What is the function/purpose of the Terminal Services\Sysprocs registry entry?

[Bruce Sanderson]

We're using Office XP SP3 in Windows Server 2003 SP1 Terminal
Services/Citrix Presentation Server Version 4 on 26 Terminal Servers. We're
using Terminal Services Roaming Profiles specified by a GPO.

We're having a performance problem for some users of Office and ctfmon.exe
has be fingered as the culprit. We're currently experimenting with a logon
script to set the per user registry entries as specified in the "Additional
Steps for Terminal Server Environments" section in
http://support.microsoft.com/?kbid=326526. Although the logon script
appears to be working correctly, we're finding that something is starting
ctfmon.exe anyway for some users and the registry entry

[HKEY_CURRENT_USER\Software\Microsoft\CTF\MSUTB] "ShowDeskBand"

gets set back to 1.

This problem does not affect all users, only some.

There is no entry in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
nor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

for ctfmon.exe.

We've found that ctfmon.exe is listed in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
Server\SysProcs

What is the function/purpose/significance of the items in this registry key?
Would removing the ctfmon.exe value have any affect on the problem?
Would removing the ctfmon.exe value create additional problems?

Any other ideas to solve this problem?

--
Bruce Sanderson MVP
http://members.shaw.ca/bsanders/
It's perfectly useless to know the right answer to the wrong question.

 

[Mahesh Lotlikar [MS]]

The Terminal Server\Sysprocs registry key plays role in single app mode.
When you specify intial program for your session, your session exits when
your initial app and all the processes that are running in your session
exit. However, there are some system processes that you would need to
ignore, for example, csrss.exe, winlogon.exe - session does not need to wait
for these processes to terminate. All these processes are listed under
Terminal Server\Sysprocs registry key. Your session started with intial
program would terminate when all the processes except the ones listed here
are terminated.

I am not sure what ctfmon.exe does, but if you remove this process from
sysprocs list, then you will have problem in the following scenario:
- IF your session started with a initial program AND
- IF ctfmon.exe process is running inside your session AND
- You close your initial program and all other applications that are started
within your session.

In this case, your session would not logoff until ctfmon.exe process exits.
Basically, you will have to terminate that session using administrative
tools (or kill ctfmon.exe). If ctfmon.exe is not going to be running inside
your session then I won't expect any negative side-effects of deleting this
registry value.

Hope that helps!!

--
This posting is provided "AS IS" with no warranties, and confers no rights.

"Bruce Sanderson" <bsanders@newsgroups.nospam> wrote in message
news:u5S5piXzHHA.4476@TK2MSFTNGP06.phx.gbl...
> We're using Office XP SP3 in Windows Server 2003 SP1 Terminal
> Services/Citrix Presentation Server Version 4 on 26 Terminal Servers.
> We're using Terminal Services Roaming Profiles specified by a GPO.
>
> We're having a performance problem for some users of Office and ctfmon.exe
> has be fingered as the culprit. We're currently experimenting with a
> logon script to set the per user registry entries as specified in the
> "Additional Steps for Terminal Server Environments" section in
> http://support.microsoft.com/?kbid=326526. Although the logon script
> appears to be working correctly, we're finding that something is starting
> ctfmon.exe anyway for some users and the registry entry
>
> [HKEY_CURRENT_USER\Software\Microsoft\CTF\MSUTB] "ShowDeskBand"
>
> gets set back to 1.
>
> This problem does not affect all users, only some.
>
> There is no entry in
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> nor
> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
>
> for ctfmon.exe.
>
> We've found that ctfmon.exe is listed in
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
> Server\SysProcs
>
> What is the function/purpose/significance of the items in this registry
> key?
> Would removing the ctfmon.exe value have any affect on the problem?
> Would removing the ctfmon.exe value create additional problems?
>
> Any other ideas to solve this problem?
>
> --
> Bruce Sanderson MVP
> http://members.shaw.ca/bsanders/
> It's perfectly useless to know the right answer to the wrong question.
>
>
>

 

[Vera Noest [MVP]]

This is very interesting information, Mahesh! Thanks!

