Winlogon og vinir þess

Fékk áhugavert mál inn á borð til mín um daginn þar sem terminal serverar fóru að fá 120 sekúndna pásu við logon eftir 24-48 tíma, eftir að hafa skoðað það í nokkra daga komst ég að eftirfarandi: 

On any platform that has installed the Lotus Notes client with the 'Single Sign-on' option chosen during the setup, a network provider called npnotes is added to the list of NP's that Winlogon should notify during logon and password changes. When this NP fails (usually within 48 hours on a busy TS), Winlogon starts timing out waiting for an answer from it (default timeout is 2 minutes).

The workaround is to remove the npnotes entries from the Network Provider registry keys which prevents it from loading (no reboot required).  In this case the npnotes entry was the problem and removing it resolved the issue.

The following registry key is taken from a TS running Citrix Presentation Server 4.5:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\HwOrder]
"ProviderOrder"="Cwbnetnt,CdmService,RDPNP,LanmanWorkstation,WebClient,PnSson,npnotes"

 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order]
"ProviderOrder"="Cwbnetnt,CdmService,RDPNP,LanmanWorkstation,WebClient,PnSson,npnotes"

Using a checked build of Winlogon, the following is seen when the problem occurs:
15:05:46.881: 11472.21432> Winlogon-Trace-Timeout: Enabling timeout after 120 seconds
15:07:46.895: 11472.21432> Winlogon-Trace-Timeout: Input timer went off, sending TIMEOUT

Using Procmon you see Winlogon spawn an instance of mpnotify.exe to notify the NP's, which would normally terminate immediately after notifying all the NP's.

When the problem occurs mpnotify.exe terminates after 2 minutes and the logon proceeds normally. Additional symptoms are that the logon is normal for a period of time after a reboot, however when the problem occurs (usually within 48 hours) all logons on that server are affected (since NPNotes stops responding).

On a Citrix box the logon session will be waiting for 120 seconds while the "Checking your credentials" prompt is displayed within the TS client (with the Citrix GINA installed). Replacing the GINA changes the message but doesn't otherwise make any difference (since the problem is with the faulty NP).

Note that this may also affect normal workstations, however the symptoms will be much more apparent on a Terminal Server since it is less likely to be rebooted regularly and has a greater number of users logging on to it.