Jump to content


Photo

Can't terminate a process - user session is now locked and cant log on

Started by Alan Evans , 17 February 2017 - 12:02 PM
8 replies to this topic

Alan Evans Members

Alan Evans
  • 188 posts

Posted 17 February 2017 - 12:02 PM

Strange issue here, we have a application that occasionally will hang and lock up. the process (lets call it Application.exe) will just remain in task manager linked to the user. When we log the user off, their session (in director & quser) will close and vanish normally, but this Appliaction.exe will still persist and cant be closed down or terminated

 

As a result, when the user tries to log back on to Citrix, the system points them back to that session, and they just get a blank screen. The only solution we have is to wait until the Citrix worker reboots over night which is the only way this process dies.

 

We have tried :-

taskkill

taskkill /f

processexplorer

task manager

Nothing can remove this process.

 

If we disable logons to the worker, Citrix still tries to resume the old session on the disabled server.

 

The application vendor is investigating, but has anyone got any ideas on how we can kill this process, or fool citrix into thinking it doesn't exist any more so a new session is created when the user tries to logon again. We do need to keep our session resilience tho, as some users roam around between network points or switch devices and expect their existing session to be pulled over rather than start a new one.

 

Xenapp 7.7 running on Server 2008 R2



Carl Stalhood CTP Member

Carl Stalhood
  • 11,139 posts

Posted 17 February 2017 - 12:31 PM

What patches on 2008 R2? Is the Convenience Rollup installed?



Alan Evans Members

Alan Evans
  • 188 posts

Posted 17 February 2017 - 12:59 PM

Hi Carl,

 

The following were installed as part of the initial build image last year, since then we perform a full (manual) windows update on the box on a frequent schedule. We are currently up to date as of February 2017.
 
Windows6.1-KB917607-x64.msu
Windows6.1-KB2465772-x64.msu
Windows6.1-KB2732673-v4-x64.msu
Windows6.1-KB2778831-x64.msu
Windows6.1-KB2896256-x64.msu
Windows6.1-KB2904034-x64.msu
AMD64-all-windows6.1-kb2775511-v2-x6
Windows6.1-KB2728738-v3-x64.msu


Carl Stalhood CTP Member

Carl Stalhood
  • 11,139 posts

Posted 17 February 2017 - 02:18 PM

Try installing https://support.microsoft.com/en-us/help/3125574/convenience-rollup-update-for-windows-7-sp1-and-windows-server-2008-r2-sp1



Alan Evans Members

Alan Evans
  • 188 posts

Posted 17 February 2017 - 02:30 PM

Just found this post - which has worked, and lets the user log back in (it triggers a new session rather than resume the locked up one)

 

http://www.jgspiers.com/user-stuck-citrix-desktop-force-log-off

 

However we still have the core problem where a process locks and can't be killed. I'll take a look at that Carl but I expect it will just be what we already have installed via the normal windows update process.

 

Cheers



Aaron Silber Members

Aaron Silber
  • 5 posts

Posted 17 February 2017 - 04:05 PM

Hi Alan,

 

Have you tried adding the application.exe into the registry value LogoffCheckSysModules, see https://support.citrix.com/article/CTX891671 for more info on this. Also you can add in the HKCU entry AutoEndTasks (https://technet.microsoft.com/en-us/library/cc978604.aspx) to help windows close down these running processes.

 

Aaron



Raul Gonzalez Members

Raul Gonzalez
  • 547 posts

Posted 17 February 2017 - 04:12 PM

I have seen this happen because of a bug in either Symantec Endpoint Protection or AppSense Performance Manager.

 

You have any management software running in the background?

 

This is a bit of a stretch but... do you have tons of potential users accessing your environment?  I would also turn off Resultant Set of Policy Logging.   It is a very useful diagnostic tool but the aggravation isn't worth it if you allow thousands of potential users like in an academic environment.  It causes Windows' WMI repository to grow to enormous sizes causing weird instabilities when it reaches it critical point.  

 

You can check C:\Windows\System32\wbem\Repository   and see if it is gigabytes in size or something similar which means it may be unstable.  After the policy is disabled, run "winmgmt /resetrepository" to get a fresh small copy.  Might need to run it a couple of times to make the command to cooperate.  WMI repository is normally about maybe 300MB give or take.



Alan Evans Members

Alan Evans
  • 188 posts

Posted 19 February 2017 - 09:12 AM

Hi Alan,

 

Have you tried adding the application.exe into the registry value LogoffCheckSysModules, see https://support.citrix.com/article/CTX891671 for more info on this. Also you can add in the HKCU entry AutoEndTasks (https://technet.microsoft.com/en-us/library/cc978604.aspx) to help windows close down these running processes.

 

Aaron

 

Hi,

 

Thanks for the post, but that wouldn't really help at all.

 

1) User clicks on the icon for Application.exe

2) Citrix starts the session

3) Citrix notices there are no processes left (as this has been added to "LogoffCheckSysModules"

4) Citrix closes down the session

 

Regards



Alan Evans Members

Alan Evans
  • 188 posts

Posted 19 February 2017 - 09:15 AM

I have seen this happen because of a bug in either Symantec Endpoint Protection or AppSense Performance Manager.

 

You have any management software running in the background?

 

This is a bit of a stretch but... do you have tons of potential users accessing your environment?  I would also turn off Resultant Set of Policy Logging.   It is a very useful diagnostic tool but the aggravation isn't worth it if you allow thousands of potential users like in an academic environment.  It causes Windows' WMI repository to grow to enormous sizes causing weird instabilities when it reaches it critical point.  

 

You can check C:\Windows\System32\wbem\Repository   and see if it is gigabytes in size or something similar which means it may be unstable.  After the policy is disabled, run "winmgmt /resetrepository" to get a fresh small copy.  Might need to run it a couple of times to make the command to cooperate.  WMI repository is normally about maybe 300MB give or take.

 

Thanks,

 

Already turned off RSOP as part of our build once the image has gone through testing. The application only has a handful of users who access it - but I'll be looking to add some exceptions to SEP and see if this helps.

 

I'm more of the opinion this is just down to poor application design, rather than a Microsoft or Citrix issue, as no other apps we publish do this, and this process only appears to lock the session once the application itself has crashed (there are errors in the event log about this)