RDP to Windows Server 2008 Terminal Server randomly gives a blank screen at login?

Question

Our uses randomly get a solid blue screen (desktop background colored blue, not BSOD) when logging into our 2008 Terminal Server. There is no TaskBar, no desktop icons, CTRL+ALT+Delete doesn't work, and no mouse events occur. The only way to end the session is to restart their terminal, or for someone to login as an admin and end their session.

I have discovered that logging in as an admin and ending the process net.exe that is running under that user's profile will end the blue screen and load the users session.

What is net.exe, and why is it randomly giving my users a solid blue screen when they login?

Here's what I know:

• Server is Windows Server 2008
• Server is a virtual server
• Disabled our group policy on our test account and the same thing still happens
• Happens about 1 in every 4 logins
• Nothing out of ordinary gets logged in the event viewer

Solution

Net.exe is the program used to map drives, mess with users, and do other network related tasks. It's usually run in logon scripts to map drives. Check your login scripts on the server that are run through startup, logon registry key, user logon script in AD, and local and domain group policies. You'll likely find something in there that's running amock at logon.

If that yields nothing, use autoruns to see what else is running at logon that may be causing issues. It would probably be benficial to disable everything not Microsoft in the logon tab and only reenable necessary processes 1by1 until you find the issue.

Comments

[Rachel]

We do have a login script which maps some network drives. I disabled it and haven't been able to get the blue screen again, so I think you're right. All it does is net use G: /del; net use g: \\server\fileshare. Do you know if there's a way to add a timeout to login scripts? Or if there's a better way to map the network drive?

[Jason Berg]

It might help to change the first command to net use g: /delete /y so it forces it to delete. It may be stuck waiting for user input and scripts are probably hidden by group policy so the user can never respond.