Symptoms or Error
Graceful logoffs from a published application launched in a seamless, fixed window, or as an RDP Initial Program, might result in the session not closing and the user being logged off. Sessions can be reset or exited correctly by manually resetting them, or by terminating remnant user processes in Terminal Services Administration, the Management Console, or Access Suite Console.
Solution
Important!: Do not place the executable name of the main published application in this key because this might result in failure to properly launch the published application. There is an issue if the main executable for the specified published application is not terminating correctly.
Complete the following steps:
Determine if the application in question and its associated processes correctly exit on a windows workstation outside of a Terminal Services environment.
If they do not, then it is possible that this mechanism might not work or it might be necessary to contact the application manufacturer.
Add the process file name to the following registry key:
Caution!Refer to the Disclaimer at the end of this article before using Registry Editor.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI
Value Name:LogoffCheckSysModules
Type:REG_SZ
String:MyAppName.exe
Notes:
Do not place the executable name of a secondary process that has a visible window in this key. This mechanism is designed to exit secondary processes that do not have a visible window, as it is expected that if an application window is visible, then it is intended for the user to see it, and therefore close it themselves.
The application might not appear to present a visible window or a system tray icon in a seamless session. Run the application in a fixed window, perform the function within the application that spawns the secondary process and minimize the main application window. The spawned window is displayed in the background. An RDP initial application session configured on the RDP listener exhibits the same behavior. If a customer uses a logoff script, the logoff script could be used to check for the spawned process and terminate the process. Ideally, the application should close all child process that it spawns.
Enter the list of executable names with a comma and NO spaces between them, for example:
App1.exe,app2.exe,app3.exe
Problem Cause
When publishing an application, only the main executable file is specified. However, some applications might spawn additional processes that run in the background and are not closed by the corresponding main executable file. Additional processes might also be created, from scripts that are executed, or from specific registry keys, such as the RunOnceKey:
HKEY_LOCAL_MACHINE\SW\Microsoft\Windows\CurrentVersion\RunOnce
Some processes might create a visible window for added functionality, and others might not.
Because the Explorer.exe Desktop is not running when launching an application in one of these ways, there is no default mechanism in either Presentation Server or Windows to terminate these background processes when a user has exited the main application.
Presentation Server has a hard coded list of what are considered ‘System’ type secondary processes that are checked for and terminated once all user application processes have terminated, these include:
atok1*.exe
clipsrv.exe
conime.exe
csrss.exe
ctfmon.exe
ddhelp.exe
eventlog.exe
iatokik*.exe
iatokqb*.exe
iatqb1*.exe
ibdbsch.exe
imejp98m.exe
imejpmgr.exe
imepadsv.exe
jsvschvw.exe
lmsvcs.exe
lsass.exe
msgsvc.exe
nddeagent.exe
nddeagnt.exe
netdde.exe
netstrs.exe
os2srv.exe
proquota.exe
screg.exe
smss.exe
spoolss.exe
ssonsvr.exe
wfshell.exe
win.com
winlogon.exe
wpabaln.exe
wuauclt.exe
Note:To specify additional processes specific to your environment, see theSolutionsection of this article.
Examples of Secondary ProcessesCwbprovd.exe is a process initiated by IBM Client Access. If you have IBM Client Access on your system and observe the same behavior as stated above, complete the following tasks:
Verify the sessionID, which is experiencing this issue.
Before logoff, type the following command from the command prompt to manually kill Cwbprovd.exe:
kill cwbprovd.exe session idGracefully exit the published application.
Cwbprovd.exe过程(among two other processes) is being launched at logon by IBM Client Access (even if you do not run it) through the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Contact IBM for a utility calledCWBCFWTSto remove these processes from the registry.
Note: Servers running IBM’s Client Access ExpressARE NOTknown to exhibit this behavior.
Sxplog32.exeis a process initiated by the Software Delivery Agent by Computer Associates and can be found in theuserinitvalue of thewinlogonregistry key. Manually terminating the process temporarily fixes the problem and allows the session to reset.
Etlits.exeandEntell50.exeare processes initiated by Entrust 6.1 and can be found in theuserinitvalue of thewinlogonregistry key. Manually terminating the process temporarily fixes the problem and allows the session to reset.
Wisptis.exe is a process that runs as a system service that provides pen-data collection for other components of the SDK. When a component needs to interact with the pen (for example, to collect ink or to detect gestures), this executable is spawned as a service to communicate directly with the input device. On a Tablet PC, Wisptis.exe interacts with the digitizer, whereas on a desktop it interacts with the mouse as well. The executable’s name is an acronym that references an outdated internal name for the team that developed it (Windows Ink Services Platform Tablet Input Subsystem). You cannot remove wisptis.exe by renaming or deleting it: Windows File Protection would reinstall the file the next time Adobe Acrobat 6.0 started. In general, the ways in which wisptis.exe can get installed on the system are by installing Journal Viewer using the Windows Update or installing Microsoft Office 2003.Ssonsvr.exe
If a starting program was specified under the Environment tab in the User Account Properties and if the ICA pass-through Client had pass through authentication enabled, Ssonsvr.exe was running in the ICA session of the user. When the user exited the application (specified in the Environment tab in User Account Properties), the ICA session could not be logged off; the administrator had to manually stop the Ssonsvr.exe process. The thread that caused the Ssonsvr.exe process to exit when the user logged off from the application was not being started.Now the thread that causes the Ssonsvr.exe process to exit is started when the user logs off from the application.
From Hotfix XE103W2K030:
Ssoshell.exe,Ssobho.exe,Ssomho.exe