AppLocker prevents DWM.exe running at log off

Hi All,
We are testing Windows 8.1 for release at our site, and have come across an AppLocker issue with DWM.exe being denied access to run at log off - this results in a black screen whenever a users chooses to log off of a PC and nobody being able to logon again
until the PC is restarted.
Event Logs on the PC indicate this as Event ID 8004 under "Application and Services Logs\Microsoft\Windows\AppLocker\EXE and DLL" and specifically states that AppLocker is preventing it. DWM.exe continuously tries to run and keeps logging errors
for a period of time before giving up.
Applocker is configured as:
Executeable Rules:
DOMAIN\Domain Users - Signed by O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US
DOMAIN\Staff - Allow anything for staff members
DOMAIN\special.user - Allow anything for a specific user.
DOMAIN\Domain Users - C:\programdata\* (This allows AppV Packages)
DOMAIN\Domain Users - C:\Program Files (x86)\*
DOMAIN\Domain Users - All Files located in program files folder
DOMAIN\Domain Users - All files located in the Windows folder
BUILTIN\Administrators - (Default Rule) All Files
Packaged app Rules, Windows Installer Rules and Script Rules all have the default rule values enabled (Though, none of these rules are set to Enforced in the base AppLocker setup - I did find that 8.1 Modern UI apps would not function without the default
rules enabled for Packaged app Rules).
These rules appear to allow everything else to function happily, with the only error showing in the Event viewer logs being the DWM.exe issue.
I have attempted to specifically allow DWM.exe via direct file, publisher, path rules for all users as above and even NT AUTHORITY\System - all with no effect on the situation.
Has anyone else encountered this issue with AppLocker and Windows 8.1 before?
Regards,
/Glaic

Hi,
Could you please paste the complete Event 8004 here so we can better know what happened?
Are there any domain or OU level group policies applied? Local group policy will be overriden by higher lever gpos which might cause this issue.
Does this issue happen on a local user account?
Yolanda Zhu
TechNet Community Support

Similar Messages

Problem is need to log off computer to go from one web site to another with message that program still running. Logging off to go from email to something else is very time consuming and annoying.

Troublesome need to log off between switching from Yahoo to another website with message that program is still running.

Terminate Firefox from the "Processes" tab of the Windows Task Manager not the "Applications" tab. Then select firefox.exc and use the right-click context menu to "End Process" or use the "End Process" button on the selected process.
Windows 7 keyboard shortcut "Ctrl+Shift+Esc" will go directly to the Windows Task Manager and reopen the last tab that you had open.
See item #38 Closing Firefox Properly -- use File -> '''Exit'''
*http://dmcritchie.mvps.org/firefox/firefox-problems.htm#close_firefox
<br><small>Please mark "Solved" one answer that will best help others with a similar problem -- hope this was it.</small>
I don't see why you feel you have to exit Firefox to get out of one website to immediately use another website. Very impractical. Does this have anything to do with desktop icons or not using tabs?
Completely unrelated to your question or your reason. Your flash plug-in is out of date.
Check for Flash updates to see if you really are current
* http://www.adobe.com/software/flash/about/
After the download,
#bring up the download manager ("Ctrl+J") and start your installs. As soon as the install comes up,
#close Firefox with File > Exit or "Firefox" button > Exit. Give Firefox some time to close and check that it finished via the Windows Task Manager -- if it is still running then terminate it by selecting the use "End Process" button or from context menu.
#proceed with the install
'''Warning''': this is the Adobe site and they have chosen to to provide crapware along with their own product. Only install the product you were planning to install. Do not install additional products: including -- "Free! McAfee Security Scan Plus" or "Google Chrome". Installing Google Chrome on your own and installing it because it is offered on the Adobe site are two different things.
Find updates for your installed plugins at http://www.mozilla.com/plugincheck/ mozilla.com/plugincheck
-- best to use Adobe's site to really see if their plug-ins are up to date.

