Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

Windows XP logoff hangs on 'Saving your settings'

Created: 09 Dec 2010 | 5 comments


I'm experiencing a random issue where approx 5-10 of our 350 XP desktops do not log off correctly each day and sit with the 'Saving you settings' message displayed on the screen. The desktop is not completely frozen at this point and it is possible to remotely connect to the drive etc, but will not gracefully shut down and needs to be cold power cycled.

These are Windows XP SP3 virtual desktops hosted on VMware ESX which are within a Citrix Xendesktop VDI. We are using Endpoint Protection v11.0.5002.333.

This was originally thought to be caused by Citrix as the issue started to occur shortly after upgrading to XenDesktop v4. We have a support case open with Citrix who have analysed dumps of the desktop's memory and the winlogon process. So far thay can see that winlogon.exe is waiting indefinitely for something, but cannot see what this is.

I have looked through the Symantec knowledge base and found other similar cases where SEP was thought  to be the cause, for example: 

Our SEP installs uses only AV and Anti-Spyware, we have Network Threat Protection and TruScan Proavtive Threat switched off.

Any help would be much appreciated as this is proving to be a pain to troubleshoot and we are running out of ideas.



Comments 5 CommentsJump to latest comment

Rafeeq's picture

from the centralized exceptions; exclude ntuser.dat file and check.


install the latest verion on one single machine and check

put the serial number

download 11.0.6 mp2

install it on the machine

Brɨan's picture

You should also upgrade to the latest version, RU6 MP2.

If you open a support case with Symantec, this is the first thing they will want done.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

spkenny's picture

Thanks for the replies, I was looking at the release notes for RU6 and found this listed as one of the fixes:

Login stalls when running Symantec Endpoint Protection

Fix ID: 1902263

Symptom: Login may take several minutes and may never complete

Solution: Fixed a synchronization issue in Tamper Protection 

This matches the problem we're having pretty closely so i've disabled Tamper Protection and will see if this has any affect over the next few days. I don't really want to have to deploy RU6 to our environemt just to see if it fixes things, so disabling TP is a much easier option.

As for the suggestion for adding a Centralised Exception for ntuser.dat, i'm guessing this means configuring from the client, not centrally fron the SEPM? If I were to try and do this from the SEPM, can the path be configured with the %userprofile% variable within the Centralised Exceptions policy? i.e %userprofile%\ntuser.dat?

Pawel Lakomski's picture

Yes, you can use Prefix variables in centralized exceptions but I am not aware of user profile variable:



Symantec Technical Specialist
Symantec Certified Specialist
Cisco Certified Network Associate
Citrix Certified Administrator

Pawel Lakomski's picture

 It is possible to use windows variables:


and here's how:

Which variables and wildcards does Endpoint Protection allow in Centralized Exception Policies?



Symantec Technical Specialist
Symantec Certified Specialist
Cisco Certified Network Associate
Citrix Certified Administrator