Fast User Switching

[DrB323]

I'm lost in trying to figure out why the Fast User Switching (FUS) box
keeps getting "unchecked". (Fast User Switching is located via Control
Panel / User Accounts / Change The Way Users Log On Or Off).

Bottom line is that I am unable to switch users without getting logged
off myself. I also tried to check the FUS box is SAFE MODE, but it
didn't save my changes.

Is it a registry problem or am I missing something. FYI - I have
already disabled Offline Files.

Tks!

P.S. Sorry if my message appears twice...I'm a new registered user and
just getting myself acquainted with this forum.

 

[Ramesh, MS-MVP]

Bottom line is that I am unable to switch users without getting logged
off myself.

Interesting! Have you checked the following registry key, when the "Fast
User Switching" box is unchecked?

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Value named "AllowMultipleTSSessions"
Data: 0x1 means FUS is enabled
Data: 0x0 means FUS is disabled


--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com



I'm lost in trying to figure out why the Fast User Switching (FUS) box
keeps getting "unchecked". (Fast User Switching is located via Control
Panel / User Accounts / Change The Way Users Log On Or Off).

Bottom line is that I am unable to switch users without getting logged
off myself. I also tried to check the FUS box is SAFE MODE, but it
didn't save my changes.

Is it a registry problem or am I missing something. FYI - I have
already disabled Offline Files.

Tks!

P.S. Sorry if my message appears twice...I'm a new registered user and
just getting myself acquainted with this forum.

 

[DrB323]

Ramesh,

The data is listed as 0x00000000 (0). Should it be 0x00000001 (1)
??

Thanks.......

Bottom line is that I am unable to switch users without getting logged
off myself.

Interesting! Have you checked the following registry key, when the
"Fast
User Switching" box is unchecked?

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon]

Value named "AllowMultipleTSSessions"
Data: 0x1 means FUS is enabled
Data: 0x0 means FUS is disabled


--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


"DrB323" (e-mail address removed) wrote in message

I'm lost in trying to figure out why the Fast User Switching (FUS) box
keeps getting "unchecked". (Fast User Switching is located via Control
Panel / User Accounts / Change The Way Users Log On Or Off).

Bottom line is that I am unable to switch users without getting logged
off myself. I also tried to check the FUS box is SAFE MODE, but it
didn't save my changes.

Is it a registry problem or am I missing something. FYI - I have
already disabled Offline Files.

Tks!

P.S. Sorry if my message appears twice...I'm a new registered user
and
just getting myself acquainted with this forum.

 

[DrB323]

I went ahead and changed the value to a '1'. I then went back to the
Control Panel / User Accounts / etc....and did verify that the Fast
User Switching was checked.

When I tried to switch users, the screen went black and then blue and
then a LOGON MESSAGE appeared (with a yellow triangle and black
exclamation point) with this message:

"The user xxxxxxxxxx is currently logged on to this computer. If
you continue this user's computer session will end and any un-saved
data will be lost. Do you want to continue? Enter YES or NO."

I clicked NO to get back into my session. I went back and checked both
the registry AND the Control Panel / etc /etc....and lo and behold the
Fast User Switching was OFF again. (sigh!!!)

 

[Ramesh, MS-MVP]

DrB323,

Make sure that the following services are enabled:

Terminal Services
Fast User Switching compatibility service

You can verify/enable it using Services.msc applet.

If that does not help, you can use Regmon (from www.sysinternals.com) to
inspect which process is changing the "AllowMultipleTSSessions" to 0.
Alternately, you can use registry auditing to track this info. See here for
more information:

How to use Group Policy to configure auditing of Windows registry keys in XP
Professional?:
http://www.winxptutor.com/auditreg.htm

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com



I went ahead and changed the value to a '1'. I then went back to the
Control Panel / User Accounts / etc....and did verify that the Fast
User Switching was checked.

When I tried to switch users, the screen went black and then blue and
then a LOGON MESSAGE appeared (with a yellow triangle and black
exclamation point) with this message:

"The user xxxxxxxxxx is currently logged on to this computer. If
you continue this user's computer session will end and any un-saved
data will be lost. Do you want to continue? Enter YES or NO."

I clicked NO to get back into my session. I went back and checked both
the registry AND the Control Panel / etc /etc....and lo and behold the
Fast User Switching was OFF again. (sigh!!!)

 

[DrB323]

When I first logged in, I opened START/RUN/SERVICES.MSC. Both Fast Use
Switching Compatibility and Terminal Services had a startup type o
Automatic. However, whereas Terminal Services had a status of STARTED
Fast User Switching Compatibilty was blank. I went ahead and STARTE
FUS.