Run while logged off of NT server

Is there any way 9iFS (9.0.1.1.0) be run while no one is logged on to the NT server its installed on. Like, as a service or something.
Cheers

1. Use PowerShell as it is more powerful.
2. Win32_UserProfile has a last accessed date that you can use.
3. Win32_UserProfile has a system flag which you can use.
4. Develop a list of accounts to exclude.
Start by analyzing how this works:
gwmi win32_userprofile -filter 'Special = False' |select SID,lastusetime
it skips all special and builtin accounts. YOu just need to detect teh domain perfix for specisal domain account and then match the list of other excluded accounts.
On our systems we roam the profiles of RDS so they can be removed even if someone still wants to use them. They will just be reloaded. I also set the intermittent users to delete the "local" copy on logoff so they take up no space.
¯\_(ツ)_/¯

LOCK the screen or LOG OFF?

Hello All,
OS: SLES 9
What is the difference between LOCK the screen or LOG OFF?
From the server I run command (rwserver.sh server=repserver90 batch=yes &) to run my report server up or running.
Pl note: If its down I am not able to run my reports.
After that I have lock the screen.
Now I am able to use any client (windows machine) to run reports from my Oracle AS url.
I wonder if I LOG OFF from the server,
is my report server still running?
Regards,
DN

What is the difference between LOCK the screen and LOG OFF from the server?
Well, lock screen keeps all the processes running,
whereas log off from the session, would kill most processes
(not the oracle server, but most others that are still associated
with the X session).Something I want to add to that: Locking the screen also prevents other users from using that terminal session, but it depends on where you're locking the screen. If you are not running an X session and you lock the screen via flock or some similar console locking mechanism then users can't use that terminal session, but can use other terminal sessions on the same machine.
If you are running an X session and you lock the terminal via xlock or xscreensaver, you prevent users from using that computer station entirely. Also, if you're running an X session, utilities like flock become quite meaningless because they don't stop the user from opening a new terminal window.
From the server I ran command to run my report server up.
rwserver.sh server=repserver90 batch=yes &
I think if you use the command with nohup instead,
it would detach from the controlling terminal, so it
wouldn't matter whether you only lock the screen,
or log out completely.The ampersand "&" at the end of the command line throws the process into the background. Most of the time this is enough to dissociate the process from the controlling terminal enough that logging out will not kill the process, so logging out after starting the server that way should leave the server running.
Nohup's behavior changes with the environment you're using. In tcsh, it simply causes the process to ignore hangups, though it can itself be overridden by the process. In Bash, nohup will will also change the scheduling priority of the process and redirect output and error messages to "nohup.out", either in the local directory or in the $HOME directory (and if it can't write to nohup.out for some reason, it refuses to run the process).
Another method is to use the GNU "screen" command.But if you use screen, make sure that the screen command is ABSOLUTELY NOT setuid root. I know most sane distributions nowadays don't install it with setuid root anymore, but paranoia never hurt the admin.

ITunes prevents log off

A window comes up saying "Saving iTunes library" and does not go away. It prevents me from opening iTunes and logging off. I have left it to think over night and it still tries to log off. I have to hard-restart the computer every time this happens. It occurs two-three times/week. Also, when I try to use the task manager to close iTunes, it then prevents me from logging off my computer. My tech department has wiped my computer & reinstalled iTunes and this still occurs. Help?!

Security software? That's a pretty vague question to me. I have Symantec Anti-virus if that's anything like what you're asking about.
If you're not clear on what security software is installed on the PC, check with your tech people to see what you're running. If it includes a firewall, try deleting the existing firewall rules for iTunes and then replacing them with a new rule (or rules) allowing full access to the internet. (Firewall rule interference with iTunes.exe is a known cause of the process refusing to die.)

