VMware Horizon View machines fail to boot: hang before logon screen

Version 3
Created by joeh on Mar 21, 2018 5:07 AM. Last modified by timothyb on Jul 30, 2018 1:54 AM.

    Verified Product Versions

    Application Control 8.9Application Control 10.0Application Control 10.1

    Introduction

    We have seen an instance of VMware View VDI machines failing to complete the bootup - the logon screen never appears and the machine simply hangs and has to be rebooted.

     

    This can be caused due to a race condition in lsass.exe loading the VMware 'wsnotify' security package, and the one belonging to the AppSense/Ivanti 'AmLsaAP' package. You can see this behaviour in a full memory dump, an example is below:

     

    0: kd> !process 0 0

     

    PROCESS fffffa8008036380

        SessionId: 0  Cid: 0224    Peb: 7fffffdb000  ParentCid: 01b0

        DirBase: a0b00000  ObjectTable: fffff8a001bde970  HandleCount: 271.

        Image: lsass.exe

     

    0: kd> .process /p /r fffffa8008036380; !process fffffa8008036380 7

     

            THREAD fffffa80080bfb50  Cid 0224.026c  Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable

                fffffa8007bd2300  SynchronizationEvent

            Not impersonating

            DeviceMap                 fffff8a000008b30

            Owning Process            fffffa8008036380       Image:         lsass.exe

            Attached Process          N/A            Image:         N/A

            Wait Start TickCount      589            Ticks: 113828 (0:00:29:35.728)

            Context Switch Count      4              IdealProcessor: 1            

            UserTime                  00:00:00.000

            KernelTime                00:00:00.000

            Win32 Start Address wsnotify!SpLsaModeInitialize (0x000007fefc549600)

            Stack Init fffff8800463fc70 Current fffff8800463f7c0

            Base fffff88004640000 Limit fffff8800463a000 Call 0

            Priority 10 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5

            Kernel stack not resident.

            Child-SP          RetAddr           Call Site

            fffff880`0463f800 fffff800`01aa35a2 nt!KiSwapContext+0x7a

            fffff880`0463f940 fffff800`01aa4e0f nt!KiCommitThreadWait+0x1d2

            fffff880`0463f9d0 fffff800`01d3e0fe nt!KeWaitForSingleObject+0x19f

            fffff880`0463fa70 fffff800`01b03183 nt!NtWaitForSingleObject+0xde

            fffff880`0463fae0 00000000`777398ea nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0463fae0)

            00000000`01b0f4c8 00000000`77702998 ntdll!ZwWaitForSingleObject+0xa

            00000000`01b0f4d0 00000000`776fd0c1 ntdll!RtlpWaitOnCriticalSection+0xe8

            00000000`01b0f580 00000000`750423ec ntdll!RtlEnterCriticalSection+0xd1

            (Inline Function) --------`-------- AMLsaAP!__acrt_lock_and_call::__l3::<lambda_5e887d1dcbef67a5eb4283622ba103bf>::operator()+0x7 (Inline Function @ 00000000`750423ec) [d:\th\minkernel\crts\ucrt\inc\corecrt_internal.h @ 904]

            00000000`01b0f5b0 00000000`01b0f630 AMLsaAP!__crt_seh_guarded_call<void>::operator()<<lambda_5e887d1dcbef67a5eb4283622ba103bf>,<lambda_4466841279450cc726390878d4a41900> & __ptr64,<lambda_341c25c0346d94847f1f3c463c57e077> >+0x1c [d:\th\minkernel\crts\ucrt\devdiv\vcruntime\inc\internal_shared.h @ 216]

            00000000`01b0f5b8 00000000`00000000 0x1b0f630

     

    Solution

    This Knowledge Article is now covered in the Known Issue article: VMware View desktops hang on startup after deploy Application Control