+1 I would have never figured that one out...
From: [email protected] [mailto:[email protected]] On Behalf Of Andrew S. Baker Sent: Monday, August 26, 2013 8:25 AM To: ntsysadm Subject: Re: [NTSysADM] MSIEXEC CPU on TS-Solved Thanks for following up. That was a very good find. ASB http://XeeMe.com/AndrewBaker<http://xeeme.com/AndrewBaker> Providing Virtual CIO Services (IT Operations & Information Security) for the SMB market... On Sat, Aug 24, 2013 at 7:12 PM, J- P <[email protected]<mailto:[email protected]>> wrote: Ok, so after looking at thousands of procmon lines , I finally figured out what was causing it- This is not the normal bug thats been around , but it did relate to an HP printer. What tipped me off was the spools process not doing anything other than "process profiling" no regquery no create , no file create and no imagepath , So I ran procmon on a desktop and there it was, Spoolsv.eve doing what it should be , RegOpen, FileSystemControl, Regcreate, etc..... "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider\Servers\Print_Server\Printers\{3B2A2A60-72A2-4B70-99F3-1FE3E72FDB85}\PrinterDriverData HKCU\Printers\Connections\,,Print_Server_Name,Shared_Printer_Name and heck of alot more entries- Evidently the genius writing the front end of the DB decided to make some upgrades (without telling anyone), like hardcoding default printers for various reports, queries etc.. and since said printers did not exist on Box , thats when MSIExec would kickoff and attempt the installation of the HP Printers. After installing ALL the printers on the box, print previews take about 1 second to load, and no MSIexec. This will be one costly lesson to the client :) as I spent quite sometime on this. Thanks to everyone for all the feedback. And now time for some cognac Thanks again Jean-Paul Natola ________________________________ From: [email protected]<mailto:[email protected]> To: [email protected]<mailto:[email protected]> Date: Thu, 22 Aug 2013 08:25:47 -0400 Subject: RE: [NTSysADM] MSIEXEC CPU on TS Not local to the Citrix server, local to the RDP or Citrix client. From: [email protected]<mailto:[email protected]> [mailto:[email protected]<mailto:[email protected]>] On Behalf Of Daniel Chenault Sent: Wednesday, August 21, 2013 11:14 PM To: [email protected]<mailto:[email protected]> Subject: Re: [NTSysADM] MSIEXEC CPU on TS Ahhhh... okay. Major bummer. If this is only for local attach printers then the only solution I see until MS issues a patch is for the RDP/Citrix server to not have any local attach printers. From: J- P<mailto:[email protected]> Sent: Wednesday, August 21, 2013 3:20 PM To: [email protected]<mailto:[email protected]> Subject: RE: [NTSysADM] MSIEXEC CPU on TS think I may have stumbled onto something,I have afew 1000 of these, however, they are not identical they seem to increment and all result in "NO MORE ENTRIES" HKU\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32 HKU\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB} HKU\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32 HKU\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA} Jean-Paul Natola ________________________________ From: [email protected]<mailto:[email protected]> To: [email protected]<mailto:[email protected]> Date: Wed, 21 Aug 2013 13:44:16 -0400 Subject: RE: [NTSysADM] MSIEXEC CPU on TS That's not the problem. What happens is that whenever a remote user (either citrix or RDP) prints (or logs on, I forget), the local printers FOR ALL LOGGED IN USERS get GUIDs assigned that are unique for that user's session. The stupid HP print drivers (maybe other too) create keys under HKU\.Default\Software\Hewlett-Packard corresponding to ALL THESE GUIDS. This rapidly results in thousands of keys. For some reason, msiexec.exe likes to fully traverse that key OVER and OVER and OVER resulting in msiexec using 100% of one CPU AND msiexec taking forever to get anything done. From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of