Admin Tips
- Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base
  - Windows NT
    - Admin Tips
      - Logon
        Winlogon bug

Section(s): Logon
Published on Apr 20, 2004.
Last Modified on Apr 20, 2004.
Last Modified by Wayne Maples.
Rated 2.3 out of 5 based on 4 votes.

If you modify a user account and remotely shut down the system that contains the account, you will lose the local account changes. During a remote shutdown, NT doesn't notify the Local Security Authority (LSA) module that a shutdown is pending. The LSA fails to flush the database cache to disk at shutdown. Its a timing issue. Given enough time LSA will write the modification to disk. The immediate shutdown causes the problem. This bug in Winlogon has been fixed. Microsoft updated the Winlogon code to inform LSA of a remote shutdown to ensure that account changes are flushed to disk. You can obtain the bug fix from Microsoft Support.