So if I understand you correctly, then the Terminal Server\Sysprocs
registry key has exactly the same function as the
HKLM\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI
\LogoffCheckSysModules registry key, as described here:

CTX891671 - Graceful Logoff from a Published Application Keeps
Sessions in Active State
http://support.citrix.com/article/CTX891671

Then it's not going to help Bruce with his problem.
Bruce, I assume that you have seen this:

282599 - Frequently asked questions about Ctfmon.exe
http://support.microsoft.com/?kbid=282599
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"Mahesh Lotlikar [MS]" <maheshl@online.microsoft.com> wrote on 25
jul 2007 in microsoft.public.windows.terminal_services:

> The Terminal Server\Sysprocs registry key plays role in single
> app mode. When you specify intial program for your session, your
> session exits when your initial app and all the processes that
> are running in your session exit. However, there are some system
> processes that you would need to ignore, for example, csrss.exe,
> winlogon.exe - session does not need to wait for these processes
> to terminate. All these processes are listed under Terminal
> Server\Sysprocs registry key. Your session started with intial
> program would terminate when all the processes except the ones
> listed here are terminated.
>
> I am not sure what ctfmon.exe does, but if you remove this
> process from sysprocs list, then you will have problem in the
> following scenario: - IF your session started with a initial
> program AND - IF ctfmon.exe process is running inside your
> session AND - You close your initial program and all other
> applications that are started within your session.
>
> In this case, your session would not logoff until ctfmon.exe
> process exits. Basically, you will have to terminate that
> session using administrative tools (or kill ctfmon.exe). If
> ctfmon.exe is not going to be running inside your session then I
> won't expect any negative side-effects of deleting this registry
> value.
>
> Hope that helps!!

 

[Bruce Sanderson]

Thanks Vera and Mahesh. Good information from Mahesh!

Vera: KB article 282599 seems to have some of the same stuff as 326526, but
I'll take a closer look at the one you suggested - thanks!

One of our problems right now is we're changing so many things in our
environment unrelated to this particular problem, that getting focus on it
is difficult! This coming weekend there will be major upgrading of our GIS
software, our line of business software and the OS on the database servers
(Sun Solaris). It seems every weekend this summer is going to see
significant important upgrades or chages of one kind or another!

We're using full desktops, not published applications and there is no
"initial program" specified.

Thanks for your interest and I'll try and keep you posted as we move ahead
on this issue.

--
Bruce Sanderson MVP Printing
http://members.shaw.ca/bsanders

It is perfectly useless to know the right answer to the wrong question.



"Vera Noest [MVP]" <vera.noest@remove-this.hem.utfors.se> wrote in message
news:Xns9978799B4F2FCveranoesthemutforsse@207.46.248.16...
> This is very interesting information, Mahesh! Thanks!
>
> So if I understand you correctly, then the Terminal Server\Sysprocs
> registry key has exactly the same function as the
> HKLM\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI
> \LogoffCheckSysModules registry key, as described here:
>
> CTX891671 - Graceful Logoff from a Published Application Keeps
> Sessions in Active State
> http://support.citrix.com/article/CTX891671
>
> Then it's not going to help Bruce with his problem.
> Bruce, I assume that you have seen this:
>
> 282599 - Frequently asked questions about Ctfmon.exe
> http://support.microsoft.com/?kbid=282599
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> ___ please respond in newsgroup, NOT by private email ___
>
> "Mahesh Lotlikar [MS]" <maheshl@online.microsoft.com> wrote on 25
> jul 2007 in microsoft.public.windows.terminal_services:
>
>> The Terminal Server\Sysprocs registry key plays role in single
>> app mode. When you specify intial program for your session, your
>> session exits when your initial app and all the processes that
>> are running in your session exit. However, there are some system
>> processes that you would need to ignore, for example, csrss.exe,
>> winlogon.exe - session does not need to wait for these processes
>> to terminate. All these processes are listed under Terminal
>> Server\Sysprocs registry key. Your session started with intial
>> program would terminate when all the processes except the ones
>> listed here are terminated.
>>
>> I am not sure what ctfmon.exe does, but if you remove this
>> process from sysprocs list, then you will have problem in the
>> following scenario: - IF your session started with a initial
>> program AND - IF ctfmon.exe process is running inside your
>> session AND - You close your initial program and all other
>> applications that are started within your session.
>>
>> In this case, your session would not logoff until ctfmon.exe
>> process exits. Basically, you will have to terminate that
>> session using administrative tools (or kill ctfmon.exe). If
>> ctfmon.exe is not going to be running inside your session then I
>> won't expect any negative side-effects of deleting this registry
>> value.
>>
>> Hope that helps!!