WARNING: Update 969947 may prohibit establishment of an RDP session on Windows XP

[David Dickinson]

I tested KB969947 on a Windows XP Professional SP3 machine that is reserved
for testing. After installing that update, I could not log on to it in a
Remote Desktop session. In fact, the machine had frozen and could not even
be accessed with its keyboard or mouse, and the hard drive light flashed in
a repeating pattern over several minutes. However, after restarting the
machine, I could log on to it locally. After uninstalling that update, RDP
sessions were successful. I reinstalled it and tested again, and RDP
sessions failed. After uninstalling, they worked.

Test this update thoroughly before deploying it! I've notified Microsoft
about the issue, but the help that is available at this time told me that
Microsoft Enterprise will have to deal with it, and I have to wait until
normal business hours tomorrow to contact them.

I haven't yet tested this update on other versions of Windows, but I hope no
adminstrators have large networks using automatic updates. I'm just hoping
that this isn't the disaster that it could be.

David Dickinson
eveningstar at mvps dot org

NOTE: This message has been cross-posted to microsoft.public.windowsupdate,
microsoft.public.security, microsoft.public.microsoft_update_catalog, and
microsoft.public.windowsxp.security_admin.

[PA Bear [MS MVP]]

See the "How to obtain help" section of
http://support.microsoft.com/kb/969947

For home users, no-charge support is available by calling 1-866-PCSAFETY
and/or 1-866-234-6020 in the United States and in Canada or by contacting
your local Microsoft subsidiary. There is no-charge for support calls that
are associated with security updates. When you call, clearly state that
your problem is related to a Security Update and cite the update's KB number
(e.g., KB999999).

Or you can...

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Consumer Security Support home page
https://consumersecuritysupport.microsoft.com/

For more information about how to contact your local Microsoft subsidiary
for security update support issues, visit the International Support Web
site: http://support.microsoft.com/common/international.aspx

For enterprise customers, support for security updates is available through
your usual support contacts.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002

David Dickinson wrote:
> I tested KB969947 on a Windows XP Professional SP3 machine that is
> reserved
> for testing. After installing that update, I could not log on to it in a
> Remote Desktop session. In fact, the machine had frozen and could not
> even
> be accessed with its keyboard or mouse, and the hard drive light flashed
> in
> a repeating pattern over several minutes. However, after restarting the
> machine, I could log on to it locally. After uninstalling that update,
> RDP
> sessions were successful. I reinstalled it and tested again, and RDP
> sessions failed. After uninstalling, they worked.
>
> Test this update thoroughly before deploying it! I've notified Microsoft
> about the issue, but the help that is available at this time told me that
> Microsoft Enterprise will have to deal with it, and I have to wait until

> normal business hours tomorrow to contact them...

[David Dickinson]

Thanks, but as I said, I've already contacted Microsoft about it. I've got
a support request number and everything. But since the Enterprise group
only works during daylight, I have to wait until then to contact them...

...which strikes me as strange. Home users can get help 24/7. But if
you've got a problem that could affect thousands of computers, your problem
has to wait.

David

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message
news:OuaSPcqY...@TK2MSFTNGP06.phx.gbl...

[tommydokc]

we're having the exact same problems here on several machines. I've had to
boot to safe mode to get it uninstalled then everything is back to normal. I
would advise to disable the download of that update at this point.

"David Dickinson" wrote:

> .
>

[Susan Bradley]

Not repro-ing that here.

XP sp3

[Susan Bradley]

Second machine tested. Can't repro on second box.

[David Dickinson]

I have two XP Pro SP3 test machines. One has the problem, the other
doesn't. I haven't been able to isolate the cause yet. The machines have
significant differences in their configurations, so it will take some time.

"Susan Bradley" <sbra...@pacbell.net> wrote in message
news:uKby%23cwYK...@TK2MSFTNGP04.phx.gbl...

[Susan Bradley]

Recently I had an issue post .net patch that I could not RDP. It was
due to the monitor card software interaction with 951847.

Look in your event log on the workstations and see if you are getting
that error.

