Normal user login now logs off immediately [w/o administrator righ

[Guest]

My normal user account under XP Pro SP2 (which has no administrator rights)
is no longer able to login. The login begins in a normal fashion: preferences
are loaded, there is disk activity for a while, the background image is
displayed, but before any icons or toolbar entries appear a logout suddenly
occurs. If I try again the logout is immediate. While trying to diagnose the
problem I happened to give my normal user account administrator rights, which
then strangely allows a normal login. Very spooky. Removing admin rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was logged just before
the problem began. The very next normal start automatically included a chkdsk
run, repairing many problems on my C: drive (file truncations, orphan
clusters, etc.). Nothing to really worry about. After about a minute into the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because of an "incorrect
application configuration".

I've tried everything I can think of to repair the damage. Chkdsk shows no
errors, and I also haven't been able to spot any errors with Regedit. The
security profiles also appear to be correct when compared with another XP Pro
system. I’ve browsed here extensively for similar problems and not found
anything applicable. I don’t have the typical userinit / wsaupdaterregistry
problem with the registry winlogon entry. I also went back to a check point
previous to the problem, but that didn’t change the behavior either. I'm sure
I don't have a malware problem, as I have AD-Watch active, use Spybot
regularly, and have a decent Kaspersky Internet Security package.

It must be something during the login procedure which is directly affected
by administrator rights, but what? Any ideas? It would probably be helpful,
if one could somehow protocol the logon progress to find out what is actually
going awry. I really hate to have to leave administrator rights enabled for
my normal work, as that's inviting trouble. As an ex-computer expert, I must
admit that I’ve never seen XP have problems of this kind after a minor disk
problem. I'd really appreciate any help in the matter.

 

[DL]

If you've had a minor disk problem perhaps you ought to download and run the
HD manu checking utility

 

[WTC]

My normal user account under XP Pro SP2 (which has no administrator
rights)
is no longer able to login. The login begins in a normal fashion:
preferences
are loaded, there is disk activity for a while, the background image is
displayed, but before any icons or toolbar entries appear a logout
suddenly
occurs. If I try again the logout is immediate. While trying to diagnose
the
problem I happened to give my normal user account administrator rights,
which
then strangely allows a normal login. Very spooky. Removing admin rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was logged just
before
the problem began. The very next normal start automatically included a
chkdsk
run, repairing many problems on my C: drive (file truncations, orphan
clusters, etc.). Nothing to really worry about. After about a minute into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because of an "incorrect
application configuration".

I've tried everything I can think of to repair the damage. Chkdsk shows no
errors, and I also haven't been able to spot any errors with Regedit. The
security profiles also appear to be correct when compared with another XP
Pro
system. I've browsed here extensively for similar problems and not found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back to a check
point
previous to the problem, but that didn't change the behavior either. I'm
sure
I don't have a malware problem, as I have AD-Watch active, use Spybot
regularly, and have a decent Kaspersky Internet Security package.

It must be something during the login procedure which is directly affected
by administrator rights, but what? Any ideas? It would probably be
helpful,
if one could somehow protocol the logon progress to find out what is
actually
going awry. I really hate to have to leave administrator rights enabled
for
my normal work, as that's inviting trouble. As an ex-computer expert, I
must
admit that I've never seen XP have problems of this kind after a minor
disk
problem. I'd really appreciate any help in the matter.

Could you post back with all the permissions that allow or denied on this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I just have a hunch
that the permissions may be incorrect.

 

[Guest]

If you've had a minor disk problem perhaps you ought to download and run the
HD manu checking utility

My apologies DL, I probably led you to believe the HD itself was flaky. That
is not the case. I merely had a hangup caused by XP itself while waking from
hibernate with a mouse missing. The only way to "breakoff" in such cases is
to hold down the laptop's power on button to force a shutdown. That often
leaves stray drive problems, but nothing which causes Chkdsk to stumble or
cause actual XP problems ----- at least until now!

 

[Guest]

My normal user account under XP Pro SP2 (which has no administrator
rights)
is no longer able to login. The login begins in a normal fashion:
preferences
are loaded, there is disk activity for a while, the background image is
displayed, but before any icons or toolbar entries appear a logout
suddenly
occurs. If I try again the logout is immediate. While trying to diagnose
the
problem I happened to give my normal user account administrator rights,
which
then strangely allows a normal login. Very spooky. Removing admin rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was logged just
before
the problem began. The very next normal start automatically included a
chkdsk
run, repairing many problems on my C: drive (file truncations, orphan
clusters, etc.). Nothing to really worry about. After about a minute into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because of an "incorrect
application configuration".

I've tried everything I can think of to repair the damage. Chkdsk shows no
errors, and I also haven't been able to spot any errors with Regedit. The
security profiles also appear to be correct when compared with another XP
Pro
system. I've browsed here extensively for similar problems and not found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back to a check
point
previous to the problem, but that didn't change the behavior either. I'm
sure
I don't have a malware problem, as I have AD-Watch active, use Spybot
regularly, and have a decent Kaspersky Internet Security package.

It must be something during the login procedure which is directly affected
by administrator rights, but what? Any ideas? It would probably be
helpful,
if one could somehow protocol the logon progress to find out what is
actually
going awry. I really hate to have to leave administrator rights enabled
for
my normal work, as that's inviting trouble. As an ex-computer expert, I
must
admit that I've never seen XP have problems of this kind after a minor
disk
problem. I'd really appreciate any help in the matter.

Could you post back with all the permissions that allow or denied on this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I just have a hunch
that the permissions may be incorrect.

Thanks for the reply WTC. I plowed into regedit and pulled up the things you
requested for [HKLM\System\MountedDevices], I hope.

Groups or Usernames Permissions Apply to:

Admin (User) Special Permissions Just this key
Administrators (Group) Full Access/Read This key & subs
Users (Group) Read This key & subs
CREATOR-OWNER (Group) Special Permissions Just sub-keys
Main Users (Group) Read This key & subs
SYSTEM (Group) Read This key & subs


There were no explicit "denies".

I also happened to look at the key directly above
[HKLM\System\MountedDevice1]. It is of "almost" the same content, but
interestingly different. It contains 21 "Volume" entries & DosDevices, where
as \MountedDevice contains 27 "Volume" entries & DosDevices. The entries look
a bit "hodge-podge" for my taste. Does that help?

Oh yes, my "problem" user is just a normal User with no special permissions,
ie. read only.

 

[WTC]

My normal user account under XP Pro SP2 (which has no administrator
rights)
is no longer able to login. The login begins in a normal fashion:
preferences
are loaded, there is disk activity for a while, the background image is
displayed, but before any icons or toolbar entries appear a logout
suddenly
occurs. If I try again the logout is immediate. While trying to
diagnose
the
problem I happened to give my normal user account administrator rights,
which
then strangely allows a normal login. Very spooky. Removing admin
rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was logged just
before
the problem began. The very next normal start automatically included a
chkdsk
run, repairing many problems on my C: drive (file truncations, orphan
clusters, etc.). Nothing to really worry about. After about a minute
into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because of an
"incorrect
application configuration".