Run time error occured while clicking the Log off

Hello Experts,
I have customized masthead file. In the masthead, when i click the log off link, the pop-up window will showing the Runtime error message. Its not working properly. I didnt make any changes in log off method. I traced the error,
<%if (!isPreview){%>
          if (EPCM.getUAType() == EPCM.MSIE)
               if(EPCM.getGlobalDirty())
                     // unsaved data on the page, display modified dialog
                    var val = window.showModalDialog('<%=GetLogoffConfirmUnsavedMsgURL(componentRequest)%>', '', '<%=LOGOFF_CONFIRM_MSG_ARGS_IE%>');
                    if (val == 'logoff')
                         disableWorkProtectCheck = true;
                         logoff();
               else //no unsaved data
                    // data saved, nothing get lost on the page, display normal dialog
                  var val = window.showModalDialog('<%=GetLogoffConfirmMsgURL(componentRequest)%>', '', '<%=LOGOFF_CONFIRM_MSG_ARGS_IE%>');
                  if (val == 'logoff')
                      logoff();
          else
               if(EPCM.getGlobalDirty())
                  window.open('<%=GetLogoffConfirmUnsavedMsgURL(componentRequest)%>', '<%=LOGOFF_CONFIRM_WINDOW_NAME%>', '<%=LOGOFF_CONFIRM_MSG_ARGS_NS%>');
               else
                  window.open('<%=GetLogoffConfirmMsgURL(componentRequest)%>', '<%=LOGOFF_CONFIRM_WINDOW_NAME%>', '<%=LOGOFF_CONFIRM_MSG_ARGS_NS%>');
     <%}%>
In this code having if condition if(EPCM.getGlobalDirty()) is set as true means, then only properly executed and it shows the Log off message. In my part it goes to the else part. Then it shows run time error message.
I cannt able to find out the solution.Pls help me in this regarding.
Regards
Prakash T

Hi,
see if running SFC /Scannow helps. This basically restores missing/corrupt system files.
Click Start/Run and type CMD
Type SFC /Scannow
Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe):
http://support.microsoft.com/kb/310747/EN-US/
Please Reward Points if Helpful.
Kind Regards,
Vamsi.

When logging off user receives appcrash on TPOSDSVC.exe on T410

I’ve also received this error message when trying to log off or on my system:
Problem signature:
Problem Event Name:                        APPCRASH
Application Name:                             TPOSDSVC.exe
Application Version:                           1.1.6.0
Application Timestamp:                     4b2f43bd
Fault Module Name:                          ntdll.dll
Fault Module Version:                        6.1.7601.17725
Fault Module Timestamp:                  4ec49b60
Exception Code:                                  c0000005
Exception Offset:                                0001f8c4
OS Version:                                          6.1.7601.2.1.0.256.48
Locale ID:                                             1033
Additional Information 1:                  e8ad
Additional Information 2:                  e8adce1c2b9e7be834b4063ac3c53863
Additional Information 3:                  e8ad
Additional Information 4:                  e8adce1c2b9e7be834b4063ac3c53863

TPOSDSVC.exe is part of the "On screen Display" . Try uninstalling that and rebooting. You can reinstall it by reinstalling hotkeys.

How to run GINA when windows log off ?

I test pGina program which was create from GINA. I want create program for logon windows with C#. I wonder when user log off windows why pGina can run application for login windows. I think application can run when start windows only . How pGina can run
program when user click log off button ?

Hi mmc01,
I'm afraid you posted your question on the wrong forum. This forum is dedicated to Project Server concerns, the Microsoft enterprise scheduling & planning application.
Please go to an appropriate forum in order to have an helpful hand.
Cheers.
Guillaume Rouyre - MBA, MCP, MCTS

Firefox Always "First Run" After Reboot or Log off The PC.

Firefox Always "First Run" After Reboot or Log off The PC, No Deepfreeze. I have scanned the PC and no virus. How To fix that?

Firefox Always "First Run" After Reboot or Log off The PC, No Deepfreeze. I have scanned the PC and no virus. How To fix that?

Run LabVIEW executable when user logs off

I have a customer request to do this.
My customer has a computer in their plant that I wrote a LabVIEW applicaiton to monitor part of their process. This computer performs other functions in addition to my program. Their IT department has changed their policy that mandates that anybody using this computer has to log in under their own user name and password. Prevoulsy it was just a group user name and password. What this means for me is everytime a new user needs to use the PC they have to log off and log back on. This stops my program.
Is there a way to have a LabVIEW executable keep running when different users log off and log on?
Thanks
Dan

Sounds like you need a service. It may be a complete architecture change, but you could have an executable running as a service and a user interface executable connecting to it (e.g. via TCP/IP). The service itself can't have a UI.
Without using a service there's no way an application can continue running when a user logs off (afaik).
A service is started even if no user logs on.
There's tools like srvany or similar that allow to run an executable as a service.
Daniel
Message Edited by dan_u on 08-18-2009 03:13 PM