I then went into the Control Panel, etc and "checked" the FUS box.

Next, I ran the Regmon (cool tool - soooo much goes on behind th
scenes) and saw where AllowMultipleTSSessions started out a '0'
switched to a '1' (via a SetValue request), and then switched back to
'0'. However, it doesn't say what or how it's changed. Here is
screen print of the value going from 0x1 to 0x0:

40.28779221 winlogon.exe:1824 QueryValue HKLM\SOFTWARE\Microsoft\Window
NT\CurrentVersion\Winlogon\AllowMultipleTSSessions SUCCESS 0x1


40.28846359 winlogon.exe:1824 SetValue HKLM\SOFTWARE\Microsoft\Window
NT\CurrentVersion\Winlogon\AllowMultipleTSSessions SUCCESS 0x0


Is another service involved that is actually moving or changing th
value back to '0'? The 2 lines above are back-to-back successiv
processes. (I had a filter on for AllowMultipleTSSessions an
FastUserSwitching.)

Also, is the Remote Procedure Call (RPC) service involved? Thi
service was STARTED / AUTOMATIC, but another service called RPC Locato
was (blank) / AUTOMATIC.

When I was reviewing the status' while in SERVICES.MSC,
double-clicked on each FUS and TS service. There are 4 tabs (general
log on / recovery / dependencies). Would there be something in ther
that I need to check?

As far as auditing, I set that up, turned on FUS, (tried to) switc
users, saw that FUS was again unchecked and finally reviewed the even
log. At this point, I didn't see anything that told me wher
AllowMultipleTSSessions was changing. What should I be looking for?
saw the Image File Name and all of the Accesses, but nothing in regard
to FUS or AllowMultipleTSSessions.

Thanks......

DrB323,

Make sure that the following services are enabled:

Terminal Services
Fast User Switching compatibility service

You can verify/enable it using Services.msc applet.

If that does not help, you can use Regmon (from www.sysinternals.com
to
inspect which process is changing the "AllowMultipleTSSessions" to 0.
Alternately, you can use registry auditing to track this info. See her
for
more information:

How to use Group Policy to configure auditing of Windows registry key
in XP
Professional?:
http://www.winxptutor.com/auditreg.htm

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


"DrB323" (e-mail address removed) wrote in message

I went ahead and changed the value to a '1'. I then went back to the
Control Panel / User Accounts / etc....and did verify that the Fast
User Switching was checked.

When I tried to switch users, the screen went black and then blue and
then a LOGON MESSAGE appeared (with a yellow triangle and black
exclamation point) with this message:

"The user xxxxxxxxxx is currently logged on to this computer. If
you continue this user's computer session will end and any un-saved
data will be lost. Do you want to continue? Enter YES or NO."

I clicked NO to get back into my session. I went back and checke
both
the registry AND the Control Panel / etc /etc....and lo and behold the
Fast User Switching was OFF again. (sigh!!!

 

[POP]

I'm lost in trying to figure out why the Fast User
Switching (FUS) box keeps getting "unchecked". (Fast User
Switching is located via Control Panel / User Accounts /
Change The Way Users Log On Or Off).

Bottom line is that I am unable to switch users without
getting logged off myself. I also tried to check the FUS
box is SAFE MODE, but it didn't save my changes.

Is it a registry problem or am I missing something. FYI - I
have already disabled Offline Files.

Tks!

P.S. Sorry if my message appears twice...I'm a new
registered user and just getting myself acquainted with
this forum.

I can't tell specifically, but there are ways that other things
can be "checking" that status and keeping it turned off on you.
Third party apps such as Norton's System Optimizer and maybe
TweakUI and others, can grab control of it and make certain it
stays unset. Have you considered those?
Try reading about it in Help and Support; I think there are
details there about when it can't be turned on. or shouldn't be
turned on.

Can anyone pipe in with settings (LAN, etc.) that require FUS to
be turned off? I can't remember them at the moment.

HTH
Pop`

 

[DrB323]

POP,

Since I use NAV, I did run some maintenance called Norton WinDoctor.
There were 12 problems found, but none associated with this problem.
also disabled NAV and tried the FUS test, but still no luck.

I've never heard of TweakUI, so I'm unfamiliar with its purpose.
don't think I have it on my system. I'll continue to read up on it i
this forum.

Funny thing is that I've never had this problem up until about 2-4 day
ago. The only thing that I can even think about what's causing it ar
some Windows XP updates that I applied earlier this week. (or mayb
one of my kids downloaded a game or something that picked up a registr
prob.) I'm usually real good about keeping my system up to speed o
updates.

The updates are: KB918420, KB917150, KB917153, KB914796, KB917347
KB917159, KB916595, and KB914388.

