0
I have a remote machine that runs on Windows 7, it gets logoff by closing all running application and the gets logged in again automatically. It happens every day but not on specific time and without specific task.
After reviewing Event logs as shown above in image, i found few Events with Id 7001 & 7002 with task category 1101 and 1102 respectively.
I use Windows 7. We are suffering from this problem with other 3 machines having same configuration.
To resolve this, I searched on internet and applied the solution regarding customer experience which is mentioned in the link below:
User Logoff Notification for Customer Experience Improvement Program
Can anyone help me to track this issue ?? Am i on right direction to resolve this problem?
EDIT.
After suggestion given by @TwistyImpersonator, i can say following things from detailed Event viewer (Image are attached at the end):
In System events:
following events always occurred AFTER 'Winlog' events:
Service Control Manager-7036-None-The Shell Hardware Detection service entered the stopped state.
And in Application event, following events occurred around the same time frame
Warning-09.11.2017 18:19:29-User-Profile Service-1530-None-Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-1277090162-4221482773-868009429-3552: Process 272 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1277090162-4221482773-868009429-3552\Printers\DevModePerUser
Information-09.11.2017 18:19:29-Desktop Window Manager-9009-None-The Desktop Window Manager has exited with code (0x40010004)
Please include the details of the relevant events you've mentioned. What software is running on the machine that logs it back in automatically? Windows can't do that without 3rd party software. – I say Reinstate Monica – 2017-11-13T15:33:29.350
No 3rd party software is installed. Logs are viewed through Admin tools of Windows. I attach screenshot of log viewer. – Bunty – 2017-11-13T16:13:13.840
Is event ID 1074 logged in the System log when these logoffs occur? What is the text of that event? – I say Reinstate Monica – 2017-11-13T17:24:01.143
"it gets logoff by closing all running application" - does that mean you suspect that there is some unwanted sofware initiating the logoff when all running desktop applications are closed? – Harry – 2017-11-13T19:37:31.090
@TwistyImpersonator Event 1074 found around 'Winlogon Event 7001' only when user initiate manual restart. Otherwise no Event 1074 found! – Bunty – 2017-11-14T10:11:22.243
@Harry Sorry for my structure of English sentence, i don't suspect about any unwanted software. I mean to say is: " It (Windows) closes all running applications and then logs off, then auto logon and still remote connection is alive" Remote connection is alive means : no need to establish the connection, desktop of remote machine can be seen after (auto) logoff and logon. – Bunty – 2017-11-14T10:16:12.583
I don't think it's actually logging off the account. It might be that the Explorer shell is crashing or being restarted. – I say Reinstate Monica – 2017-11-14T12:20:38.483
@TwistyImpersonator To solve the solution, i can consider this as one of the possibility. If it is so, how can i detect and prevent the Explorer crash? It happens with ALL 3 remote machine in our network. By the way, there are no logs of system restart. – Bunty – 2017-11-14T13:13:13.153
I'm not suggesting the system is restarting, only Windows Explorer. Start by filtering the System and Application event log to show only warning and error events. Is anything interesting logged around the time the problem occurs? – I say Reinstate Monica – 2017-11-14T13:39:23.033
@TwistyImpersonator I ahve studied the Application and System logs around the time frame of 'Winlogon' and drew a conclusion. I have a edit the question. Please look at it. – Bunty – 2017-11-14T15:36:52.457
@TwistyImpersonator I have added a link to screenshots that compares system and application events near the time of winlogon – Bunty – 2017-11-14T16:06:16.223
@Bunty, does this reflect your problem and did you try apply the steps 1-8? https://social.technet.microsoft.com/Forums/office/en-US/0439e00b-f44a-40ac-999c-e574cb575ba9/user-logoff-notification-for-customer-experience-improvement-program?forum=w7itprogeneral
– Harry – 2017-11-14T20:24:37.563@Harry that was first solution i adopted (and i mentioned with link in question as well) but didn't work. So,currently i am approaching the way suggested by 'TwistyImpersonator', this might be Explorer shell crashing problem. – Bunty – 2017-11-15T09:31:57.037
Hm everything is possible but explorer crashing would not log off nor would it close other applications. did you disable the scheduled tasks described here? Eventually better turn on scheduled task history as well so you see what if there was a scheduled task executed at the time of interest. Disable CEIP tasks: https://www.askvg.com/how-to-disallow-secret-customer-experience-improvement-program-collecting-information-in-windows-7/
– Harry – 2017-11-15T09:37:16.427@TwistyImpersonator Today in the mornning i saw login screen of remote machine. I put it running yesterday night with some applications. Today, after login i did not any application open. It looks like it is not Explorer crash problem but log off issue. Because Explorer crash won't logoff system. Any idea how can i proceed? – Bunty – 2017-11-17T08:36:02.397
@Harry You are right. It seems not an Explorer crash problem, but log off issue. Yesterday i did the setting what you mentioned in link from your last post. Even though, today morning i see system was on login screen asking for password, after login there were no application open. How to proceed? I feel like i am lost.
– Bunty – 2017-11-17T08:39:19.480i'll come up with something for you. did you meanwhile enable the history for the windows scheduled tasks? – Harry – 2017-11-17T19:04:51.780
i am trying to write an answer, meanwhile please try disabling CEIP by using GPO and all other methods described here: https://www.ghacks.net/2016/10/26/turn-off-the-windows-customer-experience-program/
– Harry – 2017-11-17T19:23:40.850