Applications still run after user logged off

Hi,
I have a w2k8r2 Terminal server and have a problem that have eluded me for some time now.
When a user is logged off, by either being disconnected or being inactive for a prolonged time, the user initiated programs are still running.
To be more exact, Some times when a user is logged off I have the following situation:
In the task manager on the users tab I cannot see the user anymore (nor in the remote desktop services manager), but in the Processes tab I can still see user initiated programs running. Furthermore I am not able to kill any of those programs, getting an
"Access is denied" error message.
My problem is that when the Terminal Server enters this "state" it becomes all buggy and itchy, causing loads of problems for the users that are already logged in (and for the new ones trying to log in). The only solution I have found is rebooting
the server.
Any solution, or further troubleshooting steps, are more than welcome. For me the next step is reinstalling which I really don't want

1. Check any task schedular is running for application or not,
Refer :
http://answers.microsoft.com/en-us/windows/forum/windows_7-security/if-i-log-off-at-night-leave-computer-on-will/559eec53-1d2a-46f8-ac12-f0d4a32ab57a?msgId=b51d42b3-e727-40c0-b94e-8a01b31bf526
2. Also update Antivirus and scan completely.
3. Is it specific application or all the application, Which user opened in his session?
4. If specific application is running (In this scenario Outlook is running even user logs off), Try the below Citrix forum thread.
Refer :
http://discussions.citrix.com/topic/301644-user-logs-off-process-outlookexe-stays-active-error-the-citrix-server-has-reached-its-concurrent-application-limit/
5. Check and update TCP/IP driver
Refer : http://support.microsoft.com/kb/2465772/en-us
6. Also cross verify Dharmesh suggestions also.
Regards,
Manjunath Sullad

Server keep running after user log-off?

Just need confirmation...
Does it keep running all services (mail, web, etc...) after logging off a user from macosx 10.5.4 server?

thanks. just need to create new user and log in because current user's finder is relaunching on almost every action with it... want to try if it's problem with user or all system.

Run a script only at shutdown (not log off or restart)

Hi,
Is there any way to run a script only at shutdown?
I mean, only when the computer is really shutting down to off state. This script should not run when doing just a log off or restart.
Any help really appreciated. Thank you!
Cheers!

Hi,
The problem is that the standard scripts can't differentiate between a restart and a complete shutdown.
If there's no separate shutdown/power off script (I'm not aware of any), maybe there's some method to detect within a script what is actually in process.
Cheers!

Run shutdown oc4j instance automatically when user Turn off/Log off

Hi All,
Can you help me anyone to run the shutdown oc4j instance automatically when user Turn off/Log off the application or the computer?
I want to use any Schema level trigger if possible to solve the issue.
I am using oracle Developer Suite 10g and Database 10g as well.
Arif

Ah, sorry I misunderstood your question (probably not enough coffee in the morning); anyway there are folders for scripts which should be executed on startup / shutdown or logon / logoff:
Startup
%SYSTEMROOT%\System32\GroupPolicy\Machine\Scripts\StartupShutdown
%SYSTEMROOT%\System32\GroupPolicy\Machine\Scripts\ShutdownLogon
%SYSTEMROOT%\System32\GroupPolicy\User\Scripts\LogonLogoff
%SYSTEMROOT%\System32\GroupPolicy\User\Scripts\LogoffWrite a script to startup / shutdown your OC4J (probably calls to startinst.bat and stopinst.bat) and place them in the apropriate folders.
cheers

How to run a batch before window log off

We have a situation. We monitor an application very closely for failure rate. Many users are currently just logging off windows when leaving work. When they use windows log off it kills this application which intern return non-zero exit code(indicating application
problem).
Is there a way to run a batch/powershell script to close application first(we have a method to close it gracefully) before log off process is triggered by windows 7.
We tried putting a routine in GPO log off script. But widows log off kills all applications before the routine has chance to run.
Please help.

Hi,
Create a batch file and insert the shutdown command in the last line. When you want to shutdown computer, just run this batch file.
Alex Zhao
TechNet Community Support

AppLocker prevents DWM.exe running at log off

Similar Messages

Maybe you are looking for