I've tried everything I can think of to repair the damage. Chkdsk shows
no
errors, and I also haven't been able to spot any errors with Regedit.
The
security profiles also appear to be correct when compared with another
XP
Pro
system. I've browsed here extensively for similar problems and not
found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back to a check
point
previous to the problem, but that didn't change the behavior either.
I'm
sure
I don't have a malware problem, as I have AD-Watch active, use Spybot
regularly, and have a decent Kaspersky Internet Security package.

It must be something during the login procedure which is directly
affected
by administrator rights, but what? Any ideas? It would probably be
helpful,
if one could somehow protocol the logon progress to find out what is
actually
going awry. I really hate to have to leave administrator rights enabled
for
my normal work, as that's inviting trouble. As an ex-computer expert, I
must
admit that I've never seen XP have problems of this kind after a minor
disk
problem. I'd really appreciate any help in the matter.

Could you post back with all the permissions that allow or denied on this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I just have a
hunch
that the permissions may be incorrect.

Thanks for the reply WTC. I plowed into regedit and pulled up the things
you
requested for [HKLM\System\MountedDevices], I hope.

Groups or Usernames Permissions Apply to:

Admin (User) Special Permissions Just this key
Administrators (Group) Full Access/Read This key & subs
Users (Group) Read This key & subs
CREATOR-OWNER (Group) Special Permissions Just sub-keys
Main Users (Group) Read This key & subs
SYSTEM (Group) Read This key & subs


There were no explicit "denies".

I also happened to look at the key directly above
[HKLM\System\MountedDevice1]. It is of "almost" the same content, but
interestingly different. It contains 21 "Volume" entries & DosDevices,
where
as \MountedDevice contains 27 "Volume" entries & DosDevices. The entries
look
a bit "hodge-podge" for my taste. Does that help?

Oh yes, my "problem" user is just a normal User with no special
permissions,
ie. read only.

Everything appears normal. Does this just happen to one user? Or does it
happen to all account that have User permissions and restrictions?

 

[Guest]

My normal user account under XP Pro SP2 (which has no administrator
rights)
is no longer able to login. The login begins in a normal fashion:
preferences
are loaded, there is disk activity for a while, the background image is
displayed, but before any icons or toolbar entries appear a logout
suddenly
occurs. If I try again the logout is immediate. While trying to
diagnose
the
problem I happened to give my normal user account administrator rights,
which
then strangely allows a normal login. Very spooky. Removing admin
rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was logged just
before
the problem began. The very next normal start automatically included a
chkdsk
run, repairing many problems on my C: drive (file truncations, orphan
clusters, etc.). Nothing to really worry about. After about a minute
into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because of an
"incorrect
application configuration".

I've tried everything I can think of to repair the damage. Chkdsk shows
no
errors, and I also haven't been able to spot any errors with Regedit.
The
security profiles also appear to be correct when compared with another
XP
Pro
system. I've browsed here extensively for similar problems and not
found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back to a check
point
previous to the problem, but that didn't change the behavior either.
I'm
sure
I don't have a malware problem, as I have AD-Watch active, use Spybot
regularly, and have a decent Kaspersky Internet Security package.

It must be something during the login procedure which is directly
affected
by administrator rights, but what? Any ideas? It would probably be
helpful,
if one could somehow protocol the logon progress to find out what is
actually
going awry. I really hate to have to leave administrator rights enabled
for
my normal work, as that's inviting trouble. As an ex-computer expert, I
must
admit that I've never seen XP have problems of this kind after a minor
disk
problem. I'd really appreciate any help in the matter.


Could you post back with all the permissions that allow or denied on this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I just have a
hunch
that the permissions may be incorrect.

Thanks for the reply WTC. I plowed into regedit and pulled up the things
you
requested for [HKLM\System\MountedDevices], I hope.

Groups or Usernames Permissions Apply to:

Admin (User) Special Permissions Just this key
Administrators (Group) Full Access/Read This key & subs
Users (Group) Read This key & subs
CREATOR-OWNER (Group) Special Permissions Just sub-keys
Main Users (Group) Read This key & subs
SYSTEM (Group) Read This key & subs


There were no explicit "denies".

I also happened to look at the key directly above
[HKLM\System\MountedDevice1]. It is of "almost" the same content, but
interestingly different. It contains 21 "Volume" entries & DosDevices,
where
as \MountedDevice contains 27 "Volume" entries & DosDevices. The entries
look
a bit "hodge-podge" for my taste. Does that help?

Oh yes, my "problem" user is just a normal User with no special
permissions,
ie. read only.

Everything appears normal. Does this just happen to one user? Or does it
happen to all account that have User permissions and restrictions?

Hmmm.....It only happens to just this one normal user account, my other is
with administrator priviledges for installation and housekeeping work. Really
strange, what? I don't suppose you have any ideas how I could protocol the
logon sequence?

 

[WTC]

:

My normal user account under XP Pro SP2 (which has no administrator
rights)
is no longer able to login. The login begins in a normal fashion:
preferences
are loaded, there is disk activity for a while, the background image
is
displayed, but before any icons or toolbar entries appear a logout
suddenly
occurs. If I try again the logout is immediate. While trying to
diagnose
the
problem I happened to give my normal user account administrator
rights,
which
then strangely allows a normal login. Very spooky. Removing admin
rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was logged
just
before
the problem began. The very next normal start automatically included
a
chkdsk
run, repairing many problems on my C: drive (file truncations,
orphan
clusters, etc.). Nothing to really worry about. After about a minute
into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because of an
"incorrect
application configuration".

I've tried everything I can think of to repair the damage. Chkdsk
shows
no
errors, and I also haven't been able to spot any errors with
Regedit.
The
security profiles also appear to be correct when compared with
another
XP
Pro
system. I've browsed here extensively for similar problems and not
found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back to a
check
point
previous to the problem, but that didn't change the behavior either.
I'm
sure
I don't have a malware problem, as I have AD-Watch active, use
Spybot
regularly, and have a decent Kaspersky Internet Security package.

It must be something during the login procedure which is directly
affected
by administrator rights, but what? Any ideas? It would probably be
helpful,
if one could somehow protocol the logon progress to find out what is
actually
going awry. I really hate to have to leave administrator rights
enabled
for
my normal work, as that's inviting trouble. As an ex-computer
expert, I
must
admit that I've never seen XP have problems of this kind after a
minor
disk
problem. I'd really appreciate any help in the matter.


Could you post back with all the permissions that allow or denied on
this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I just have a
hunch
that the permissions may be incorrect.

--
William Crawford
MS-MVP Windows Shell/User

Thanks for the reply WTC. I plowed into regedit and pulled up the
things
you
requested for [HKLM\System\MountedDevices], I hope.