Drb323

 

[Ramesh, MS-MVP]

Hi DrB323,

Two options that I can think of:

1. Alter the "AllowMultipleTSSessions" value directly in the registry, and
don't use the User Accounts applet.

2. See if there are any service failures (checking the Security event log)

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com



When I first logged in, I opened START/RUN/SERVICES.MSC. Both Fast User
Switching Compatibility and Terminal Services had a startup type of
Automatic. However, whereas Terminal Services had a status of STARTED,
Fast User Switching Compatibilty was blank. I went ahead and STARTED
FUS.

I then went into the Control Panel, etc and "checked" the FUS box.

Next, I ran the Regmon (cool tool - soooo much goes on behind the
scenes) and saw where AllowMultipleTSSessions started out a '0',
switched to a '1' (via a SetValue request), and then switched back to a
'0'. However, it doesn't say what or how it's changed. Here is a
screen print of the value going from 0x1 to 0x0:

40.28779221 winlogon.exe:1824 QueryValue HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\AllowMultipleTSSessions SUCCESS 0x1


40.28846359 winlogon.exe:1824 SetValue HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\AllowMultipleTSSessions SUCCESS 0x0


Is another service involved that is actually moving or changing the
value back to '0'? The 2 lines above are back-to-back successive
processes. (I had a filter on for AllowMultipleTSSessions and
FastUserSwitching.)

Also, is the Remote Procedure Call (RPC) service involved? This
service was STARTED / AUTOMATIC, but another service called RPC Locator
was (blank) / AUTOMATIC.

When I was reviewing the status' while in SERVICES.MSC, I
double-clicked on each FUS and TS service. There are 4 tabs (general /
log on / recovery / dependencies). Would there be something in there
that I need to check?

As far as auditing, I set that up, turned on FUS, (tried to) switch
users, saw that FUS was again unchecked and finally reviewed the event
log. At this point, I didn't see anything that told me where
AllowMultipleTSSessions was changing. What should I be looking for? I
saw the Image File Name and all of the Accesses, but nothing in regards
to FUS or AllowMultipleTSSessions.

Thanks......

 

[DrB323]

Ramesh,

I've changed the registry for AllowMultipleTSSessions to 0x1, but it'
still getting reset to 0x0 while trying to switch users.

I've also run an audit but don't see any failures. Below is on
copy/paste of a process from the event log. Every process is virtuall
the same except for the changing of the Image File Name. Those fil
names are:

verclsid.exe
mmc.exe
explorer.exe
winlogon.exe
msmsgs.exe
regedit.exe
winhlp32.exe
hposm.exe (the only one from the sub-directory o
HP\hpcoretech\soln)

Under the ACCESSES below, does that tell us anything?

tks..............Drb



Object Open:
Object Server: Security
Object Type: Key
Object Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Window
NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings
Handle ID: 2328
Operation ID: {0,8814058}
Process ID: 584
Image File Name: C:\WINDOWS\system32\winlogon.exe
Primary User Name: PERSONAL$
Primary Domain: MSHOME
Primary Logon ID: (0x0,0x3E7)
Client User Name: Mike Nielson
Client Domain: PERSONAL
Client Logon ID: (0x0,0x7B14C1)
Accesses: READ_CONTROL
Query key value
Set key value
Create sub-key
Enumerate sub-keys
Notify about changes to keys

Hi DrB323,

Two options that I can think of:

1. Alter the "AllowMultipleTSSessions" value directly in the registry
and
don't use the User Accounts applet.

2. See if there are any service failures (checking the Security even
log)

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


"DrB323" (e-mail address removed) wrote in message

When I first logged in, I opened START/RUN/SERVICES.MSC. Both Fas
User
Switching Compatibility and Terminal Services had a startup type of
Automatic. However, whereas Terminal Services had a status o
STARTED,
Fast User Switching Compatibilty was blank. I went ahead and STARTED
FUS.

I then went into the Control Panel, etc and "checked" the FUS box.

Next, I ran the Regmon (cool tool - soooo much goes on behind the
scenes) and saw where AllowMultipleTSSessions started out a '0',
switched to a '1' (via a SetValue request), and then switched back t
a
'0'. However, it doesn't say what or how it's changed. Here is a
screen print of the value going from 0x1 to 0x0:

40.28779221 winlogon.exe:1824 QueryValu
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\AllowMultipleTSSessions SUCCESS 0x1


40.28846359 winlogon.exe:1824 SetValue HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\AllowMultipleTSSessions SUCCESS 0x0


Is another service involved that is actually moving or changing the
value back to '0'? The 2 lines above are back-to-back successive
processes. (I had a filter on for AllowMultipleTSSessions and
FastUserSwitching.)