After the install of KB951847 (.net family) I found I could not rdp into
a XP workstation. Updating the driver didn't work but putting in the
registry key did:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\Memory Management]

"SessionImageSize"=dword:00000020

Brad Rutkowski's Blog : \SystemRoot\System32\RDPDD.dll failed to load:
http://blogs.technet.com/brad_rutkowski/archive/2008/01/04/systemroot-system32-rdpdd-dll-failed-to-load.aspx

[David Dickinson]

I had considered display driver problems, but that's not it. With 969947
installed, the machine freezes during RDP logon. Without 969947, the
machine works fine. There are absolutely not messages in the event log
relating to this issue. The security log doesn't even show the normal logon
attempt messages. As soon as I enter the password to logon in a remote
desktop session, the machine freezes.

"Susan Bradley" <sbra...@pacbell.net> wrote in message

news:OhfrBrwY...@TK2MSFTNGP06.phx.gbl...

[Susan Bradley]

You said you had a case open right? If not ping me and I'll get you
one. Can you let me know what they say?

[Nort]

I have seen a problem where after installing 969947, the PC will
lockup shortly after you login. I was able to uninstall the update in
safe mode.

This has only occurred on PC's with an ATI Radeon HD 2400 series
cards. Upgrading to the latest version of the driver (9.1, released
10/22/2009) and then reapplying the 969947 update seems to fix the
issue.

Just my .02

On Nov 11, 3:09 pm, Susan Bradley <sbrad...@pacbell.net> wrote:
> You said you had a case open right?  If not ping me and I'll get you
> one.  Can you let me know what they say?
>
> David Dickinson wrote:
> > I had considered display driver problems, but that's not it.  With
> > 969947 installed, the machine freezes during RDP logon.  Without 969947,
> > the machine works fine.  There are absolutely not messages in the event
> > log relating to this issue.  The security log doesn't even show the
> > normal logon attempt messages.  As soon as I enter the password to logon
> > in a remote desktop session, the machine freezes.
>

> > "Susan Bradley" <sbrad...@pacbell.net> wrote in message

> >news:OhfrBrwY...@TK2MSFTNGP06.phx.gbl...
> >> Recently I had an issue post .net patch that I could not RDP.  It was
> >> due to the monitor card software interaction with 951847.
>
> >> Look in your event log on the workstations and see if you are getting
> >> that error.
>
> >> After the install of KB951847 (.net family) I found I could not rdp
> >> into a XP workstation.  Updating the driver didn't work but putting in
> >> the registry key did:
>
> >> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
> >> Manager\Memory Management]
>
> >> "SessionImageSize"=dword:00000020
>
> >> Brad Rutkowski's Blog : \SystemRoot\System32\RDPDD.dll failed to load:

> >>http://blogs.technet.com/brad_rutkowski/archive/2008/01/04/systemroot...

>
> >> David Dickinson wrote:
> >>> I have two XP Pro SP3 test machines.  One has the problem, the other
> >>> doesn't.  I haven't been able to isolate the cause yet.  The machines
> >>> have significant differences in their configurations, so it will take
> >>> some time.
>

> >>> "Susan Bradley" <sbrad...@pacbell.net> wrote in message

[David Dickinson]

This machine has an nVidia GeForce 7050. But the symptom you describe is
similar to what this machine experiences. Perhaps there's a problem with
display rendering in an RDP session when this update is installed.

"Nort" <mg...@yahoo.com> wrote in message
news:47d5667f-dde2-409d...@h2g2000vbd.googlegroups.com...

[David Dickinson]

I spent two hours on the phone, including hold times, with Microsoft while
they transferred me to different departments. PC Safety says its a business
problem since it involves RDP. Business support says its a PC Safety
problem since it involves an update. Then we got disconnected when a guy's
headsets failed. I can't try again until tomorrow. I am not a happy guy.

I'll post an update when I learn something.

"Susan Bradley" <sbra...@pacbell.net> wrote in message

news:uInx8Mx...@TK2MSFTNGP05.phx.gbl...

