Introduction
We have seen an instance of VMware View VDI machines failing to complete the bootup - the logon screen never appears and the machine simply hangs and has to be rebooted.
This can be caused due to a race condition in lsass.exe loading the VMware 'wsnotify' security package, and the one belonging to the AppSense/Ivanti 'AmLsaAP' package. You can see this behaviour in a full memory dump, an example is below:
0: kd> !process 0 0
PROCESS fffffa8008036380
SessionId: 0 Cid: 0224 Peb: 7fffffdb000 ParentCid: 01b0
DirBase: a0b00000 ObjectTable: fffff8a001bde970 HandleCount: 271.
Image: lsass.exe
0: kd> .process /p /r fffffa8008036380; !process fffffa8008036380 7
THREAD fffffa80080bfb50 Cid 0224.026c Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable
fffffa8007bd2300 SynchronizationEvent
Not impersonating
DeviceMap fffff8a000008b30
Owning Process fffffa8008036380 Image: lsass.exe
Attached Process N/A Image: N/A
Wait Start TickCount 589 Ticks: 113828 (0:00:29:35.728)
Context Switch Count 4 IdealProcessor: 1
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address wsnotify!SpLsaModeInitialize (0x000007fefc549600)
Stack Init fffff8800463fc70 Current fffff8800463f7c0
Base fffff88004640000 Limit fffff8800463a000 Call 0
Priority 10 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Kernel stack not resident.
Child-SP RetAddr Call Site
fffff880`0463f800 fffff800`01aa35a2 nt!KiSwapContext+0x7a
fffff880`0463f940 fffff800`01aa4e0f nt!KiCommitThreadWait+0x1d2
fffff880`0463f9d0 fffff800`01d3e0fe nt!KeWaitForSingleObject+0x19f
fffff880`0463fa70 fffff800`01b03183 nt!NtWaitForSingleObject+0xde
fffff880`0463fae0 00000000`777398ea nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0463fae0)
00000000`01b0f4c8 00000000`77702998 ntdll!ZwWaitForSingleObject+0xa
00000000`01b0f4d0 00000000`776fd0c1 ntdll!RtlpWaitOnCriticalSection+0xe8
00000000`01b0f580 00000000`750423ec ntdll!RtlEnterCriticalSection+0xd1
(Inline Function) --------`-------- AMLsaAP!__acrt_lock_and_call::__l3::<lambda_5e887d1dcbef67a5eb4283622ba103bf>::operator()+0x7 (Inline Function @ 00000000`750423ec) [d:\th\minkernel\crts\ucrt\inc\corecrt_internal.h @ 904]
00000000`01b0f5b0 00000000`01b0f630 AMLsaAP!__crt_seh_guarded_call<void>::operator()<<lambda_5e887d1dcbef67a5eb4283622ba103bf>,<lambda_4466841279450cc726390878d4a41900> & __ptr64,<lambda_341c25c0346d94847f1f3c463c57e077> >+0x1c [d:\th\minkernel\crts\ucrt\devdiv\vcruntime\inc\internal_shared.h @ 216]
00000000`01b0f5b8 00000000`00000000 0x1b0f630
Solution
This Knowledge Article is now covered in the Known Issue article: VMware View desktops hang on startup after deploy Application Control
Comments