Also, is the Remote Procedure Call (RPC) service involved? This
service was STARTED / AUTOMATIC, but another service called RP
Locator
was (blank) / AUTOMATIC.

When I was reviewing the status' while in SERVICES.MSC, I
double-clicked on each FUS and TS service. There are 4 tabs (genera
/
log on / recovery / dependencies). Would there be something in there
that I need to check?

As far as auditing, I set that up, turned on FUS, (tried to) switch
users, saw that FUS was again unchecked and finally reviewed the event
log. At this point, I didn't see anything that told me where
AllowMultipleTSSessions was changing. What should I be looking for?
I
saw the Image File Name and all of the Accesses, but nothing i
regards
to FUS or AllowMultipleTSSessions.

Thanks.....

 

[DrB323]

To add some additional notes from earlier this morning, I'm basically at
a loss on what's going on. I'm now in the restore mode. Since I don't
really have a good restore point (which is another subject and probably
another chatroom), I've been removing/uninstalling stuff that had been
put on / installed within the past 7 days.

I've removed MS Ofc updates KB918420, KB917150, KB917153, KB914796, and
KB917347.

I've removed Win XP updates KB917159, KB916595, and KB914388.

I've removed .NET update KB917283.

I couldn't remove a Windows Defender update, KB915597, so I've just
uninstalled Windows Defender.

The only update I'm not able to remove is KB890830 - which is some sort
of malicious removal software tool.

I've also ran across a couple of programs/processes called AGEIA and
AEGIS - GONE!!!

I've run traces and audits, looked thru event logs, double-checked and
triple-checked the FastUserSwitching, Remote Procedure Call, and
Terminal services, and edited regedit for AllowMultipleTSSessions.

So far, I've not run across any service failures.

I've tried this with and without Norton Anti-Virus.

In summing up, I can turn on the FUS service, save the changes, get
back to my desktop (no open window sessions), then go back to Control
Panel to check FUS......it is still ON. BUT, when I logoff and log
back on, it's turned off.

Food for thought on this one....I booted up in SAFE MODE once, made the
change via the Control Panel, hit Apply Options, and then went back to
view my change - it was OFF. So, maybe SAVE MODE is trying to tell me
something that my change isn't REALLY working at all. In normal mode,
it looks like the change is there and eventually is turned off at
logoff time, but safe mode turns it off immediately.

If I do have a problem with a "third party", how do I go about tracking
that?

Thank you all.........DrB

 

[Ramesh, MS-MVP]

No third-party issue, from what I see in this case.

- - -
40.28779221 winlogon.exe:1824 QueryValue HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\AllowMultipleTSSessions SUCCESS 0x0
- - -

It's the Windows' own process, Winlogon.exe resetting the
"AllowMultipleTSSessions" to 0, and I have no clue as to why this happens.

I'm running out of ideas here, but will sure let you know if I come across
any issues (perhaps someone from the WU newsgroups or elsewhere would be
facing the same problem.)

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com



To add some additional notes from earlier this morning, I'm basically at
a loss on what's going on. I'm now in the restore mode. Since I don't
really have a good restore point (which is another subject and probably
another chatroom), I've been removing/uninstalling stuff that had been
put on / installed within the past 7 days.

I've removed MS Ofc updates KB918420, KB917150, KB917153, KB914796, and
KB917347.

I've removed Win XP updates KB917159, KB916595, and KB914388.

I've removed .NET update KB917283.

I couldn't remove a Windows Defender update, KB915597, so I've just
uninstalled Windows Defender.

The only update I'm not able to remove is KB890830 - which is some sort
of malicious removal software tool.

I've also ran across a couple of programs/processes called AGEIA and
AEGIS - GONE!!!

I've run traces and audits, looked thru event logs, double-checked and
triple-checked the FastUserSwitching, Remote Procedure Call, and
Terminal services, and edited regedit for AllowMultipleTSSessions.

So far, I've not run across any service failures.

I've tried this with and without Norton Anti-Virus.

In summing up, I can turn on the FUS service, save the changes, get
back to my desktop (no open window sessions), then go back to Control
Panel to check FUS......it is still ON. BUT, when I logoff and log
back on, it's turned off.

Food for thought on this one....I booted up in SAFE MODE once, made the
change via the Control Panel, hit Apply Options, and then went back to
view my change - it was OFF. So, maybe SAVE MODE is trying to tell me
something that my change isn't REALLY working at all. In normal mode,
it looks like the change is there and eventually is turned off at
logoff time, but safe mode turns it off immediately.

If I do have a problem with a "third party", how do I go about tracking
that?

Thank you all.........DrB