[cox]

David,

Same issue here on a SBS test server. Have not confirmed 100% it is
related only to the 969947 patch. However, I saw the following error
in the event log:

Event Type: Error
Event Source: TermService
Event Category: None
Event ID: 1014
Date: 11/11/2009
Time: 3:32:10 PM
User: N/A
Computer: FSERVER
Description:
Cannot load illegal module: C:\WINDOWS\system32\rdpwsx.DLL.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I googled it and someone suggested to take another copy of the
rdpwsx.dll and replace it on the sick machine. I rebooted and it
worked.

I can't say any of these events are related, but I thought I share my
experience anyway.

Cox

[Susan Bradley]

If this is occuring on a SBS box that may be something else?

SBS 2003 and DNS patch issues revisited - THE OFFICIAL BLOG OF THE SBS
"DIVA":
http://msmvps.com/blogs/bradley/archive/2009/03/11/sbs-2003-and-dns-patch-issues-revisited.aspx

[David Dickinson]

You have a different problem. Try resetting the RDP session with this:

echo yes | reset session RDP-tcp

If it happens a lot, then you've got a corrupted installation. A
repair/reinstall of the OS should fix it. Unfortunately, I don't know of a
better solution.

"cox" <c...@coxpartners.com> wrote in message
news:9549798b-e03e-4950...@b15g2000yqd.googlegroups.com...

[lifeisgood]

Can you check this link (Looks like a similar issue):
http://forums.techarena.in/windows-xp-support/1139973.htm

The last post in the above link says:
Dell technical support sent me this link (among others) this morning:
http://www.nvidia.co.uk/object/winxp_182.08_uk.html
I downloaded and installed that, and it has fixed the problem.

"Susan Bradley" wrote:

> .
>

[PA Bear [MS MVP]]

@David: Are you aware of the annual Global Technical Support package benefit
and did you avail yourself of same to get assistance with this? cf.
https://mvp.support.microsoft.com/gp/MVPTechSup
--
~Robear

[David Dickinson]

@PA Bear: Yes, thanks, I do know about the benefits. But I haven't been an
MVP since 2002, when my business expanded and I just couldn't keep up with
the forums. Not being an MVP anymore, I don't qualify for the package. But
now that I've been able to delegate some of my more tedious
responsibilities, I hope to have more time to spend here. I'd forgotten how
much I enjoyed it.

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message

news:%23ll$Bs2YKH...@TK2MSFTNGP05.phx.gbl...

[Stefan Ikas]

We have a similar problem. If I login (without RDP), the machine
freezes. In safe mode it is possible to uninstall the update. Than the
problem is solved. In this department we have about 20 PC's. Only 4 of
them got this phenomenon. At one of this PC I was unable to start the
safe mode. Only the Recovery Console gave me the possibility to
uninstall the patch.

David Dickinson schrieb:

[David Dickinson]

"Stefan Ikas" <s...@audacon.com> wrote in message
news:u%23sL$P3YKH...@TK2MSFTNGP06.phx.gbl...

> We have a similar problem. If I login (without RDP), the machine freezes.
> In safe mode it is possible to uninstall the update. Than the problem is
> solved. In this department we have about 20 PC's. Only 4 of them got this
> phenomenon. At one of this PC I was unable to start the safe mode. Only
> the Recovery Console gave me the possibility to uninstall the patch.

Let me make sure that I understand you: your machine freezes when you login
locally and /not/ in an RDP session? And the problem is with KB969947?

This is a new symptom, and a very interesting one.

[Stefan Ikas]

Yes you are right! If I uninstall this update the machine is OK. To be
sure that patch make this problem, I installed this patch again and the
problem was back: PC is frozen.

