1
2
Need help. Problem appeared when I tried to log in to my OS today, before this problem has never been. I entered password, logged in and several seconds after immediatly logged out. OS is Windows Server 2012. The whole day I'm trying to solve this, but all of my attempts are failed. I looked to regedit and all of the values such as Shell, UIHost, Userinit have right values.
Shell: explorer.exe
UIHost: logonui.exe
Userinit: C:\Windows\System32\userinit.exe
Moreover, I guessed that it could be that userinit is binded to malware executable and It somehow logs off PC. I used MalwareBytes, but nothing was found. In safe mode everything is all right: I enter password and log in and then nothing send me back. What could be wrong?
DmitryMikhaylenko
Posted 2014-03-13T14:30:15.040
Reputation: 11
Same problem on a fresh (!) Win2012 R2 Server install. Nothing installed yet. It’s been joined to a domain. The local admin can log in, and two out of four domain users I tried. The other two log immediately off after logging in. Event log shows it’s “user-initiated”. – mirabilos – 2014-11-13T16:24:44.490
I've just reinstalled my system. Unfortunatly, nothing helped me. Try to look for something suspicious via win log system. – DmitryMikhaylenko – 2014-11-13T22:01:09.570
1If safe mode is working, it's probably some program in your startup. Run
msconfigand try disabling things. – allquixotic – 2014-03-13T14:33:47.763I just tried it. Nothing new happened. – DmitryMikhaylenko – 2014-03-13T14:34:56.863
You tried what with MSconfig exactly? Did you disable all non-MS services and 3rd party start-ups? If you create a new user, can you log in (normal mode) with it? – Ƭᴇcʜιᴇ007 – 2014-03-13T14:45:30.943
I created new User and added to Administrators Group, disabled all in start up. After logging through new created user I've got the same as with Administrator user. – DmitryMikhaylenko – 2014-03-13T15:08:49.980
anything in the eventlog that stands out? – Keltari – 2014-03-13T15:45:30.617
Right now looking for something significant information. There is events as Winlogon : Logoff notification for Customer Expierence Improvement Program.Nothing more Informative. – DmitryMikhaylenko – 2014-03-13T16:15:57.657
More Detailes: A few days ago I've installed Apache Server on Windows Server 2012 and mod_wsgi. Web app use django, so I chose This Tools. Apache is Listening 8079 port IIS 80, but main domain is bound to IIS. Could it be a problem somewhere here? But when I disabled Apache nothing new happened, so It seems that problem is not in that area. – DmitryMikhaylenko – 2014-03-13T16:19:31.777