Windows Server 2003 Terminal Services Problems; More Windows 2000 Hotfixes

Windows Server 2003 Terminal Services ProblemsIf you're configuring Windows 2003 Terminal Services, be aware that Microsoft has released 22 hotfixes for known problems that occur on servers and clients. Last month, I described a bug that causes a terminal server to reset Terminal Services license mode from per-user mode to per-device mode when you add or remove Windows components, as the Microsoft article "Terminal Services Licensing mode changes from Per User to Per Device after you add or remove a Windows component" (http://support.microsoft.com/?kbid=834651) documents. This month, I discuss four additional problems you should address in your standard Windows 2003 Terminal Services images before you deploy them in a production environment.
Unresponsive Server. After you configure a new Terminal Services terminal server, you might find that the server refuses to log off current sessions, refuses new connection requests, and doesn't respond to a console logon attempt. A problem in the way the redirector component processes an I/O request prevents the correct shutdown of connected sessions, even when the user appears to have logged off successfully. After these pending I/O’s accumulate for 3 or 4 days, the terminal server hangs and you need to reboot the system to restore its functionality. Microsoft Product Support Services (PSS) released a hotfix that contains new versions of two redirector components, mrxsmb.sys and rdbss.sys, both with file release dates of November 25, 2003. When you call PSS, cite the reference article "Terminal Services stops responding on your Windows Server 2003 server" (http://support.microsoft.com/?kbid=832971).
Roaming Profiles. Some administrators like to configure Terminal Services users with roaming profiles. If you use this technique, be aware that when a user changes his or her password, the terminal server might be unable to load the user’s roaming profile. When a user changes his or her password as requested, a bug in the authentication procedure loads the server’s default desktop profile instead of the user-specific profile. You can work around the problem for one user by rebooting the terminal server. Of course, in an environment with hundreds or thousands of Terminal Services clients, this workaround is impractical. To permanently correct the problem, you need to install a new version of lsasrv.dll which PSS has had available since December 7, 2003. You’ll need to reboot to activate the fix. See the Microsoft article "The roaming profile is not loaded after the user uses Terminal Services to log on to Windows Server 2003" (http://support.microsoft.com/?kbid=833409) for more information about the problem and fix.
Idle Disconnect Ignored. When a Terminal Services terminal server disconnects a client because the inactivity disconnect time has been reached, the next time the same user reconnects, the system doesn't restart the idle disconnect timer. Because the disconnect timer is not restarted, the same individual can remain connected for days, even though the session is idle. After several days of such behavior, your terminal server might end up loaded with inactive sessions that take resources from users who are actually working. Microsoft PSS has a bug fix for this problem—a new version of termsrv.dll with a file release date of December 8, 2003. You need to reboot the server after you install the update to load the new binary. For more information about the problem, see the Microsoft article "Windows Server 2003 Terminal Server ignores the idle disconnect settings in a user profile" (http://support.microsoft.com/?kbid=832088).
Printing Issues. Nothing is more frustrating than printing problems. When you host Windows 2000 and Windows XP Terminal Services clients on a Windows 2003 Terminal Server, print jobs might show up in a network print queue as printing, but never come out at the printer. You’ll experience this printing problem when you use the Net Use command to connect a network printer to a parallel port (e.g., LPT1) on the client. You can eliminate lost print jobs by installing a new version of rpddr.sys, with a file release date January 12, 2004. According to Microsoft PSS, you don’t need to restart the server to activate this fix. When calling PSS, cite the reference article "You cannot print from a Terminal Server session that is hosted by Windows Server 2003" (http://support.microsoft.com/?kbid=833746).

More Windows 2000 Hotfixes
Microsoft has released the following hotfixes that correct Win2K-related problems.
Win2K Smart Card Hotfix. Those of you who use a smart card to log on to Win2K over a wireless network might already be familiar with the problems you encounter when you forget to put the card into the reader before you log on. If you don’t first insert the card, a bug in the logon procedure might prompt you to do so every 30 seconds. And, the smart card prompt might remain on the screen after you enter your PIN and successfully log on to the network. The good news is that Microsoft has released a bug fix for this problem, which occurs specifically on wireless networks. The fix updates seven components, the most recent of which have only been available for the last 2 months. After you install the update, you must reboot to activate the fix. For information, see the Microsoft article "You are repeatedly prompted to insert your smart card when you log on to your Windows 2000-based computer" (http://support.microsoft.com/?kbid=837191).
Win2K MBSA Hotfix Eliminates System Reboot. A coding error in the popular Microsoft Baseline Security Analyzer (MBSA) utility can cause the services.exe umbrella process to fail with an access violation. When services.exe fails, it forces a system reboot. Microsoft PSS has a hotfix that corrects this problem; the hotfix updates three files, browser.dll, netapi32.dll, wkssvc.dll, all of which have a file release date of February 13, 2004. Note that this problem affects only Win2K, Windows 2003 or XP. The Microsoft article "Windows 2000-based computer that is running Microsoft Baseline Security Analyzer restarts unexpectedly" (http://support.microsoft.com/?kbid=823644) documents this problem.
Certificate Wizard Hotfix for XP, Win2K, and NT. Have you seen an access violation when you use the Microsoft Management Console (MMC) Certificates snap-in and attempt to import certificates? If so, you've encountered a known bug in the how the wizard processes an import request on XP, Win2K, and Windows NT. Microsoft has released a platform-dependent hotfix for this problem. The NT bug fix updates eight files, with file release dates from October 2003 through April 13, 2004. The extensive Win2K hotfix updates more than 40 system components, including several core processes; most of the Win2K files have a December 2003 release date. The XP version updates five or six components, most with a release date of December 17. You must obtain this update directly from PSS. When you do, cite the article "Access violation error when you try to import a certificate on a computer that is running Windows NT 4.0, Windows 2000, or Windows XP" (http://support.microsoft.com/?kbid=833828).
Windows 2003 and Win2K IDE Blue Screen Bug Fix. A bug in how the IDE code manages device synchronization can blue screen Windows 2003 and Win2K systems with a stop code of 0x000000D1. Microsoft has corrected the coding error in a newly released version of pciidex.sys. The Windows 2003 release has a file date of April 5, and the Win2K version has a file release date of March 30. The new code is available only from PSS. For more information, see the Microsoft article "You receive a 'STOP 0x000000D1' error message in Windows Server 2003 or in Windows 2000 Server" (http://support.microsoft.com/?kbid=831694).
Win2K Explorer Hotfix Corrects Shutdown Failure. When you enable the active desktop on Win2K systems and shut down the system, you might see an error indicating that Windows Explorer has failed with the message “The instruction at "0x00404d51" referenced memory at "0x00000000". The memory could not be "read". The Explorer crash doesn't have serious consequences because the system restarts normally. If you don’t want to see the error message during shutdown, you can correct the problem by installing the latest version of explorer.exe, released April 15, 2004. The update is available directly from PSS. When you call PSS, cite the reference article "Access violation error message in Explorer.exe when you shut down your Windows 2000-based computer" (http://support.microsoft.com/?kbid=840330).