There are apparently a variety of things that can cause the winlogon.exe process on Windows PCs to consume all available CPU, but I’ve found few references to this cause – corruption in Offline Files, even when Offline Files is disabled on the PC, on the server and on the domain (via Group Policy). Depending on the age of the PC, this will consume either 50% of the CPU (on newer dual-core systems) or 100% of the CPU (on older systems). This is the only non-malware winlogon.exe problem that I recall personally encountering.
Update: The original title & article indicated that this applied to Windows PCs on domains only, but Offline Files is available to non-domain PCs as well as long as Fast User Switching is not turned on.
I haven’t gone through to track exactly what’s causing the problem, just identified it as an Offline Files problem. We disable Offline Files for systems we’re configuring so individual PCs shouldn’t be caching them, but every once in a while a Windows XP box will decide that it needs to be doing something. The symptoms can include either all available disk space being consumed by the C:\Windows\CSC (technically, %windir%\CSC) or winlogon.exe going into a loop that interferes with use of the system.
While Microsoft provides instructions and a mechanism to Re-initialize the offline files cache and database, following those instructions has never worked for me – possibly because the systems I’m encountering are having problems despite Offline Files being disabled.
For me, the solution has been to do the unthinkable, go against all available instructions, and simply delete the entire contents of the C:\Windows\CSC directory (from Safe Mode if necessary).
Reportedly deleting the CSC folder’s contents breaks Offline Files in ways that can’t be recovered from, but that’s not a concern for me because we aren’t using that feature and have no expectation of doing so (also, I suspect that it actually is possible to recover from this without having to reinstall Windows – possibly as easily as dropping from the Domain & rejoining). We have very few users with laptops, even fewer that need access to office files on laptops while outside the office, and none where having patient information on local laptop drives outside the office is a good idea.[contact-form-7 404 "Not Found"]