Sysinternals Homepage
Forum Home Forum Home > Sysinternals Utilities > Miscellaneous Utilities
  New Posts New Posts RSS Feed: Desktops stopped working on Windows 7
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

Desktops stopped working on Windows 7
 Post Reply Post Reply Page  <1234 5>
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
thedailycommute View Drop Down
Newbie
Newbie
Avatar

Joined: 02 June 2009
Online Status: Offline
Posts: 18 		Post Options Post Options   Quote thedailycommute Quote  Post ReplyReply Direct Link To This Post Topic: Desktops stopped working on Windows 7
    Posted: 11 July 2009 at 1:49am
Finally!!!

Took me a little more than 15h to come back but I finally figured out what's causing desktops to switch back: schedhlp.exe! This is part of the Acronis TrueImage (Home) software (I have Acronis Home v10 on my machine) and, from what I can gather, it's used by the scheduling service, registering logons/logoffs.

What I don't understand is why it suddenly began to cause problems. I've had this version of Acronis TrueImage installed on my machine for almost 2 years and never had a problem until the last set of updates were installed.

This page gives an overview of the principal services operated by Acronis. The info is from 2004 and refers to v7 (I use v10) but it appears to still be relevant.

And now, any ideas on how to fix the problem? With windbg running and the breakpoint set, desktops works exactly as before. But I don't relish the idea of having to run windbg, attach to the process and set a breakpoint every time I want to use desktops :-)

Thanks for all the advice!

John
Back to Top
thedailycommute View Drop Down
Newbie
Newbie
Avatar

Joined: 02 June 2009
Online Status: Offline
Posts: 18 		Post Options Post Options   Quote thedailycommute Quote  Post ReplyReply Direct Link To This Post Posted: 09 July 2009 at 9:20am
So, have you had a chance to eliminate common processes such as explorer.exe?

No, not yet - I did check explorer.exe (that was one of the first processes I tried) but the problem continued. I also decided I needed to be more methodical - instead of just randomly selecting likely candidate processes I intend to go back to safe mode, make a list of all running processes, reboot normally and remove those items from a list of currently running processes.

I know that's no guarantee that the "offending" process (or processes) will not be among the processes running in safe mode, but it will help reduce the initial list (and help me avoid attaching to something that's better left alone :-)

Of course these tests will have to be performed at home, and since I can't reboot into safe mode via LogMeIn (well I could probably tinker with the boot options so it did, but then I'd lose access to the machine until I got home :-) I'll have to wait a few hours before posting more.

Watch this space (in about 15h :-)
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 09 July 2009 at 3:03am
So, have you had a chance to eliminate common processes such as explorer.exe?
Daily affirmation:
net helpmsg 4006
Back to Top
thedailycommute View Drop Down
Newbie
Newbie
Avatar

Joined: 02 June 2009
Online Status: Offline
Posts: 18 		Post Options Post Options   Quote thedailycommute Quote  Post ReplyReply Direct Link To This Post Posted: 09 July 2009 at 1:21am
I think I'll leave debugging csrss and winlogon until I really need them :-)

I did just discover an interesting fact - if I boot into safe mode desktops works just fine! (Curiously so does another piece of s/w I have, a 3D pool simulation, but when booting normally it gives an invalid pixel format error - something to do with DX. Odd - and annoying ! :-)

Going back to desktops, "all" I need to do now is figure out which app (or service or ...) is causing the problem and stop it! But that'll have to wait until tomorrow since it's already getting on for 1.30am Sleepy.

Many thanks for the suggestions!

John
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 08 July 2009 at 7:11pm
debugger.chm includes specific sections for dealing with debugging csrss and winlogon; each section states something akin to:
The easiest way to debug WinLogon is to use NTSD and control it from the kernel debugger.

...
Daily affirmation:
net helpmsg 4006
Back to Top
thedailycommute View Drop Down
Newbie
Newbie
Avatar

Joined: 02 June 2009
Online Status: Offline
Posts: 18 		Post Options Post Options   Quote thedailycommute Quote  Post ReplyReply Direct Link To This Post Posted: 08 July 2009 at 6:51pm
Did you explicitly detach from the csrss process, or simply exit the debugger?  If the latter, the process will be terminated, and in the case of csrss you will experience a bugcheck as a result of that critical system process termination.

No, I used ctrl-break to stop debugging and shift-f5 to detach. WinDbg detached fine (apparently - as usual all open windows - command, calls etc. - closed) but about 1 second later ... boom! BSOD :-)

I'll just have to be more choosy about which processes to attach to, or at least leave the (lower numbered) system processes to last!
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 08 July 2009 at 6:35pm
Yes - that's why I suggested at least starting with the processes running with your account...  Certain other processes require special techniques for debugging, so it may be better to focus on e.g. third-party modules loaded into their address spaces, in the event nothing turns up.

Did you explicitly detach from the csrss process, or simply exit the debugger?  If the latter, the process will be terminated, and in the case of csrss you will experience a bugcheck as a result of that critical system process termination.
Daily affirmation:
net helpmsg 4006
Back to Top
thedailycommute View Drop Down
Newbie
Newbie
Avatar

Joined: 02 June 2009
Online Status: Offline
Posts: 18 		Post Options Post Options   Quote thedailycommute Quote  Post ReplyReply Direct Link To This Post Posted: 08 July 2009 at 5:50pm
Ok, I checked all the processes running on my work machine which I know are running on my home machine and nothing stops. I also discovered (the hard way! aka big bad BSOD :-) that attaching (or rather detaching) to/from the csrss processes is not a good idea lol. Luckily I didn't lose any work.

At home it'll be easier to check, I'll disable everything first and then run through all remaining processes. With a little luck I should be able to post my findings (if I do find anything!) within a day or two.

Thanks!
Back to Top
thedailycommute View Drop Down
Newbie
Newbie
Avatar

Joined: 02 June 2009
Online Status: Offline
Posts: 18 		Post Options Post Options   Quote thedailycommute Quote  Post ReplyReply Direct Link To This Post Posted: 08 July 2009 at 4:28pm
ahhh I think I'll stick to user process debugging for now :-)
At least it'll give me something concrete to look for (plus it's a good excuse to install the debug tools on my home machine Big smile). I'll leave kernel debugging to the experts...or until I run out of processes to attach to!
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 08 July 2009 at 4:17pm
If you're up for methodical, you could consider attaching a debugger to each process (start with processes running under your account), one at a time, and setting a breakpoint on user32!ntuserswitchdesktop.  Then, use Desktops to switch the desktop, and see if the process you're debugging "breaks" at the breakpoint.  If so, that process is likely responsible, and you can check the stack at the time of the bp to attempt to determine why the process is determining that the desktop needs to be switched back.  If not, and the desktop switches back, move on to the next process...

(That's it at a high level...)

Of course, there's also the option of kernel debugging, if you're into that... Wink


Edited by molotov - 08 July 2009 at 4:18pm
Daily affirmation:
net helpmsg 4006
Back to Top
 Post Reply Post Reply Page  <1234 5>

Forum Jump Forum Permissions View Drop Down