Groups or Usernames Permissions Apply to:

Admin (User) Special Permissions Just this key
Administrators (Group) Full Access/Read This key & subs
Users (Group) Read This key & subs
CREATOR-OWNER (Group) Special Permissions Just sub-keys
Main Users (Group) Read This key & subs
SYSTEM (Group) Read This key & subs


There were no explicit "denies".

I also happened to look at the key directly above
[HKLM\System\MountedDevice1]. It is of "almost" the same content, but
interestingly different. It contains 21 "Volume" entries & DosDevices,
where
as \MountedDevice contains 27 "Volume" entries & DosDevices. The
entries
look
a bit "hodge-podge" for my taste. Does that help?

Oh yes, my "problem" user is just a normal User with no special
permissions,
ie. read only.

Everything appears normal. Does this just happen to one user? Or does it
happen to all account that have User permissions and restrictions?

Hmmm.....It only happens to just this one normal user account, my other is
with administrator priviledges for installation and housekeeping work.
Really
strange, what? I don't suppose you have any ideas how I could protocol the
logon sequence?

Create a new normal user account and see what happens. If you have no
problems then copy the old profile to a new profile.

How to copy data from a corrupted user profile to a new profile
http://support.microsoft.com/default.aspx?kbid=811151

 

[Guest]

:

My normal user account under XP Pro SP2 (which has no administrator
rights)
is no longer able to login. The login begins in a normal fashion:
preferences
are loaded, there is disk activity for a while, the background image
is
displayed, but before any icons or toolbar entries appear a logout
suddenly
occurs. If I try again the logout is immediate. While trying to
diagnose
the
problem I happened to give my normal user account administrator
rights,
which
then strangely allows a normal login. Very spooky. Removing admin
rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was logged
just
before
the problem began. The very next normal start automatically included
a
chkdsk
run, repairing many problems on my C: drive (file truncations,
orphan
clusters, etc.). Nothing to really worry about. After about a minute
into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because of an
"incorrect
application configuration".

I've tried everything I can think of to repair the damage. Chkdsk
shows
no
errors, and I also haven't been able to spot any errors with
Regedit.
The
security profiles also appear to be correct when compared with
another
XP
Pro
system. I've browsed here extensively for similar problems and not
found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back to a
check
point
previous to the problem, but that didn't change the behavior either.
I'm
sure
I don't have a malware problem, as I have AD-Watch active, use
Spybot
regularly, and have a decent Kaspersky Internet Security package.

It must be something during the login procedure which is directly
affected
by administrator rights, but what? Any ideas? It would probably be
helpful,
if one could somehow protocol the logon progress to find out what is
actually
going awry. I really hate to have to leave administrator rights
enabled
for
my normal work, as that's inviting trouble. As an ex-computer
expert, I
must
admit that I've never seen XP have problems of this kind after a
minor
disk
problem. I'd really appreciate any help in the matter.


Could you post back with all the permissions that allow or denied on
this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I just have a
hunch
that the permissions may be incorrect.

--
William Crawford
MS-MVP Windows Shell/User

Thanks for the reply WTC. I plowed into regedit and pulled up the
things
you
requested for [HKLM\System\MountedDevices], I hope.

Groups or Usernames Permissions Apply to:

Admin (User) Special Permissions Just this key
Administrators (Group) Full Access/Read This key & subs
Users (Group) Read This key & subs
CREATOR-OWNER (Group) Special Permissions Just sub-keys
Main Users (Group) Read This key & subs
SYSTEM (Group) Read This key & subs


There were no explicit "denies".

I also happened to look at the key directly above
[HKLM\System\MountedDevice1]. It is of "almost" the same content, but
interestingly different. It contains 21 "Volume" entries & DosDevices,
where
as \MountedDevice contains 27 "Volume" entries & DosDevices. The
entries
look
a bit "hodge-podge" for my taste. Does that help?

Oh yes, my "problem" user is just a normal User with no special
permissions,
ie. read only.


Everything appears normal. Does this just happen to one user? Or does it
happen to all account that have User permissions and restrictions?

Hmmm.....It only happens to just this one normal user account, my other is
with administrator priviledges for installation and housekeeping work.
Really
strange, what? I don't suppose you have any ideas how I could protocol the
logon sequence?

Create a new normal user account and see what happens. If you have no
problems then copy the old profile to a new profile.

How to copy data from a corrupted user profile to a new profile
http://support.microsoft.com/default.aspx?kbid=811151

I made an additional normal user account (w/o administrator rights) and had
the same login/logout problem with it too. I got brave and also temporarily
removed administrator rights from my normal "admin" user and the problem
appeared there too! That means the problem is indeed deeper seated, and
infact affects any and all user accounts, even newly created ones.

I don't suppose you happen to know how to find the file name from the id
given in the chkdsk protocol? That might be a help to figure out what went
wrong. By the way, the DCOM error I wrote about had to do with
"C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding".

 

[WTC]

:



:

My normal user account under XP Pro SP2 (which has no
administrator
rights)
is no longer able to login. The login begins in a normal fashion:
preferences
are loaded, there is disk activity for a while, the background
image
is
displayed, but before any icons or toolbar entries appear a
logout
suddenly
occurs. If I try again the logout is immediate. While trying to
diagnose
the
problem I happened to give my normal user account administrator
rights,
which
then strangely allows a normal login. Very spooky. Removing admin
rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was logged
just
before
the problem began. The very next normal start automatically
included
a
chkdsk
run, repairing many problems on my C: drive (file truncations,
orphan
clusters, etc.). Nothing to really worry about. After about a
minute
into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because of an
"incorrect
application configuration".

I've tried everything I can think of to repair the damage. Chkdsk
shows
no
errors, and I also haven't been able to spot any errors with
Regedit.
The
security profiles also appear to be correct when compared with
another
XP
Pro
system. I've browsed here extensively for similar problems and
not
found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back to a
check
point
previous to the problem, but that didn't change the behavior
either.
I'm
sure
I don't have a malware problem, as I have AD-Watch active, use
Spybot
regularly, and have a decent Kaspersky Internet Security package.

It must be something during the login procedure which is directly
affected
by administrator rights, but what? Any ideas? It would probably
be
helpful,
if one could somehow protocol the logon progress to find out what
is
actually
going awry. I really hate to have to leave administrator rights
enabled
for
my normal work, as that's inviting trouble. As an ex-computer
expert, I
must
admit that I've never seen XP have problems of this kind after a
minor
disk
problem. I'd really appreciate any help in the matter.


Could you post back with all the permissions that allow or denied
on
this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I just have
a
hunch
that the permissions may be incorrect.

--
William Crawford
MS-MVP Windows Shell/User

Thanks for the reply WTC. I plowed into regedit and pulled up the
things
you
requested for [HKLM\System\MountedDevices], I hope.