Daniel Chenault Sent: Wednesday, August 21, 2013 12:53 PM To: [email protected]<mailto:[email protected]> Subject: Re: [NTSysADM] MSIEXEC CPU on TS Maybe I'm missing something or need more coffee... Set up a group of the RDP users. Deny those users access to those printers using the printer properties Security tab. From: J- P<mailto:[email protected]> Sent: Tuesday, August 20, 2013 4:29 PM To: [email protected]<mailto:[email protected]> Subject: RE: [NTSysADM] MSIEXEC CPU on TS on the TS box itself- I guess disabling MSIExec wouldn't help either I'm up to 27 new guids in the last hour Jean-Paul Natola ________________________________ From: [email protected]<mailto:[email protected]> To: [email protected]<mailto:[email protected]> Subject: Re: [NTSysADM] MSIEXEC CPU on TS Date: Tue, 20 Aug 2013 16:21:07 -0500 Is it enumerating printers local to the TS server or the workstation? From: J- P<mailto:[email protected]> Sent: Tuesday, August 20, 2013 4:13 PM To: [email protected]<mailto:[email protected]> Subject: RE: [NTSysADM] MSIEXEC CPU on TS I get that, the issue is that when a user logs into TS, the minute they try to print or print preview their first job (its a report from Access ) - MSIExec hits 100% till the keys get enumerated, during that time ,everyone on TS feels it and you know how it is to just watch the hour glass 3-4 minutes seems like an eternity to the user waiting for it. Can I just disable the server from even attempting to enumerate, the option of upgrading to a new OS is not really viable at the moment. Jean-Paul Natola ________________________________ From: [email protected]<mailto:[email protected]> To: [email protected]<mailto:[email protected]> Date: Tue, 20 Aug 2013 17:00:15 -0400 Subject: RE: [NTSysADM] MSIEXEC CPU on TS Just put the GP in place and relax. You can't manually get rid of them - they just keep coming back. From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of J- P Sent: Tuesday, August 20, 2013 4:56 PM To: [email protected]<mailto:[email protected]> Subject: RE: [NTSysADM] MSIEXEC CPU on TS I did a manual delete of the hP key, and sure enough after logging into to the TS when I went to do a "pdf preview" it hung for about 4 minutes- and then about 11 new keys showed up I'm open to options , users dont actually need to print over TS, but they do require print preview for the PDF's they email- ROCK> me < HARD PLACE open to all suggestions thanks ________________________________ From: [email protected]<mailto:[email protected]> To: [email protected]<mailto:[email protected]> Subject: RE: [NTSysADM] MSIEXEC CPU on TS Date: Tue, 20 Aug 2013 15:54:06 -0400 Yes they are in HP gazillion Can you share your policy, did it delete before or after user logon/off And more importantly did it prevent MSIEXEC from shooting to 100 during a new logon? THANKS SO MUCH Jean-Paul Natola ________________________________ From: [email protected]<mailto:[email protected]> To: [email protected]<mailto:[email protected]> Date: Tue, 20 Aug 2013 15:49:47 -0400 Subject: RE: [NTSysADM] MSIEXEC CPU on TS IIRC, my problem is HP printers and they create gazillions of keys under HKU\.Default\Software\HewlettPackard. I simply created a group policy object that deletes the whole HKU\.Default\Software\HewlettPackard key. From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of J- P Sent: Monday, August 19, 2013 4:21 PM To: [email protected]<mailto:[email protected]> Subject: [NTSysADM] MSIEXEC CPU on TS I realize this is has been around for a while, but it seems that there still has not been an actual fix for this, so i am asking if anyone has had any successful work-arounds, besides upgrading the server http://social.technet.microsoft.com/Forums/windowsserver/en-US/c16e01d6-4b64-4dad-ba8f-479c9fea85c0/high-cpu-usage-in-msiexec-due-to-enumeration-of-print-guids-in-hkudefaultsoftware I literally have thousands of these guids on the TS Environment, 2008 32 bit TS with Citrix fundamentals Any thoughts are appreciated
