One of our customers has the following problem:
If a user using a smart card logs on to the terminal server, the CertPropSvc has an error.
Then the "User Profile Service" restarts.
After that, all other users are only logged in with temporary profiles.
The problem first appeared after the following Windows Server 2016 updates were installed:
- KB4091664 (2018-09 Update for Windows Server 2016 for x64-based Systems)
- KB4487038 (2019-02 Security Update for Adobe Flash Player for Windows Server 2016 for x64-based Systems)
- KB4485447 (2019-02 Servicing Stack Update for Windows Server 2016 for x64-based Systems)
- KB4487026 (2019-02 Cumulative Update for Windows Server 2016 for x64-based Systems)
After we noticed the error, the following update was installed:
- KB4487006 (2019-02 Cumulative Update for Windows Server 2016 for x64-based Systems)
However, this did not improve the situation.
At first only one of the servers was affected by the error as it was the only one that got the updates installed.
But the other ones got the same problem after installing the updates.
We currently needed to disable smartcard redirection for the affected rds farm and would
Event Viewer:
- 07:28:40 -> User logs on with the smartcard connected via usb (and smartcard enabled on the rds-server)
- 07:28:46 -> CertPropSvc error #1
- 07:28:47 -> desktopshellext.dll / sihost.exe error
- 07:27:47 -> user profile service restart
- 07:28:57 -> twinui.dll / explorer.exe error
- 07:29:33 -> user profile service logging in a user with a temporary profile
CertPropSvc Error:
Event 1000, Application Error
- Faulting application name: svchost.exe_CertPropSvc, version: 10.0.14393.0, time stamp: 0x57899b1c
Faulting module name: ntdll.dll, version: 10.0.14393.2608, time stamp: 0x5bd133d4
Exception code: 0xc0000008
Fault offset: 0x00000000000a975a
Faulting process id: 0x47c
Faulting application start time: 0x01d4d1f5f8b67d6b
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 35e736e3-1a95-4370-8182-06acccf78d28
Faulting package full name:
Faulting package-relative application ID:
Event 1001, Windows Error Reporting
- Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: svchost.exe_CertPropSvc
P2: 10.0.14393.0
P3: 57899b1c
P4: ntdll.dll
P5: 10.0.14393.2608
P6: 5bd133d4
P7: c0000008
P8: 00000000000a975a
P9:
P10:
Attached files:
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_Cert_26a6b2b3886758ea49d9b56135f8ec6a67e4e8_4de58e77_7009cbd6
Analysis symbol:
Rechecking for solution: 0
Report Id: 35e736e3-1a95-4370-8182-06acccf78d28
Report Status: 4
Hashed bucket:
User Profile Service:
Event 1531, User Profile Service
- The User Profile Service has started successfully.
I could provide other logs if needed.