Groups or Usernames Permissions Apply to:

Admin (User) Special Permissions Just this key
Administrators (Group) Full Access/Read This key & subs
Users (Group) Read This key & subs
CREATOR-OWNER (Group) Special Permissions Just sub-keys
Main Users (Group) Read This key & subs
SYSTEM (Group) Read This key & subs


There were no explicit "denies".

I also happened to look at the key directly above
[HKLM\System\MountedDevice1]. It is of "almost" the same content,
but
interestingly different. It contains 21 "Volume" entries &
DosDevices,
where
as \MountedDevice contains 27 "Volume" entries & DosDevices. The
entries
look
a bit "hodge-podge" for my taste. Does that help?

Oh yes, my "problem" user is just a normal User with no special
permissions,
ie. read only.


Everything appears normal. Does this just happen to one user? Or does
it
happen to all account that have User permissions and restrictions?

--
William Crawford
MS-MVP Windows Shell/User

Hmmm.....It only happens to just this one normal user account, my other
is
with administrator priviledges for installation and housekeeping work.
Really
strange, what? I don't suppose you have any ideas how I could protocol
the
logon sequence?

Create a new normal user account and see what happens. If you have no
problems then copy the old profile to a new profile.

How to copy data from a corrupted user profile to a new profile
http://support.microsoft.com/default.aspx?kbid=811151

I made an additional normal user account (w/o administrator rights) and
had
the same login/logout problem with it too. I got brave and also
temporarily
removed administrator rights from my normal "admin" user and the problem
appeared there too! That means the problem is indeed deeper seated, and
infact affects any and all user accounts, even newly created ones.

I don't suppose you happen to know how to find the file name from the id
given in the chkdsk protocol?

No I do not.

That might be a help to figure out what went
wrong. By the way, the DCOM error I wrote about had to do with
"C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding".

Have you look in the Event Viewer for Errors. This might give better clues.

Control Panel > Administrative Tools > Event Viewer.

In the System Category of the Event Viewer there should some DCOM errors
with a red X. Please write the info and post back.

 

[Guest]

:



:

My normal user account under XP Pro SP2 (which has no
administrator
rights)
is no longer able to login. The login begins in a normal fashion:
preferences
are loaded, there is disk activity for a while, the background
image
is
displayed, but before any icons or toolbar entries appear a
logout
suddenly
occurs. If I try again the logout is immediate. While trying to
diagnose
the
problem I happened to give my normal user account administrator
rights,
which
then strangely allows a normal login. Very spooky. Removing admin
rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was logged
just
before
the problem began. The very next normal start automatically
included
a
chkdsk
run, repairing many problems on my C: drive (file truncations,
orphan
clusters, etc.). Nothing to really worry about. After about a
minute
into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because of an
"incorrect
application configuration".

I've tried everything I can think of to repair the damage. Chkdsk
shows
no
errors, and I also haven't been able to spot any errors with
Regedit.
The
security profiles also appear to be correct when compared with
another
XP
Pro
system. I've browsed here extensively for similar problems and
not
found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back to a
check
point
previous to the problem, but that didn't change the behavior
either.
I'm
sure
I don't have a malware problem, as I have AD-Watch active, use
Spybot
regularly, and have a decent Kaspersky Internet Security package.

It must be something during the login procedure which is directly
affected
by administrator rights, but what? Any ideas? It would probably
be
helpful,
if one could somehow protocol the logon progress to find out what
is
actually
going awry. I really hate to have to leave administrator rights
enabled
for
my normal work, as that's inviting trouble. As an ex-computer
expert, I
must
admit that I've never seen XP have problems of this kind after a
minor
disk
problem. I'd really appreciate any help in the matter.


Could you post back with all the permissions that allow or denied
on
this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I just have
a
hunch
that the permissions may be incorrect.

--
William Crawford
MS-MVP Windows Shell/User

Thanks for the reply WTC. I plowed into regedit and pulled up the
things
you
requested for [HKLM\System\MountedDevices], I hope.

Groups or Usernames Permissions Apply to:

Admin (User) Special Permissions Just this key
Administrators (Group) Full Access/Read This key & subs
Users (Group) Read This key & subs
CREATOR-OWNER (Group) Special Permissions Just sub-keys
Main Users (Group) Read This key & subs
SYSTEM (Group) Read This key & subs


There were no explicit "denies".

I also happened to look at the key directly above
[HKLM\System\MountedDevice1]. It is of "almost" the same content,
but
interestingly different. It contains 21 "Volume" entries &
DosDevices,
where
as \MountedDevice contains 27 "Volume" entries & DosDevices. The
entries
look
a bit "hodge-podge" for my taste. Does that help?

Oh yes, my "problem" user is just a normal User with no special
permissions,
ie. read only.


Everything appears normal. Does this just happen to one user? Or does
it
happen to all account that have User permissions and restrictions?

--
William Crawford
MS-MVP Windows Shell/User

Hmmm.....It only happens to just this one normal user account, my other
is
with administrator priviledges for installation and housekeeping work.
Really
strange, what? I don't suppose you have any ideas how I could protocol
the
logon sequence?


Create a new normal user account and see what happens. If you have no
problems then copy the old profile to a new profile.

How to copy data from a corrupted user profile to a new profile
http://support.microsoft.com/default.aspx?kbid=811151

I made an additional normal user account (w/o administrator rights) and
had
the same login/logout problem with it too. I got brave and also
temporarily
removed administrator rights from my normal "admin" user and the problem
appeared there too! That means the problem is indeed deeper seated, and
infact affects any and all user accounts, even newly created ones.

I don't suppose you happen to know how to find the file name from the id
given in the chkdsk protocol?

No I do not.

That might be a help to figure out what went
wrong. By the way, the DCOM error I wrote about had to do with
"C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding".

Have you look in the Event Viewer for Errors. This might give better clues.

Control Panel > Administrative Tools > Event Viewer.

In the System Category of the Event Viewer there should some DCOM errors
with a red X. Please write the info and post back.

The DCOM error I mentioned was in fact logged in the system event viewer log
you just referred to, twice in a row. Since the incident there have been NO
further DCOM errors, so that must not be a problem? I'll post the major event
log entries from the time in question so you can get a feel for what happened:

15:45:22 System Log>Error>Source:ntfs>Response:55 The file system on the
media is damaged and unusable. Perform chkdsk on volume "C:".
15:53:00 System Log>Info>Source:eventlog>Windows start
15:53:03 Application Log>Info>Source:winlogon>chkdsk repairs many errors on C:
15:53:xx Various services start normally
15:54:10 System Log>Error>SourceCOM>Response:10000 A DCOM Server could not
be started: {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}. Error:
"This application could not be started, because the application
configuration is incorrect. The application should be reinstalled to correct
the problem."
Occurred at the start of command:
C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding
16:03:48 System Log>Info>Source:eventlog>Windows start

I also recently tried to remove the administration rights from my normal
user and put him into the Main User group to see if logins would then
function, but it didn't help either. Looking at the group policies also
brought nothing to light.

