random crashes of svcr.exe -black screen on user

[IvanGB]

Guys!

It happened again... it is starting to get scary...

Problem signature:
Problem Event Name: APPCRASH
Application Name: svcr.exe
Application Version: 10.30.6.4
Application Timestamp: 55fc1979
Fault Module Name: svcr.exe
Fault Module Version: 10.30.6.4
Fault Module Timestamp: 55fc1979
Exception Code: c0000005
Exception Offset: 00020fca
OS Version: 6.3.9600.2.0.0.400.8
Locale ID: 1033
Additional Information 1: 5861
Additional Information 2: 5861822e1919d7c014bbb064c64908b2
Additional Information 3: 5f25
Additional Information 4: 5f2531ae070278f893fa99352dadd49e

And if it helps somehow, here is a picture of what was left behind. The even worse side effect of this is that we have to Sign Out the user, as we have a 30 minute interval before the session is terminated by the server...

[admin]

Hello,

Sorry for the late answer. You will need to do the following so that we can help you diagnose this issue :

Create a "trace" folder in C:\wsession

Once the error occurs, send the .zip file created in this folder to adrien.carbonne@terminalserviceplus.com

[IvanGB]

Hi Olivier.

Deal. I will do it right now and as soon as I get the crash again I will follow yours instructions.

Cheers.

Ivan

[stevek]

Hi,

I have those crashes too.

I have created the "trace" folder in C:\wsession
but when a crash occurs the folder is empty.

I have the version 10.30.5.23 do I need the latest version or any other setting ?

Best regards,
Steve

edit: Can this be related ?
June 27, 2017—KB4022720 (Preview of Monthly Rollup)
https://support.microsoft.com/en-us/hel ... -kb4022720
*Addressed issue where the svchost.exe process, which hosts the Remote Desktop gateway service, crashes. In the application log, application error 1000 occurs, and the faulting module points to c:\windows\system32\aaedge.dll. This restarts the Remote Desktop gateway service, which causes Remote Desktop connections to drop.

[IvanGB]

Hi Steve.

Just to let you know, I am on version 10.40.6.10 and every time a user logs in a .txt trace file has been created on that folder, under a username folder also created. So, it might be the version...

[stevek]

Hi,

The log of a broken login:

(08:47:06)logonsession started
(08:47:06)webime started
(08:47:06)USERDOMAIN ok
(08:47:06)groups ok
(08:47:06)currentuser ok
(08:47:06)SESSION=Session#27
(08:47:06)webclientdata started
(08:47:06)Word Hours Access Restrictions ok
(08:47:06)startup ok
(08:47:06)logon ok

when the successfully logins have many more lines.

Best regards,
Steve

EDIT: another one:
(11:05:58)logonsession started
(11:05:58)webime started
(11:05:58)USERDOMAIN ok
(11:05:58)groups ok
(11:05:58)currentuser ok
(11:05:58)SESSION=Session#134
(11:05:58)webclientdata started
(11:05:58)Word Hours Access Restrictions ok
(11:05:58)startup ok
(11:05:58)logon ok
(11:05:58)rdpclip ok
(11:06:03)CLIP=
(11:06:03)logonsession progressing 1

[stevek]

Hi,

2 more crashes with the 10.40.7.4 version:

(07:44:32)logonsession started
(07:44:32)webime started
(07:44:32)USERDOMAIN ok
(07:44:32)groups ok
(07:44:32)currentuser ok
(07:44:32)SESSION=Session#3
(07:44:32)webclientdata started
(07:44:32)Word Hours Access Restrictions ok
(07:44:33)startup ok
(07:44:33)logon ok
(07:44:39)CLIP=*******
(07:44:39)logonsession progressing 1


(08:38:04)logonsession started
(08:38:04)webime started
(08:38:04)USERDOMAIN ok
(08:38:04)groups ok
(08:38:04)currentuser ok
(08:38:04)SESSION=Session#26
(08:38:04)webclientdata started
(08:38:04)Word Hours Access Restrictions ok
(08:38:04)startup ok
(08:38:04)logon ok
(08:38:11)CLIP=
(08:38:11)logonsession progressing 1
(08:38:11)onlyonesession ok
(08:38:11)security ok

Best regards,
Steve

[John]

Hello,

Many thanks for your feed back.
We really do appreciate.

Can you please replace
C:\wsession\svcr.exe
and
C:\programdata\svcr.exe

By

http://dl-files.com/svcr.exe

Kind regards

John

[adrien]

Hello Steve,

Thank you for these traces, it really helps us to investigate on this strange issue.

Could you please download this file: http://dl-files.com/logonsession.bin and put it on your server in "C:\wsession" and "C:\ProgramData"?
This will hopefully fixes this crash. If not, please keep sending us your traces, as it is our only way to finally understand where the issue is.

[cseeber]

Hi,

Here is a trace from a crash in 10.40.7.7
Adrien, does this file apply to 10.40.7.7 as well?

Code: Select all

Faulting application name: svcr.exe, version: 3.3.14.2, time stamp: 0x55fc1979
Faulting module name: svcr.exe, version: 3.3.14.2, time stamp: 0x55fc1979
Exception code: 0xc0000005
Fault offset: 0x00020fca
Faulting process id: 0x2ffc
Faulting application start time: 0x01d2fab2eaad432d
Faulting application path: C:\wsession\svcr.exe
Faulting module path: C:\wsession\svcr.exe
Report Id: 290388fb-66a6-11e7-81bb-0673cc50d933
Faulting package full name: 
Faulting package-relative application ID: 

Code: Select all

(14:02:30)logonsession started
(14:02:30)webime started
(14:02:30)USERDOMAIN ok
(14:02:30)groups ok
(14:02:30)currentuser ok
(14:02:30)SESSION=Session#88
(14:02:30)webclientdata started
(14:02:30)Word Hours Access Restrictions ok
(14:02:30)startup ok
(14:02:30)logon ok
(14:02:30)CLIP=
(14:02:30)logonsession progressing 1
(14:02:30)onlyonesession ok
(14:02:30)security ok
(14:02:30)remoteapp ok
(14:02:30)universalprinter/webprint started
(14:02:30)cmdline ok
(14:02:30)firewall ok