Vista Black Screen of Death and Altiris SVS

When we rolled out the HP 2730p tablets to Staff last year, we decided to try out the Altiris software virtualisation (SVS).

Since it came bundled with our Altiris purchase it seemed like the easiest choice for getting into software virtualisation. We had tried the demo for VMWare’s Thinapp but were discouraged by the pricing and had been impressed with demos if Microsoft App-V. Software virtualisation would let us have a much smaller SOE with just Vista, Office 2007 and the Adobe CS4 Master Collection, and have every other application installed as an SVS layer. This way we could reduce the time needed for imaging and control the application deployment through Altiris. We could also enable the web portal which would let Staff select which SVS layers they’d like deployed to their machine!

Since the 2730p machines have been imaged, we’ve had a few come back because Vista seems to hang on a black screen after the green progress bar on boot up

Vista Green Bars

The problem seems to be with a driver for SVS (fslx.sys) and after browsing the web for reasons why we’ve had this issue found that it may be a problem with one of the SVS packages we’ve deployed.

A thread on the Symantec forums details some of the SVS KSOD issues that people have had and found that troublesome SVS layers are the culprit. This thread confirmed our suspicions that we were having trouble with SVS packages that we’d made for applications like Skype and iTunes that have regular/frequent updates. The files in the SVS layer can’t be updated when there’s an update or patch for an application. With software virtualisation on the rise it would be handy if the application knew it was virtualised and would warn the user that new versions can’t be installed until the virtualised application is removed.

Anyway, here’s the fix:

· Boot the machine into Safe Mode

· Login as Admin

· Rename C:\Windows\system32\drivers\fslx.sys to C:\Windows\system32\drivers\fslx_old.sys

· Restart the machine

This will disable SVS and all the SVS layers. We’ve had some success with updating the SVS software to a slightly newer version, though, in most cases we’ve still had trouble after updating the SVS client. The best bet is to work out which SVS layer us causing the problem and disable it. Easier said than done.

We’re yet to decide if we’ll consider SVS for the 2010 Staff image. If we do, we’ll have to exclude applications like iTunes and Skype and try to avoid the black screen issues. We also need to decide if we’re going to move to Windows 7 for this image and whether it will be 32 or 64bit. Symantec have released the beta version of Symantec Workspace Virtualization,new version of SVS, which is compatible with 64bit Windows but it’s unlikely that the final version will be released in time for our internal testing.

Vista bug – Deletes Inactive Profile

vista Sometime ago now, but still worth sharing, we had an issue with our Vista tablets for Staff. The issue was with Vista, pre SP1 we think, and a Group Policy setting for deleting an inactive profile after 30 days. This GPO setting was a legacy setting that we had on the network to delete Student profiles on network machines that weren’t removed when they logged off.

After successfully rolling out the notebooks to staff, we think about a 30 days after the imaging, we had 4 panicked Staff call the IT Helpdesk within minutes of each other. Their machines had fouled up and restarted and when they logged in they had a fresh profile and all of their documents and email had disappeared!

After a some quick Googling we found Dave’s post on his blog and he’d had exactly the same experience. This is straight from Dave Says:

“Seems the domain controller software has a (Y/N) parameter to delete old profiles that have not been used for 30 days or more.
If set to Y, the software screws up when a terminal logging in is running either Vista or Server 2008 OS. In these instances, it sometimes concludes the current user profile has been inactive for 30 days & deletes it!

Solution is have your admin set parameter to N – apparently there was a note floating around back in the beta days last year – thanks for publicising it guys!”

Thanks to Dave, we immediately change the GPO setting and, luckily, didn’t have any more problems. It was interesting that we only had 4 notebooks with the problem, if it was all 55 we would have been in trouble, but this is what happens when you dive into a new OS I suppose…

More info from Dave Says

Vista logged on with a temporary profile

Over the past few months we’ve had a few instances of users logging into their Vista machines and receiving a temporary user profile. We have a fleet of 55 Vista notebooks that we’ve been running since Jan 2008 and had this error 3 or 4 times on different machines and twice on one machine! We haven’t been able to work out what’s causing the profile corruption, its not clear if the users have had trouble shutting down their machines, BSOD, or something else. We imaged these machines pre-SP1, and this problem could be something to do with the pre-SP1 Vista issues. None of our Vista SP1 machines have had this error so far, touch wood…

The error logged in Event Viewer is EventID 1511:
Event ID: 1511 – Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.

The users are logged on with a temporary profile and receive a warning in the system tray to tell them that their changes to the temp profile wont be saved. With the machines that we’ve come across so far the original profile has been in tact and there as been no data loss, just the inconvenience for the user while they loose their machine for an hour while we sort it out.

By looking in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList you can see that the corrupt profile has been renamed and has a .bak appended to the SID.

Looking the error up in Google took me straight to the Microsoft KB947242 where they say the cause is:

“This problem occurs if the current user’s profile was accidentally deleted from the system.”

WTF?! That doesn’t exactly instil confidence in Vista and user profiles, fortunately we haven’t lost any data yet but it would be interesting to know what’s been causing this error for us and if their are many people out there that have had similar experiences.

This is a copy of the instructions from the Microsoft Knowledge Base Article 947242 to fix the problem. We followed these instructions, pretty easy, just a hassle, and haven’t had any issues with data loss from the original profile.
To resolve this problem, follow these steps:

1. Log on to the system by using an administrative user account other than the user account that is experiencing the problem.

2. Back up all data in the current user’s profile folder if the profile folder still exists, and then delete the profile folder. By default, the profile resides in the following location:

%SystemDrive%\Users\UserName

3. Click Start, type regedit in the Start Search box, and then press ENTER.
If you are prompted for an administrator password or for confirmation, type your password, or click Continue.

4. Locate the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

5. Under the ProfileList subkey, delete the subkey that is named SID.bak.
Note SID is a placeholder for the security identifier (SID) of the user account that is experiencing the problem. The SID.bak subkey should contain a ProfileImagePath registry entry that points to the original profile folder of the user account that is experiencing the problem.

6. Exit Registry Editor.

7. Log off the system.

8. Log on to the system again.

Full details here on Microsoft Knowledge Base Article 947242

The temporary profile issue is one of two major profile issues we’ve had since migrating to Vista, will blog the other issue soon, and we are starting to look seriously at client backup and recovery options. The Altiris Client Management Suite and Backup Exec Desktop Edition has been recommended to us but would like to hear from anyone that can recommend this package, or something else, for a corporate environment.