In the last few days another problem has appeared: It is almost impossible
to log off my normal user, to shut down, or to restart with normal
procedures. Even the task manager fails to do the job. The only way seems to
be to use task manager to log off the user in a particular menu, which
usually then functions. The appropriate event log entries are also rather
interesting:
20:02:41 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Unknown on DELLDUDE has failed.
20:03:40 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Newstart on DELLDUDE has failed.
20:04:45 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Shutdown on DELLDUDE has failed.

The chkdsk errors originally corrected were also interesting, as they often
related to bungled file attributes. Here are a few representative errors:
- The attribute with the instance id 0x0 and the segment reference 0x......
can not be found. The expected attribute type is 0x80. Damaged attribute
entry (128."") will be deleted from data record segment xxxx.
- The attribute of type 0x80 and the instance id 0x0 in the file 0x.... has
a reserved length of 0x358000 instead of 0x35a000.
- Damaged entry in the attribute list with type code 128 in file .... was
deleted.

I'm sure something in the access rights were somehow snafu'd by the original
ntfs problem. Things are getting a bit desperate now to say the least!

 

[WTC]

--
William Crawford
MS-MVP Windows Shell/User

:



:



:

My normal user account under XP Pro SP2 (which has no
administrator
rights)
is no longer able to login. The login begins in a normal fashion:
preferences
are loaded, there is disk activity for a while, the background
image
is
displayed, but before any icons or toolbar entries appear a
logout
suddenly
occurs. If I try again the logout is immediate. While trying to
diagnose
the
problem I happened to give my normal user account administrator
rights,
which
then strangely allows a normal login. Very spooky. Removing admin
rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was logged
just
before
the problem began. The very next normal start automatically
included
a
chkdsk
run, repairing many problems on my C: drive (file truncations,
orphan
clusters, etc.). Nothing to really worry about. After about a
minute
into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because of an
"incorrect
application configuration".

I've tried everything I can think of to repair the damage. Chkdsk
shows
no
errors, and I also haven't been able to spot any errors with
Regedit.
The
security profiles also appear to be correct when compared with
another
XP
Pro
system. I've browsed here extensively for similar problems and
not
found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back to a
check
point
previous to the problem, but that didn't change the behavior
either.
I'm
sure
I don't have a malware problem, as I have AD-Watch active, use
Spybot
regularly, and have a decent Kaspersky Internet Security package.

It must be something during the login procedure which is directly
affected
by administrator rights, but what? Any ideas? It would probably
be
helpful,
if one could somehow protocol the logon progress to find out what
is
actually
going awry. I really hate to have to leave administrator rights
enabled
for
my normal work, as that's inviting trouble. As an ex-computer
expert, I
must
admit that I've never seen XP have problems of this kind after a
minor
disk
problem. I'd really appreciate any help in the matter.


Could you post back with all the permissions that allow or denied
on
this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I just have
a
hunch
that the permissions may be incorrect.

--
William Crawford
MS-MVP Windows Shell/User

Thanks for the reply WTC. I plowed into regedit and pulled up the
things
you
requested for [HKLM\System\MountedDevices], I hope.

Groups or Usernames Permissions Apply to:

Admin (User) Special Permissions Just this key
Administrators (Group) Full Access/Read This key & subs
Users (Group) Read This key & subs
CREATOR-OWNER (Group) Special Permissions Just sub-keys
Main Users (Group) Read This key & subs
SYSTEM (Group) Read This key & subs


There were no explicit "denies".

I also happened to look at the key directly above
[HKLM\System\MountedDevice1]. It is of "almost" the same content,
but
interestingly different. It contains 21 "Volume" entries &
DosDevices,
where
as \MountedDevice contains 27 "Volume" entries & DosDevices. The
entries
look
a bit "hodge-podge" for my taste. Does that help?

Oh yes, my "problem" user is just a normal User with no special
permissions,
ie. read only.


Everything appears normal. Does this just happen to one user? Or does
it
happen to all account that have User permissions and restrictions?

--
William Crawford
MS-MVP Windows Shell/User

Hmmm.....It only happens to just this one normal user account, my other
is
with administrator priviledges for installation and housekeeping work.
Really
strange, what? I don't suppose you have any ideas how I could protocol
the
logon sequence?


Create a new normal user account and see what happens. If you have no
problems then copy the old profile to a new profile.

How to copy data from a corrupted user profile to a new profile
http://support.microsoft.com/default.aspx?kbid=811151

--
William Crawford
MS-MVP Windows Shell/User

I made an additional normal user account (w/o administrator rights) and
had
the same login/logout problem with it too. I got brave and also
temporarily
removed administrator rights from my normal "admin" user and the problem
appeared there too! That means the problem is indeed deeper seated, and
infact affects any and all user accounts, even newly created ones.

I don't suppose you happen to know how to find the file name from the id
given in the chkdsk protocol?

No I do not.

That might be a help to figure out what went
wrong. By the way, the DCOM error I wrote about had to do with
"C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding".

Have you look in the Event Viewer for Errors. This might give better clues.

Control Panel > Administrative Tools > Event Viewer.

In the System Category of the Event Viewer there should some DCOM errors
with a red X. Please write the info and post back.

The DCOM error I mentioned was in fact logged in the system event viewer log
you just referred to, twice in a row. Since the incident there have been NO
further DCOM errors, so that must not be a problem? I'll post the major event
log entries from the time in question so you can get a feel for what happened:

15:45:22 System Log>Error>Source:ntfs>Response:55 The file system on the
media is damaged and unusable. Perform chkdsk on volume "C:".
15:53:00 System Log>Info>Source:eventlog>Windows start
15:53:03 Application Log>Info>Source:winlogon>chkdsk repairs many errors on C:
15:53:xx Various services start normally
15:54:10 System Log>Error>SourceCOM>Response:10000 A DCOM Server could not
be started: {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}. Error:
"This application could not be started, because the application
configuration is incorrect. The application should be reinstalled to correct
the problem."
Occurred at the start of command:
C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding
16:03:48 System Log>Info>Source:eventlog>Windows start

I also recently tried to remove the administration rights from my normal
user and put him into the Main User group to see if logins would then
function, but it didn't help either. Looking at the group policies also
brought nothing to light.

In the last few days another problem has appeared: It is almost impossible
to log off my normal user, to shut down, or to restart with normal
procedures. Even the task manager fails to do the job. The only way seems to
be to use task manager to log off the user in a particular menu, which
usually then functions. The appropriate event log entries are also rather
interesting:
20:02:41 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Unknown on DELLDUDE has failed.
20:03:40 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Newstart on DELLDUDE has failed.
20:04:45 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Shutdown on DELLDUDE has failed.

