winlogon high cpu usage...

[GO]

Winlogon.exe has been routinely utilizing a very high amount of processing
time (90% and greater). It seems to occur about once a week (or less) and
typically is right after I power on and log in. The machine is pretty much
useless and I have to forcibly power down and restart. I think it started
doing this a couple months ago but I can't pin it down to anything specific
(possibly a Windows update?). The Event log has nothing out of the ordinary
and have yet to come across anything relevant in my own search to date. Any
ideas on a cause?


TIA,

Greg

 

[Sid Knee]

Winlogon.exe has been routinely utilizing a very high amount of processing
time (90% and greater). It seems to occur about once a week (or less) and
typically is right after I power on and log in. The machine is pretty much
useless and I have to forcibly power down and restart. I think it started
doing this a couple months ago but I can't pin it down to anything specific
(possibly a Windows update?). The Event log has nothing out of the ordinary
and have yet to come across anything relevant in my own search to date. Any
ideas on a cause?

I posted some time ago about a problem that sounds similar. See:

http://groups.google.ca/group/micro...gst&q=sid+knee&rnum=24&hl=en#17347a61dd835200

In my case I got a lot of disk activity along with the high cpu usage
for perhaps 5 minutes after desktop presentation, during which the
machine was pretty much unusable.

Never found a satisfactory resolution and like you, I suspected that it
started with a windows update. However, it only happened on one of my
machines and I have 5 or 6 (it varies) running Win2K.

I found also that running a chkdsk on the boot drive (I did it from a
Bart's PE Boot Disk) took an extremely long time initially examining the
MFT. Similarly, if I did a Ghost backup from a dos boot it would again
spend a long time examining the MFT (probably running its own chkdsk).
In both cases however, the filesystem was reported to be problem free.

The manufacturer's HD test utility pronounced the drive in good health

I'd be interested to know what happens when you run a chkdsk.

I removed what applications I could which improved things slightly
(probably due to the reduction in MFT size). I also changed the HD (for
other reasons) for a larger, faster drive and that improved things
significantly

 

[GO]

I posted some time ago about a problem that sounds similar. See:

http://groups.google.ca/group/microsoft.public.win2000.general/browse_frm/th
read/5de0e9f521d47b0f/17347a61dd835200?lnk=gst&q=sid+knee&rnum=24&hl=en#1734
7a61dd835200

In my case I got a lot of disk activity along with the high cpu usage
for perhaps 5 minutes after desktop presentation, during which the
machine was pretty much unusable.

Never found a satisfactory resolution and like you, I suspected that
it started with a windows update. However, it only happened on one of
my machines and I have 5 or 6 (it varies) running Win2K.

I found also that running a chkdsk on the boot drive (I did it from a
Bart's PE Boot Disk) took an extremely long time initially examining
the MFT. Similarly, if I did a Ghost backup from a dos boot it would
again spend a long time examining the MFT (probably running its own
chkdsk). In both cases however, the filesystem was reported to be
problem free.

The manufacturer's HD test utility pronounced the drive in good health

I'd be interested to know what happens when you run a chkdsk.

I removed what applications I could which improved things slightly
(probably due to the reduction in MFT size). I also changed the HD
(for other reasons) for a larger, faster drive and that improved
things significantly

Hi Sid Knee,

Thanks for the reply. I am not experiencing and hard drive thrashing as
you were, and chkdsk comes up clean. I didn't perform an offline chkdsk, so
I'm not sure if that would yield different results. When the winlogon
problem occurs I don't think it will ever come back to "life" on it's own
without a hard boot (I let it run for close to a half-hour at one point and
it constantly ate 90%+ of my CPU).

At this point I'm pretty much set to restore from a Ghost image, but it
would be nice to resolve the matter without resorting to that.

Thanks,

Greg

 

[Sid Knee]

GO wrote:
Knee,

Thanks for the reply. I am not experiencing and hard drive thrashing as
you were, and chkdsk comes up clean. I didn't perform an offline chkdsk, so
I'm not sure if that would yield different results. When the winlogon
problem occurs I don't think it will ever come back to "life" on it's own
without a hard boot (I let it run for close to a half-hour at one point and
it constantly ate 90%+ of my CPU).

Sounds like it might be something different to what I was seeing. I take
it you've done all the usual virus/malware scans?

At this point I'm pretty much set to restore from a Ghost image, but it
would be nice to resolve the matter without resorting to that.

You could use Ghost to backup the current installation and restore an
earlier one temporarily to see if the problem goes away. If it does you
could do the Windows Updates one at a time and see if one of them starts
this behaviour.

Or ... you could back up the current installation and then remove the
latest windows updates one by one to see if the problem disappears at
some point.

 

[GO]

GO wrote:
Knee,

Sounds like it might be something different to what I was seeing. I
take it you've done all the usual virus/malware scans?

Yup. Both came up clean. Two different virus scanners, with one being a
remote scan from my XP box. Malware has been a non-issue since switching to
Firefox (although I still do a scan now and again).

You could use Ghost to backup the current installation and restore an
earlier one temporarily to see if the problem goes away. If it does
you could do the Windows Updates one at a time and see if one of them
starts this behaviour.

Or ... you could back up the current installation and then remove the
latest windows updates one by one to see if the problem disappears at
some point.

The problem is quite intermittent so I think troubleshooting will be a time
waster. What I'm likely to do is just restore my Ghost image (which is
more or less a full backup of what I have now as my Win2k box rarely
changes) and bring it up to date with the patches. If the problem returns
then a Windows update will be a prime suspect. And at that point I will
restore again and slowly add the patches.

Thanks again,

Greg