Symptoms
Published application sessions take 60 seconds to log off when Windows 2003, Service Pack 1 is installed.
Cause
Microsoft code changes in Service Pack 1 for Windows 2003.
In Service Pack 1, two instances of userinit.exe are started at logon. One instance runs for more than 1 minute performing Certification Auto Enrollment.
Because it takes userinit more than a minute to run the second instance on load, once 60 seconds have passed, the session will log off normally.
However, if logoff occurs or is attempted before the 60 seconds, the logoff will wait for the second userinit to run, taking at least 60 seconds causing the delay.
Workaround
Refer to below as a workaround available in Microsoft TechNet.
AEExpress
Registry path
HKEY_Local_Machine\Software\Policies\Microsoft\Cryptography\Autoenrollment
Version
Windows Server 2003 and Windows XP
Add AEExpress on a per-user basis if the default 60-second delay is not desired. With this registry setting, the autoenrollment balloon UI appears at each logon or Group Policy refresh interval.
Note
•Using this subkey in a normal production environment is not recommended. If it is used, the subkey must be created on a per-user basis. Computer certificates do not support user interaction and should not be configured to require this setting.
OR
Create a Microsoft Group Policy Object (GPO) which is assigned to the Terminal Server users and change the Autoenrollment Settings under User Configuration\Security Settings\Public Key Policies\ to Do not enroll certificates automatically as shown below:
This prevents the second instance of userinit.
Resolution
This behavior is by Microsoft design.
[#103511]