The chkdsk errors originally corrected were also interesting, as they often
related to bungled file attributes. Here are a few representative errors:
- The attribute with the instance id 0x0 and the segment reference 0x......
can not be found. The expected attribute type is 0x80. Damaged attribute
entry (128."") will be deleted from data record segment xxxx.
- The attribute of type 0x80 and the instance id 0x0 in the file 0x.... has
a reserved length of 0x358000 instead of 0x35a000.
- Damaged entry in the attribute list with type code 128 in file .... was
deleted.

I'm sure something in the access rights were somehow snafu'd by the original
ntfs problem. Things are getting a bit desperate now to say the least!

I am unsure was is happening, sorry I cannot help you. If you believe this may be a permission issue then maybe read this article.

How To Reset Security Settings Back to the Defaults
http://support.microsoft.com/?kbid=313222

Good Luck

 

[Guest]

--
William Crawford
MS-MVP Windows Shell/User

:



:



:

My normal user account under XP Pro SP2 (which has no
administrator
rights)
is no longer able to login. The login begins in a normal fashion:
preferences
are loaded, there is disk activity for a while, the background
image
is
displayed, but before any icons or toolbar entries appear a
logout
suddenly
occurs. If I try again the logout is immediate. While trying to
diagnose
the
problem I happened to give my normal user account administrator
rights,
which
then strangely allows a normal login. Very spooky. Removing admin
rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was logged
just
before
the problem began. The very next normal start automatically
included
a
chkdsk
run, repairing many problems on my C: drive (file truncations,
orphan
clusters, etc.). Nothing to really worry about. After about a
minute
into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because of an
"incorrect
application configuration".

I've tried everything I can think of to repair the damage. Chkdsk
shows
no
errors, and I also haven't been able to spot any errors with
Regedit.
The
security profiles also appear to be correct when compared with
another
XP
Pro
system. I've browsed here extensively for similar problems and
not
found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back to a
check
point
previous to the problem, but that didn't change the behavior
either.
I'm
sure
I don't have a malware problem, as I have AD-Watch active, use
Spybot
regularly, and have a decent Kaspersky Internet Security package.

It must be something during the login procedure which is directly
affected
by administrator rights, but what? Any ideas? It would probably
be
helpful,
if one could somehow protocol the logon progress to find out what
is
actually
going awry. I really hate to have to leave administrator rights
enabled
for
my normal work, as that's inviting trouble. As an ex-computer
expert, I
must
admit that I've never seen XP have problems of this kind after a
minor
disk
problem. I'd really appreciate any help in the matter.


Could you post back with all the permissions that allow or denied
on
this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I just have
a
hunch
that the permissions may be incorrect.

--
William Crawford
MS-MVP Windows Shell/User

Thanks for the reply WTC. I plowed into regedit and pulled up the
things
you
requested for [HKLM\System\MountedDevices], I hope.

Groups or Usernames Permissions Apply to:

Admin (User) Special Permissions Just this key
Administrators (Group) Full Access/Read This key & subs
Users (Group) Read This key & subs
CREATOR-OWNER (Group) Special Permissions Just sub-keys
Main Users (Group) Read This key & subs
SYSTEM (Group) Read This key & subs


There were no explicit "denies".

I also happened to look at the key directly above
[HKLM\System\MountedDevice1]. It is of "almost" the same content,
but
interestingly different. It contains 21 "Volume" entries &
DosDevices,
where
as \MountedDevice contains 27 "Volume" entries & DosDevices. The
entries
look
a bit "hodge-podge" for my taste. Does that help?

Oh yes, my "problem" user is just a normal User with no special
permissions,
ie. read only.


Everything appears normal. Does this just happen to one user? Or does
it
happen to all account that have User permissions and restrictions?

--
William Crawford
MS-MVP Windows Shell/User

Hmmm.....It only happens to just this one normal user account, my other
is
with administrator priviledges for installation and housekeeping work.
Really
strange, what? I don't suppose you have any ideas how I could protocol
the
logon sequence?


Create a new normal user account and see what happens. If you have no
problems then copy the old profile to a new profile.

How to copy data from a corrupted user profile to a new profile
http://support.microsoft.com/default.aspx?kbid=811151

--
William Crawford
MS-MVP Windows Shell/User

I made an additional normal user account (w/o administrator rights) and
had
the same login/logout problem with it too. I got brave and also
temporarily
removed administrator rights from my normal "admin" user and the problem
appeared there too! That means the problem is indeed deeper seated, and
infact affects any and all user accounts, even newly created ones.

I don't suppose you happen to know how to find the file name from the id
given in the chkdsk protocol?

No I do not.

That might be a help to figure out what went
wrong. By the way, the DCOM error I wrote about had to do with
"C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding".

Have you look in the Event Viewer for Errors. This might give better clues.

Control Panel > Administrative Tools > Event Viewer.

In the System Category of the Event Viewer there should some DCOM errors
with a red X. Please write the info and post back.

The DCOM error I mentioned was in fact logged in the system event viewer log
you just referred to, twice in a row. Since the incident there have been NO
further DCOM errors, so that must not be a problem? I'll post the major event
log entries from the time in question so you can get a feel for what happened:

15:45:22 System Log>Error>Source:ntfs>Response:55 The file system on the
media is damaged and unusable. Perform chkdsk on volume "C:".
15:53:00 System Log>Info>Source:eventlog>Windows start
15:53:03 Application Log>Info>Source:winlogon>chkdsk repairs many errors on C:
15:53:xx Various services start normally
15:54:10 System Log>Error>SourceCOM>Response:10000 A DCOM Server could not
be started: {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}. Error:
"This application could not be started, because the application
configuration is incorrect. The application should be reinstalled to correct
the problem."
Occurred at the start of command:
C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding
16:03:48 System Log>Info>Source:eventlog>Windows start

I also recently tried to remove the administration rights from my normal
user and put him into the Main User group to see if logins would then
function, but it didn't help either. Looking at the group policies also
brought nothing to light.

In the last few days another problem has appeared: It is almost impossible
to log off my normal user, to shut down, or to restart with normal
procedures. Even the task manager fails to do the job. The only way seems to
be to use task manager to log off the user in a particular menu, which
usually then functions. The appropriate event log entries are also rather
interesting:
20:02:41 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Unknown on DELLDUDE has failed.
20:03:40 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Newstart on DELLDUDE has failed.
20:04:45 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Shutdown on DELLDUDE has failed.

The chkdsk errors originally corrected were also interesting, as they often
related to bungled file attributes. Here are a few representative errors:
- The attribute with the instance id 0x0 and the segment reference 0x......
can not be found. The expected attribute type is 0x80. Damaged attribute
entry (128."") will be deleted from data record segment xxxx.
- The attribute of type 0x80 and the instance id 0x0 in the file 0x.... has
a reserved length of 0x358000 instead of 0x35a000.
- Damaged entry in the attribute list with type code 128 in file .... was
deleted.

I'm sure something in the access rights were somehow snafu'd by the original
ntfs problem. Things are getting a bit desperate now to say the least!

I am unsure was is happening, sorry I cannot help you. If you believe this may be a permission issue then maybe read this article.

