Users are unable to launch applications, the application appears to launch then disappears.

Looking into the CDF traces, we see a connection interruption after the application got created and the VDA server received CGP_CHANNEL_CLOSE while the session established which seems to be the reason for the session disconnection.

Ideally the Winlogon.exe reads “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\” and creates userinit.exe process. However, in the affected environment, apart from userinit.exe it also created another process kusrinit.exe , which is a software component of KACE Agent which replaces the original "UserInit" file in Windows Operating Systems to operate as its own version of the original "UserInit" file so that it can integrate into the operating system efficiently.

This Kusrinit.exe created another Userinit.exe which again created cmstart.exe and wfshell.exe and the additional Kuserinit.exe caused the duplicate instances of userinit.exe, cmstart.exe and whsell.exe.

Check the registry “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\” for Userinit value and ensure there is only below entry in there:

C:\Windows\system32\KUsrInit.exe

Problem Cause