David Dickinson schrieb:

[Curt]

On Nov 12, 2:59 am, Stefan Ikas <s...@audacon.com> wrote:
> Yes you are right! If I uninstall this update the machine is OK. To be
> sure that patch make this problem, I installed this patch again and the
> problem was back: PC is frozen.
>

Yep, we are having the problem in a major way here. The majority of
our workstations all share the same ghost image and its been affecting
them all. We are doing both the removal of the update and loading an
update to our video drivers and so far its working just fine for us.
We are using ATI video cards and loading the R186683.exe update from
Dell for them. We've been loading critical security updates using WSUS
for about 4 years now and so far this is the first one that has bombed
out totally. Guess 4 years with no bombing out in a Microsoft world
isn't too bad eh? :-)

[PhilBatesNY]

(New to posting-apologies if I break etiquette)
I concure with "Nort"s issue/solution...
We have Dell Optiplex 745/755's - XPProSP3 w/ATI Radeon HD2400 video cards.
FYI - Dell website drivers not helpfull with this (out of date as of 12Nov09)
- AMD had the latest on their website
(http://game.amd.com/us-en/drivers_catalyst.aspx?p=xp/radeonx-xp).
Uninstalled Security Update KB969947 (VIA SafeMode) rebooted - installed
latest video drivers - restarted PC's - Re-Installed SU KB969947 (Held
Breath) and things are running very well at this point. This has affected 5
PC's so far (Updates installed on 11Nov09 causing initial issue - my "clue")
Waiting for my other 30+ 745/755 PC's to install the update and freeze -
Doing this Reactivily, not Proactive at this point. (Staffing-but that's
another post :-)
Thanks for the help folks...
Wouldn't have attempted the AMD Website Driver fix without this
posting/string for information.

"Nort" wrote:

> > >>http://blogs.technet.com/brad_rutkowski/archive/2008/01/04/systemroot....

> .
>

[Curt]

On Nov 12, 9:59 am, PhilBatesNY

<PhilBate...@discussions.microsoft.com> wrote:
> (New to posting-apologies if I break etiquette)
> I concure with "Nort"s issue/solution...
> We have Dell Optiplex 745/755's - XPProSP3 w/ATI Radeon HD2400 video cards.  
> FYI - Dell website drivers not helpfull with this (out of date as of 12Nov09)
> - AMD had the latest on their website
> (http://game.amd.com/us-en/drivers_catalyst.aspx?p=xp/radeonx-xp).  
> Uninstalled Security Update KB969947 (VIA SafeMode) rebooted - installed
> latest video drivers - restarted PC's - Re-Installed SU KB969947 (Held
> Breath) and things are running very well at this point.  This has affected 5
> PC's so far (Updates installed on 11Nov09 causing initial issue - my "clue")  
> Waiting for my other 30+ 745/755 PC's to install the update and freeze -
> Doing this Reactivily, not Proactive at this point. (Staffing-but that's
> another post :-)
> Thanks for the help folks...

Now we are having some sproadic issues with Network Cards and Printers
due to this. We are having to remove the drivers for the network cards
and parallel ports and let Windows reinstall them before they will
work properly. Wow, they did a bangup job this time!

[John]

Jeez... same problem here and spent hours trying to figure out why no rdp.
John

[Kevin Hau]

Curt;1603308 Wrote:
> On Nov 12, 9:59*am, PhilBatesNY

> <PhilBate...@discussions.microsoft.com> wrote:
> > (New to posting-apologies if I break etiquette)
> > I concure with "Nort"s issue/solution...
> > We have Dell Optiplex 745/755's - XPProSP3 w/ATI Radeon HD2400 video

> cards. *

> > FYI - Dell website drivers not helpfull with this (out of date as of
> 12Nov09)
> > - AMD had the latest on their website

> > ('Drivers & Support | GAME.AMD.COM'
> (http://game.amd.com/us-en/drivers_catalyst.aspx?p=xp/radeonx-xp)). *

> > Uninstalled Security Update KB969947 (VIA SafeMode) rebooted -
> installed
> > latest video drivers - restarted PC's - Re-Installed SU KB969947
> (Held

> > Breath) and things are running very well at this point. *This has

> affected 5
> > PC's so far (Updates installed on 11Nov09 causing initial issue - my

> "clue") *

> > Waiting for my other 30+ 745/755 PC's to install the update and
> freeze -
> > Doing this Reactivily, not Proactive at this point. (Staffing-but
> that's
> > another post :-)
> > Thanks for the help folks...
>
>
> Now we are having some sproadic issues with Network Cards and Printers
> due to this. We are having to remove the drivers for the network cards
> and parallel ports and let Windows reinstall them before they will
> work properly. Wow, they did a bangup job this time!