How To Reset Security Settings Back to the Defaults
http://support.microsoft.com/?kbid=313222

Good Luck

I studied your advice somewhat and finally decided to give it a try after
saving the registry. It solved the login requiring administrator rights
problem! Thanks WTC! I have since had a few problems with access rights at
the file level, but not anything really tragic. Strangely enough I can't seem
to get the detailed file/directory ownership details under the
characteristics window to correct/investigate things. Must be a registry
setting.

 

[WTC]

--
William Crawford
MS-MVP Windows Shell/User

:



:



:



:

message
My normal user account under XP Pro SP2 (which has no
administrator
rights)
is no longer able to login. The login begins in a normal
fashion:
preferences
are loaded, there is disk activity for a while, the
background
image
is
displayed, but before any icons or toolbar entries appear a
logout
suddenly
occurs. If I try again the logout is immediate. While
trying to
diagnose
the
problem I happened to give my normal user account
administrator
rights,
which
then strangely allows a normal login. Very spooky. Removing
admin
rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was
logged
just
before
the problem began. The very next normal start automatically
included
a
chkdsk
run, repairing many problems on my C: drive (file
truncations,
orphan
clusters, etc.). Nothing to really worry about. After about
a
minute
into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because
of an
"incorrect
application configuration".

I've tried everything I can think of to repair the damage.
Chkdsk
shows
no
errors, and I also haven't been able to spot any errors
with
Regedit.
The
security profiles also appear to be correct when compared
with
another
XP
Pro
system. I've browsed here extensively for similar problems
and
not
found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back
to a
check
point
previous to the problem, but that didn't change the
behavior
either.
I'm
sure
I don't have a malware problem, as I have AD-Watch active,
use
Spybot
regularly, and have a decent Kaspersky Internet Security
package.

It must be something during the login procedure which is
directly
affected
by administrator rights, but what? Any ideas? It would
probably
be
helpful,
if one could somehow protocol the logon progress to find
out what
is
actually
going awry. I really hate to have to leave administrator
rights
enabled
for
my normal work, as that's inviting trouble. As an
ex-computer
expert, I
must
admit that I've never seen XP have problems of this kind
after a
minor
disk
problem. I'd really appreciate any help in the matter.


Could you post back with all the permissions that allow or
denied
on
this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I
just have
a
hunch
that the permissions may be incorrect.

--
William Crawford
MS-MVP Windows Shell/User

Thanks for the reply WTC. I plowed into regedit and pulled up
the
things
you
requested for [HKLM\System\MountedDevices], I hope.

Groups or Usernames Permissions Apply to:

Admin (User) Special Permissions Just this key
Administrators (Group) Full Access/Read This key &
subs
Users (Group) Read This key & subs
CREATOR-OWNER (Group) Special Permissions Just sub-keys
Main Users (Group) Read This key & subs
SYSTEM (Group) Read This key & subs


There were no explicit "denies".

I also happened to look at the key directly above
[HKLM\System\MountedDevice1]. It is of "almost" the same
content,
but
interestingly different. It contains 21 "Volume" entries &
DosDevices,
where
as \MountedDevice contains 27 "Volume" entries & DosDevices.
The
entries
look
a bit "hodge-podge" for my taste. Does that help?

Oh yes, my "problem" user is just a normal User with no
special
permissions,
ie. read only.


Everything appears normal. Does this just happen to one user? Or
does
it
happen to all account that have User permissions and
restrictions?

--
William Crawford
MS-MVP Windows Shell/User

Hmmm.....It only happens to just this one normal user account, my
other
is
with administrator priviledges for installation and housekeeping
work.
Really
strange, what? I don't suppose you have any ideas how I could
protocol
the
logon sequence?


Create a new normal user account and see what happens. If you have
no
problems then copy the old profile to a new profile.

How to copy data from a corrupted user profile to a new profile
http://support.microsoft.com/default.aspx?kbid=811151

--
William Crawford
MS-MVP Windows Shell/User

I made an additional normal user account (w/o administrator rights)
and
had
the same login/logout problem with it too. I got brave and also
temporarily
removed administrator rights from my normal "admin" user and the
problem
appeared there too! That means the problem is indeed deeper seated,
and
infact affects any and all user accounts, even newly created ones.

I don't suppose you happen to know how to find the file name from
the id
given in the chkdsk protocol?

No I do not.

That might be a help to figure out what went
wrong. By the way, the DCOM error I wrote about had to do with
"C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding".

Have you look in the Event Viewer for Errors. This might give better
clues.

Control Panel > Administrative Tools > Event Viewer.

In the System Category of the Event Viewer there should some DCOM
errors
with a red X. Please write the info and post back.

--
William Crawford
MS-MVP Windows Shell/User

The DCOM error I mentioned was in fact logged in the system event
viewer log
you just referred to, twice in a row. Since the incident there have
been NO
further DCOM errors, so that must not be a problem? I'll post the major
event
log entries from the time in question so you can get a feel for what
happened:

15:45:22 System Log>Error>Source:ntfs>Response:55 The file system on
the
media is damaged and unusable. Perform chkdsk on volume "C:".
15:53:00 System Log>Info>Source:eventlog>Windows start
15:53:03 Application Log>Info>Source:winlogon>chkdsk repairs many
errors on C:
15:53:xx Various services start normally
15:54:10 System Log>Error>SourceCOM>Response:10000 A DCOM Server
could not
be started: {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}. Error:
"This application could not be started, because the application
configuration is incorrect. The application should be reinstalled to
correct
the problem."
Occurred at the start of command:
C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding
16:03:48 System Log>Info>Source:eventlog>Windows start

I also recently tried to remove the administration rights from my
normal
user and put him into the Main User group to see if logins would then
function, but it didn't help either. Looking at the group policies also
brought nothing to light.

In the last few days another problem has appeared: It is almost
impossible
to log off my normal user, to shut down, or to restart with normal
procedures. Even the task manager fails to do the job. The only way
seems to
be to use task manager to log off the user in a particular menu, which
usually then functions. The appropriate event log entries are also
rather
interesting:
20:02:41 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Unknown on DELLDUDE has failed.
20:03:40 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Newstart on DELLDUDE has failed.
20:04:45 System Log>Warning>Source:USER32>Response:1073 The attempt, to
execute Shutdown on DELLDUDE has failed.

The chkdsk errors originally corrected were also interesting, as they
often
related to bungled file attributes. Here are a few representative
errors:
- The attribute with the instance id 0x0 and the segment reference
0x......
can not be found. The expected attribute type is 0x80. Damaged
attribute
entry (128."") will be deleted from data record segment xxxx.
- The attribute of type 0x80 and the instance id 0x0 in the file 0x....
has
a reserved length of 0x358000 instead of 0x35a000.
- Damaged entry in the attribute list with type code 128 in file ....
was
deleted.

I'm sure something in the access rights were somehow snafu'd by the
original
ntfs problem. Things are getting a bit desperate now to say the least!

