Our uses randomly get a solid blue screen (desktop background colored blue, not BSOD) when logging into our 2008 Terminal Server. There is no TaskBar, no desktop icons, CTRL+ALT+Delete doesn't work, and no mouse events occur. The only way to end the session is to restart their terminal, or for someone to login as an admin and end their session.
I have discovered that logging in as an admin and ending the process net.exe that is running under that user's profile will end the blue screen and load the users session.
What is net.exe, and why is it randomly giving my users a solid blue screen when they login?
Here's what I know:
- Server is Windows Server 2008
- Server is a virtual server
- Disabled our group policy on our test account and the same thing still happens
- Happens about 1 in every 4 logins
- Nothing out of ordinary gets logged in the event viewer
Net.exe is the program used to map drives, mess with users, and do other network related tasks. It's usually run in logon scripts to map drives. Check your login scripts on the server that are run through startup, logon registry key, user logon script in AD, and local and domain group policies. You'll likely find something in there that's running amock at logon.
If that yields nothing, use autoruns to see what else is running at logon that may be causing issues. It would probably be benficial to disable everything not Microsoft in the logon tab and only reenable necessary processes 1by1 until you find the issue.