Thanks for following up. That was a very good find.
*ASB **http://XeeMe.com/AndrewBaker* <http://xeeme.com/AndrewBaker>* **Providing Virtual CIO Services (IT Operations & Information Security) for the SMB market…*** On Sat, Aug 24, 2013 at 7:12 PM, J- P <[email protected]> wrote: > Ok, so after looking at thousands of procmon lines , I finally figured out > what was causing it- > This is not the normal bug thats been around , but it did relate to an HP > printer. > > What tipped me off was the spools process not doing anything other than > "process profiling" no regquery no create , no file create and no > imagepath , > > So I ran procmon on a desktop and there it was, Spoolsv.eve doing what it > should be , RegOpen, FileSystemControl, Regcreate, etc..... > > "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client > Side Rendering Print > Provider\Servers\Print_Server\Printers\{3B2A2A60-72A2-4B70-99F3-1FE3E72FDB85}\PrinterDriverData > > HKCU\Printers\Connections\,,Print_Server_Name,Shared_Printer_Name > > and heck of alot more entries- > > > Evidently the genius writing the front end of the DB decided to make some > upgrades (without telling anyone), like hardcoding default printers for > various reports, queries etc.. and since said printers did not exist on Box > , thats when MSIExec would kickoff and attempt the installation of the HP > Printers. > > After installing ALL the printers on the box, print previews take about 1 > second to load, and no MSIexec. > > This will be one costly lesson to the client :) as I spent quite sometime > on this. > > Thanks to everyone for all the feedback. > > And now time for some cognac > > Thanks again > > > > > > > > > > > > Jean-Paul Natola > > > > ------------------------------ > From: [email protected] > To: [email protected] > Date: Thu, 22 Aug 2013 08:25:47 -0400 > Subject: RE: [NTSysADM] MSIEXEC CPU on TS > > Not local to the Citrix server, local to the RDP or Citrix client. > > > > *From:* [email protected] [mailto: > [email protected]] *On Behalf Of *Daniel Chenault > *Sent:* Wednesday, August 21, 2013 11:14 PM > *To:* [email protected] > *Subject:* Re: [NTSysADM] MSIEXEC CPU on TS > > > > Ahhhh... okay. Major bummer. > > > > If this is only for local attach printers then the only solution I see > until MS issues a patch is for the RDP/Citrix server to not have any local > attach printers. > > > > *From:* J- P <[email protected]> > > *Sent:* Wednesday, August 21, 2013 3:20 PM > > *To:* [email protected] > > *Subject:* RE: [NTSysADM] MSIEXEC CPU on TS > > > > think I may have stumbled onto something,I have afew 1000 of these, > however, they are not identical they seem to increment and all result in > "NO MORE ENTRIES" > > > HKU\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32 > HKU\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB} > > HKU\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32 > HKU\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA} > > > > > > > > > > > > > > Jean-Paul Natola > > > ------------------------------ > > From: [email protected] > To: [email protected] > Date: Wed, 21 Aug 2013 13:44:16 -0400 > Subject: RE: [NTSysADM] MSIEXEC CPU on TS > > That’s not the problem. > > > > What happens is that whenever a remote user (either citrix or RDP) prints > (or logs on, I forget), the local printers FOR ALL LOGGED IN USERS get > GUIDs assigned that are unique for that user’s session. The stupid HP > print drivers (maybe other too) create keys under > HKU\.Default\Software\Hewlett-Packard corresponding to ALL THESE GUIDS. > This rapidly results in thousands of keys. > > > > For some reason, msiexec.exe likes to fully traverse that key OVER and > OVER and OVER resulting in msiexec using 100% of one CPU AND msiexectaking > forever to get anything done. > > > > *From:* [email protected] [ > mailto:[email protected] <[email protected]>] *On > Behalf Of *Daniel Chenault > *Sent:* Wednesday, August 21, 2013 12:53 PM > *To:* [email protected] > *Subject:* Re: [NTSysADM] MSIEXEC CPU on TS > > > > Maybe I’m missing something or need more coffee... > > > > Set up a group of the RDP users. Deny those users access to those printers > using the printer properties Security tab. > > > > *From:* J- P <[email protected]> > > *Sent:* Tuesday, August 20, 2013 4:29 PM > > *To:* [email protected] > > *Subject:* RE: [NTSysADM] MSIEXEC CPU on TS > > > > on the TS box itself- > > I guess disabling MSIExec wouldn't help either > > I'm up to 27 new guids in the last hour > > > > > > > > > > > > Jean-Paul Natola > > > > ------------------------------ > > From: [email protected] > To: [email protected] > Subject: Re: [NTSysADM] MSIEXEC CPU on TS > Date: Tue, 20 Aug 2013 16:21:07 -0500 > > Is it enumerating printers local to the TS server or the workstation? > > > > *From:* J- P <[email protected]> > > *Sent:* Tuesday, August 20, 2013 4:13 PM > > *To:* [email protected] > > *Subject:* RE: [NTSysADM] MSIEXEC CPU on TS > > > > I get that, the issue is that when a user logs into TS, the minute they > try to print or print preview their first job (its a report from Access ) - > MSIExec hits 100% till the keys get enumerated, during that time ,everyone > on TS feels it and you know how it is to just watch the hour glass 3-4 > minutes seems like an eternity to the user waiting for it. > > > Can I just disable the server from even attempting to enumerate, the > option of upgrading to a new OS is not really viable at the moment. > > > > > > > > Jean-Paul Natola > > > > ------------------------------ > > From: [email protected] > To: [email protected] > Date: Tue, 20 Aug 2013 17:00:15 -0400 > Subject: RE: [NTSysADM] MSIEXEC CPU on TS > > Just put the GP in place and relax. You can’t manually get rid of them – > they just keep coming back. > > > > *From:* [email protected] [ > mailto:[email protected] <[email protected]>] *On > Behalf Of *J- P > *Sent:* Tuesday, August 20, 2013 4:56 PM > *To:* [email protected] > *Subject:* RE: [NTSysADM] MSIEXEC CPU on TS > > > > I did a manual delete of the hP key, and sure enough after logging into to > the TS when I went to do a "pdf preview" it hung for about 4 minutes- and > then about 11 new keys showed up > > > I'm open to options , users dont actually need to print over TS, but they > do require print preview for the PDF's they email- > > ROCK> me < HARD PLACE > > open to all suggestions > > thanks > > > > ------------------------------ > > From: [email protected] > To: [email protected] > Subject: RE: [NTSysADM] MSIEXEC CPU on TS > Date: Tue, 20 Aug 2013 15:54:06 -0400 > > Yes they are in HP gazillion > > Can you share your policy, did it delete before or after user logon/off > > And more importantly did it prevent MSIEXEC from shooting to 100 during a > new logon? > > > THANKS SO MUCH > > > > > > > > > > > > > > Jean-Paul Natola > > > > ------------------------------ > > From: [email protected] > To: [email protected] > Date: Tue, 20 Aug 2013 15:49:47 -0400 > Subject: RE: [NTSysADM] MSIEXEC CPU on TS > > IIRC, my problem is HP printers and they create gazillions of keys under > HKU\.Default\Software\HewlettPackard. > > > > I simply created a group policy object that deletes the whole > HKU\.Default\Software\HewlettPackard key. > > > > *From:* [email protected] [ > mailto:[email protected] <[email protected]>] *On > Behalf Of *J- P > *Sent:* Monday, August 19, 2013 4:21 PM > *To:* [email protected] > *Subject:* [NTSysADM] MSIEXEC CPU on TS > > > > I realize this is has been around for a while, but it seems that there > still has not been an actual fix for this, so i am asking if anyone has had > any successful work-arounds, besides upgrading the server > > > http://social.technet.microsoft.com/Forums/windowsserver/en-US/c16e01d6-4b64-4dad-ba8f-479c9fea85c0/high-cpu-usage-in-msiexec-due-to-enumeration-of-print-guids-in-hkudefaultsoftware > > I literally have thousands of these guids on the TS > > Environment, 2008 32 bit TS with Citrix fundamentals > > > Any thoughts are appreciated > > >