I am unsure was is happening, sorry I cannot help you. If you believe
this may be a permission issue then maybe read this article.

How To Reset Security Settings Back to the Defaults
http://support.microsoft.com/?kbid=313222

Good Luck

I studied your advice somewhat and finally decided to give it a try after
saving the registry. It solved the login requiring administrator rights
problem! Thanks WTC!

You're welcome.

I have since had a few problems with access rights at
the file level, but not anything really tragic. Strangely enough I can't
seem
to get the detailed file/directory ownership details under the
characteristics window to correct/investigate things. Must be a registry
setting.

Folder Options > View tab > Uncheck "Use simple file sharing".

 

[Guest]

I am even more screwed. none of my users (all with administrator rights) can
get through the cycle. not even in safe mode. password is accepted but
immediately logs out.

--
William Crawford
MS-MVP Windows Shell/User


:



:



:



:

message
My normal user account under XP Pro SP2 (which has no
administrator
rights)
is no longer able to login. The login begins in a normal
fashion:
preferences
are loaded, there is disk activity for a while, the
background
image
is
displayed, but before any icons or toolbar entries appear a
logout
suddenly
occurs. If I try again the logout is immediate. While
trying to
diagnose
the
problem I happened to give my normal user account
administrator
rights,
which
then strangely allows a normal login. Very spooky. Removing
admin
rights
brings the problem back again.

Judging from the system logs, evidently an NTFS error was
logged
just
before
the problem began. The very next normal start automatically
included
a
chkdsk
run, repairing many problems on my C: drive (file
truncations,
orphan
clusters, etc.). Nothing to really worry about. After about
a
minute
into
the
actual start a single DCOM server error
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} was logged because
of an
"incorrect
application configuration".

I've tried everything I can think of to repair the damage.
Chkdsk
shows
no
errors, and I also haven't been able to spot any errors
with
Regedit.
The
security profiles also appear to be correct when compared
with
another
XP
Pro
system. I've browsed here extensively for similar problems
and
not
found
anything applicable. I don't have the typical userinit /
wsaupdaterregistry
problem with the registry winlogon entry. I also went back
to a
check
point
previous to the problem, but that didn't change the
behavior
either.
I'm
sure
I don't have a malware problem, as I have AD-Watch active,
use
Spybot
regularly, and have a decent Kaspersky Internet Security
package.

It must be something during the login procedure which is
directly
affected
by administrator rights, but what? Any ideas? It would
probably
be
helpful,
if one could somehow protocol the logon progress to find
out what
is
actually
going awry. I really hate to have to leave administrator
rights
enabled
for
my normal work, as that's inviting trouble. As an
ex-computer
expert, I
must
admit that I've never seen XP have problems of this kind
after a
minor
disk
problem. I'd really appreciate any help in the matter.


Could you post back with all the permissions that allow or
denied
on
this
key in the registry?

[HKLM\System\MountedDevices]

Right click on MountedDevices and select "Permissions". I
just have
a
hunch
that the permissions may be incorrect.

--
William Crawford
MS-MVP Windows Shell/User

Thanks for the reply WTC. I plowed into regedit and pulled up
the
things
you
requested for [HKLM\System\MountedDevices], I hope.

Groups or Usernames Permissions Apply to:

Admin (User) Special Permissions Just this key
Administrators (Group) Full Access/Read This key &
subs
Users (Group) Read This key & subs
CREATOR-OWNER (Group) Special Permissions Just sub-keys
Main Users (Group) Read This key & subs
SYSTEM (Group) Read This key & subs


There were no explicit "denies".

I also happened to look at the key directly above
[HKLM\System\MountedDevice1]. It is of "almost" the same
content,
but
interestingly different. It contains 21 "Volume" entries &
DosDevices,
where
as \MountedDevice contains 27 "Volume" entries & DosDevices.
The
entries
look
a bit "hodge-podge" for my taste. Does that help?

Oh yes, my "problem" user is just a normal User with no
special
permissions,
ie. read only.


Everything appears normal. Does this just happen to one user? Or
does
it
happen to all account that have User permissions and
restrictions?

--
William Crawford
MS-MVP Windows Shell/User

Hmmm.....It only happens to just this one normal user account, my
other
is
with administrator priviledges for installation and housekeeping
work.
Really
strange, what? I don't suppose you have any ideas how I could
protocol
the
logon sequence?


Create a new normal user account and see what happens. If you have
no
problems then copy the old profile to a new profile.

How to copy data from a corrupted user profile to a new profile
http://support.microsoft.com/default.aspx?kbid=811151

--
William Crawford
MS-MVP Windows Shell/User

I made an additional normal user account (w/o administrator rights)
and
had
the same login/logout problem with it too. I got brave and also
temporarily
removed administrator rights from my normal "admin" user and the
problem
appeared there too! That means the problem is indeed deeper seated,
and
infact affects any and all user accounts, even newly created ones.

I don't suppose you happen to know how to find the file name from
the id
given in the chkdsk protocol?

No I do not.

That might be a help to figure out what went
wrong. By the way, the DCOM error I wrote about had to do with
"C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding".

Have you look in the Event Viewer for Errors. This might give better
clues.

Control Panel > Administrative Tools > Event Viewer.

In the System Category of the Event Viewer there should some DCOM
errors
with a red X. Please write the info and post back.

--
William Crawford
MS-MVP Windows Shell/User

The DCOM error I mentioned was in fact logged in the system event
viewer log
you just referred to, twice in a row. Since the incident there have
been NO
further DCOM errors, so that must not be a problem? I'll post the major
event
log entries from the time in question so you can get a feel for what
happened:

15:45:22 System Log>Error>Source:ntfs>Response:55 The file system on
the
media is damaged and unusable. Perform chkdsk on volume "C:".
15:53:00 System Log>Info>Source:eventlog>Windows start
15:53:03 Application Log>Info>Source:winlogon>chkdsk repairs many
errors on C:
15:53:xx Various services start normally
15:54:10 System Log>Error>SourceCOM>Response:10000 A DCOM Server
could not
be started: {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}. Error:
"This application could not be started, because the application
configuration is incorrect. The application should be reinstalled to
correct
the problem."
Occurred at the start of command:
C:\WINDOWS\System32\wbem\wmiprvse.exe -Embedding
16:03:48 System Log>Info>Source:eventlog>Windows start

I also recently tried to remove the administration rights from my
normal
user and put him into the Main User group to see if logins would then
function, but it didn't help either. Looking at the group policies also

 

[Pegasus]

I am even more screwed. none of my users (all with administrator rights)
can
get through the cycle. not even in safe mode. password is accepted but
immediately logs out.

Instead of piggy-backing onto an old and stale thread, try
to describe your own situation in details, e.g. by stating
- Does this happen on one machine or on many?
- What is the recent history of the machine?
- Is the machine is networked?
- Can you log on under your own account?