We've seen this issue resolved in the Answers forums.

The resolution is to boot to safe mode and uninstall the update, then
update the ATI video drivers, then reboot and reinstall the update.

'Lost user profile / unable to boot to desktop after installing
KB969947' (http://tinyurl.com/ydd3wh5)

I hope this helps.

--
Kevin Hau
Posted via http://www.vistaheads.com

[PA Bear [MS MVP]]

No problemo, just checking. Have you seen Kevin Hau's post where he pointed
afflicted users to
http://social.answers.microsoft.com/Forums/en-US/vistawu/thread/62820804-061e-4cd9-aaef-73e607d8760a ?

<QP>

The resolution is to boot to safe mode and uninstall the update, then
update the ATI video drivers, then reboot and reinstall the update.

</QP>

If no joy, we've got a CSS Security PM who will work with you.

[PA Bear [MS MVP]]

cf.
http://social.answers.microsoft.com/Forums/en-US/vistawu/thread/62820804-061e-4cd9-aaef-73e607d8760a

[PA Bear [MS MVP]]

Follow-up: See the Known Issues section of
http://support.microsoft.com/kb/969947 (Revised 12 Nov-09)

[PA Bear [MS MVP]]

Follow-up: See the Known Issues section of
http://support.microsoft.com/kb/969947 (Revised 12 Nov-09)

@TOMCAT46: Please continue the crosspost in your replies. THX

TOMCAT46 wrote:
> I have verified this issue on a Dell Optiplex 755 with an ATI 2400 XT
> video card.
>
> My test system completely hung (no mouse, video or keyboard) within 1
> minute of logging in (it doesn't happen until you log in). Occassionally
> video fragments appeared in red or pink along the top of the screen and
> at the location where my mouse arrow had been.
>
> I resolved this issue by upgrading the video driver to the current
> version from ATI. The current version from Dell seems to fix this as
> well.
>
> To reproduce the issue, install this version of the AMD/ATI driver for
> the 2400 XT:
> Version; 8.420.000
> Date: 9/14/2007
>
> The Current version from Dell:
> Version: 8.490.0.0
> Date: 4/9/2008
>
> The current version from AMD/ATI:
> Version 8.661.0.0
> Date: 7/23/2009
>
> My only remaining issue is I'll need to upgrade the video driver on all
> Dell Optiplex 755's in the company before I can push out this critical
> security update. That's going to cause a 1-week postponement of the
> hotfix deployment.
>
> I've also opened a case at Microsoft, so I'm hoping they might have a
> fix before I have to upgrade the video drivers.

[~*Laughingstar 2009*~]

may I ask - should we the people uninstall it?

thank you.

PA Bear [MS MVP] wrote:

[Stefan I.]

Yeah, it works! Thanks! :)

PA Bear [MS MVP] schrieb:

[Susan Bradley]

You need it to protect your system. If you are impacted, then follow
the info to update the video driver.

[GregInd]

On Nov 13, 2:38 pm, Susan Bradley <sbrad...@pacbell.net> wrote:
> You need it to protect your system.  If you are impacted, then follow
> the info to update the video driver.
>
>
>
> ~*Laughingstar 2009*~ wrote:
> > may I ask - should we the people uninstall it?
>
> > thank you.
>
> > PA Bear [MS MVP] wrote:
> >> Follow-up: See the Known Issues section of

> >>http://support.microsoft.com/kb/969947(Revised 12 Nov-09)

> >>> fix before I have to upgrade the video drivers.- Hide quoted text -
>
> - Show quoted text -

I have about 11 Dell Optiplex 755's at a client site. Luckily the
computers arent freezing at this point but we have been having major
RDP issues. I have one employee at this site who uses SBS 2003 RWW to
access her computer remotely and obvioously she cant work now! I have
tried the above fix with no success but these Dell's are the same as
some of the above posts. I am going to try again today but if I have
to I will rebuild the workstations one by one and then block this
update!!