

Well I switched off the critical updates service over the weekend and the error still occurred.

I should have mentioned that I use this machine as a web server and FTP server, so there is incoming connections on a regular basis. I can gather from the responses here that the error may be to do with incoming requests, but this has only started happening in the last month or two, the machine has been running the web server and FTP server for years without these errors….

Reply | Quote

Well! That’s a different story. The errors do not sound like “anonymous” web and ftp problems. Are NT-style logons required for web and ftp? How exactly is this machine firewalled, that is, can you guarantee that all connections on ports other than the standard FTP and HTTP ports are being dropped?

Reply | Quote

The WWW server is IIS v5.1, and allows anonymous connections, the FTP server (Argosoft FTP server) does not allow anonymous connections, and the log shows no correlation between connections and the logon error, eg last night there were no connections to the FTP server, but the logon error still occurred a couple of times.

I use Kerio Personal Firewall & McAffee for anti-virus.

Reply | Quote

I’m not familiar with Kerio personal firewall. Is it set up to block the Windows networking ports so we can rule out attempted Windows logons?

Reply | Quote

Kerio is basically an updated version of the Tiny Personal Firewall, v2. See here.

I’m not quite sure about which ports should be blocked, can you be more specific please.

Reply | Quote

I think the Windows networking ports are 135-139, and then various other numbers I can’t remember. Perhaps you could start by blocking all inbound ports, and then opening only those that need to be open to enable FTP and WWW?

Reply | Quote

I think the Windows networking ports are 135-139, and then various other numbers I can’t remember. Perhaps you could start by blocking all inbound ports, and then opening only those that need to be open to enable FTP and WWW?

Reply | Quote

Kerio is basically an updated version of the Tiny Personal Firewall, v2. See here.

I’m not quite sure about which ports should be blocked, can you be more specific please.

Reply | Quote

I’m not familiar with Kerio personal firewall. Is it set up to block the Windows networking ports so we can rule out attempted Windows logons?

Reply | Quote

The WWW server is IIS v5.1, and allows anonymous connections, the FTP server (Argosoft FTP server) does not allow anonymous connections, and the log shows no correlation between connections and the logon error, eg last night there were no connections to the FTP server, but the logon error still occurred a couple of times.

I use Kerio Personal Firewall & McAffee for anti-virus.

Reply | Quote

Well! That’s a different story. The errors do not sound like “anonymous” web and ftp problems. Are NT-style logons required for web and ftp? How exactly is this machine firewalled, that is, can you guarantee that all connections on ports other than the standard FTP and HTTP ports are being dropped?

Reply | Quote

Hi Al,

I’m loathe to turn off the automatic windows update, as the inconvenience of getting the endless stream of patches manually outweighs the problem of this error message… But I’ll turn off the windows update service over the weekend and see what happens on Monday..

As for boot items, I’ve checked and not spotted anything out of the ordinary.

Thanks for the advice, I’ll get back to you on Monday with the result of my experiment!!

Mark.

Reply | Quote

I don’t use what I think you’re talking about when you say “usual Windows update” service. If that means the automatic service, I’d turn it OFF and see if the problem persists. Could be. Even though you say there should be nothing going on network-wise, there could be, without your knowledge. Have you looked in MSCONFIG to see what’s starting up when your computer is booted? The fact that the problem doesn’t happen over a SHORT time would lead me to think that it’s one of these two items.

Reply | Quote

Thanks for the replies!

To Bigaldoc: I Don’t have anything scheduled other than a weekly virusscan, and the usual Windows Update service. I get the message every day when I log in, but not if I simply lock the PC and come back 1/2 hour later..

To SMBP: I have both of those reg entires correct, although the userinit entry had a comma at the end, which I’ve removed.

To jscher2000: I am the only person who has login access to the PC, but it is on the uni network. Nobody should be trying to login remotely, and the uni servers don’t talk to my PC for backups etc, as I run separate from their control!

TO DaveA: I have the power setting set to turn off my monitor after 2 hours, no standby or hibernation active.

Reply | Quote

Do you have hibernation or any other power saving settings turned on?

DaveA I am so far behind, I think I am First
Genealogy....confusing the dead and annoying the living

Reply | Quote