winlogon.exe consumes 50% CPU after XP Pro SP3 update

[Thee Chicago Wolf]

Yes, I was planning to slipstream an SP3 disk once I got to that point. I

haven't reinstalled XP yet. I thought I would do a bit more experimentation.

I've tried booting without loading any of the startup programs, thinking
that maybe the culprit might be there. It starts up fine, but then
winlogon.exe either gives an error message or goes into the 50% CPU loop
within 15 minutes of boot up. Wierd! And each time I have to crash the system
to shut it down. And no unusual red flags in the event log either.

I'll try to start up with only the basic stuff and see what happens.

For kicks and giggles, go to Event viewer, right click all the items
listed and choose clear all events, don't save. Clear everything. Try
doing your experiment where you've been seeing winlogon.exe eventually
kick in and hog CPU cycles. Note the time and see if ANYTHING shows
up. Something has got to show up.

- Thee Chicago Wolf

 

[Dale Chamberlain]

After doing a boot with the startup items disabled, I did a diagnostic
startup and winlogon did not misbehave. So perhaps it is device or driver
related?

I went back to booting normally, except with the startup items disabled and
watched the event log. No red flagged items appeared, but the last log entry
that appearred was for the CI service:

Event Type: Information
Event Source: Ci
Event Category: CI Service
Event ID: 4103
Date: 9/11/2008
Time: 10:58:24 AM
User: N/A
Computer: DESKTOP
Description:
Master merge has completed on c:\system volume information\catalog.wci.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

3 minutes, 52 seconds later winlogon.exe went into the 50% CPU load loop.

Dale

 

[Thee Chicago Wolf]

After doing a boot with the startup items disabled, I did a diagnostic

startup and winlogon did not misbehave. So perhaps it is device or driver
related?

If it is, it's not that hard to determine what's in need of updating.

I went back to booting normally, except with the startup items disabled and
watched the event log. No red flagged items appeared, but the last log entry
that appearred was for the CI service:

Event Type: Information
Event Source: Ci
Event Category: CI Service
Event ID: 4103
Date: 9/11/2008
Time: 10:58:24 AM
User: N/A
Computer: DESKTOP
Description:
Master merge has completed on c:\system volume information\catalog.wci.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

3 minutes, 52 seconds later winlogon.exe went into the 50% CPU load loop.

Dale

Hm, that is a bit of info. Only one entry for it on EventID.net:
http://www.eventid.net/display.asp?eventid=4103&eventno=844&source=Ci&phase=1

From what few references I can see, this is *supposed* to be Windows
2000 related. Was this by chance a machine that was Windows 2000 but
upgraded via XP Upgrade? Is this computer running IIS by chance? Did
you turn off Indexing Service (Control Panel > Administrative Tools >
Services > Indexing Service)? While you have the services open, check
and see if IIS service is running.

- Thee Chicago Wolf

 

[Dale Chamberlain]

No, this system was never a W2K system, and I have never used IIS on this
machine. Based on your recommendation, I went into Services and disabled the
indexing service. It seemed to improve the performance of the system, but it
didn't stop the winlogon.exe problem.

I didn't see IIS running either.

Nothing I've done so far seems to have affected the winlogon.exe problem.
I've check to make sure all the drivers were current. I've looked for
patterns and trigger points, but can't find anything that is consistent.

I'm starting to build the SP3 slipstream disk to prepare for a reload of
Windows.

 

[Thee Chicago Wolf]

No, this system was never a W2K system, and I have never used IIS on this

machine. Based on your recommendation, I went into Services and disabled the
indexing service. It seemed to improve the performance of the system, but it
didn't stop the winlogon.exe problem.

Yes, as I expected but it was worth a shot.

I didn't see IIS running either.

Well, if you want to try and play around with some other services to
see if anything else might help the winlogon.exe, you could always
jump over to http://www.blackviper.com/WinXP/servicecfg.htm and check
out some of his recommendations of services that could be disabled to
either free up system resources. In experimentation, you may wind up
discovering something else that is contributing to the winlogon.exe
gremlin.

Nothing I've done so far seems to have affected the winlogon.exe problem.
I've check to make sure all the drivers were current. I've looked for
patterns and trigger points, but can't find anything that is consistent.

I'm starting to build the SP3 slipstream disk to prepare for a reload of
Windows.

There was an updated version of nlite released a few days ago. Just an
FYI.

- Thee Chicago Wolf

 

[Dale Chamberlain]

I created the SP3 slipstream disk, which was much easier using nlite. Thanks
for the recommendation!

I've installed XP SP3 fresh on my machine and all is running fine now.