Hello,
I’m getting the following issue at an issue where explorer.exe is hanging at log off for users on a Citrix 6.5 farm. It's also happening for RDP users.
Issue
When a user logs off, very intermittently (but regular enough to be a problem, and seems to be getting more frequent) the receiver window doesn’t close – it’s just a black screen, and hangs for 10-15 minutes.
When you look in task manager on the server the user has just logged off from it, explorer.exe is the only process running for that user. If you try and end task, it doesn’t kill it. You can close the receiver window…but the explorer.exe process will stay open.
This was happening before we deployed any printers.
You see the following logged in the event log:
Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 23/08/2012 10:15:55
Event ID: 1530
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: xenapp.domain.local
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
18 user registry handles leaked from \Registry\User\S-1-5-21-636380745-1033377849-1849977318-2376:
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Microsoft\Windows NT\CurrentVersion
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Microsoft\Windows\Shell
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Policies
Process 9084 (\Device\HarddiskVolume1\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-636380745-1033377849-1849977318-2376\Software\Policies
What I’ve tried
At the same time as this happening, I was getting
{Delayed Write Failed} Windows was unable to save all the data for the file \\fileserver\UserData$\xenapp20\AppData\Roaming\Microsoft\Windows\Cookies\index.dat; the data has been lost. This error may be caused by network connectivity issues. Please try to save this file elsewhere.
I applied the latest hotfixes for file services, and that error has gone, but the explorer.exe process still hangs...
User profiles aren't being deleted at logoff, with an error saying it can't be deleted as the directory is not empty, so each time the user logs on, it has C:\Users\User.000
C:\Users\User.001
etc as the profile path
Looking into the profiles, it seems to be index.dat files that are locked.
I've set:
Do not forcefully unload the users registry at user logoff: Disabled
Delete cached copies of roaming profiles: Enabled
I've tried setting a logoff script for tsdiscon.exe %sessionname% (and I think this has got rid of the RDP users experiencing it)
All data folders that can be redirected, are redirected, and are not made available offline.
Any help would be appreciated.