Graceful Logoff from a Published Application Renders the Session in Active State

When publishing an application, only the main executable file is specified. However, some applications might spawn additional processes that run in the background and are not closed by the corresponding main executable file. Additional processes might also be created, from scripts that are executed, or from specific registry keys, such as the RunOnceKey:


Some processes might create a visible window for added functionality, and others might not.

Because the Explorer.exe Desktop is not running when launching an application in one of these ways, there is no default mechanism in either Presentation Server or Windows to terminate these background processes when a user has exited the main application.

Presentation Server has a hard coded list of what are considered ‘System’ type secondary processes that are checked for and terminated once all user application processes have terminated, these include:

  • atok1*.exe

  • clipsrv.exe

  • conime.exe

  • csrss.exe

  • ctfmon.exe

  • ddhelp.exe

  • eventlog.exe

  • iatokik*.exe

  • iatokqb*.exe

  • iatqb1*.exe

  • ibdbsch.exe

  • imejp98m.exe

  • imejpmgr.exe

  • imepadsv.exe

  • jsvschvw.exe

  • lmsvcs.exe

  • lsass.exe

  • msgsvc.exe

  • nddeagent.exe

  • nddeagnt.exe

  • netdde.exe

  • netstrs.exe

  • os2srv.exe

  • proquota.exe

  • screg.exe

  • smss.exe

  • spoolss.exe

  • ssonsvr.exe

  • wfshell.exe


  • winlogon.exe

  • wpabaln.exe

  • wuauclt.exe

Note: To specify additional processes specific to your environment, see the Solution section of this article.

Examples of Secondary Processes

CTX123073 ‑ ICA Session Remains Active for Five Minutes when Streaming to Server with the Version 5.2 Offline Plug-in

Cwbprovd.exe is a process initiated by IBM Client Access. If you have IBM Client Access on your system and observe the same behavior as stated above, complete the following tasks:

  1. Verify the sessionID, which is experiencing this issue.

  2. Before logoff, type the following command from the command prompt to manually kill Cwbprovd.exe:

    kill cwbprovd.exe session id

  3. Gracefully exit the published application.

    The Cwbprovd.exe process (among two other processes) is being launched at logon by IBM Client Access (even if you do not run it) through the following registry key:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit

    Contact IBM for a utility called CWBCFWTS to remove these processes from the registry.

    Note: Servers running IBM’s Client Access Express ARE NOT known to exhibit this behavior.

Proquota.exe is a process initiated by having a Windows 2000 policy, Limit Profile Size, enabled. This might conflict with the Seamgr.exe process. Manually terminating either of these two processes temporarily fixes the problem and allows the session to reset. This issue is resolved by installing Service Pack 2 for MetaFrame 1.8 for Windows 2000.

Sxplog32.exe is a process initiated by the Software Delivery Agent by Computer Associates and can be found in the userinit value of the winlogon registry key. Manually terminating the process temporarily fixes the problem and allows the session to reset.

Etlits.exe and Entell50.exe are processes initiated by Entrust 6.1 and can be found in the userinit value of the winlogon registry key. Manually terminating the process temporarily fixes the problem and allows the session to reset.

Wisptis.exe is a process that runs as a system service that provides pen-data collection for other components of the SDK. When a component needs to interact with the pen (for example, to collect ink or to detect gestures), this executable is spawned as a service to communicate directly with the input device. On a Tablet PC, Wisptis.exe interacts with the digitizer, whereas on a desktop it interacts with the mouse as well. The executable’s name is an acronym that references an outdated internal name for the team that developed it (Windows Ink Services Platform Tablet Input Subsystem). You cannot remove wisptis.exe by renaming or deleting it: Windows File Protection would reinstall the file the next time Adobe Acrobat 6.0 started. In general, the ways in which wisptis.exe can get installed on the system are by installing Journal Viewer using the Windows Update or installing Microsoft Office 2003.


If a starting program was specified under the Environment tab in the User Account Properties and if the ICA pass-through Client had pass through authentication enabled, Ssonsvr.exe was running in the ICA session of the user. When the user exited the application (specified in the Environment tab in User Account Properties), the ICA session could not be logged off; the administrator had to manually stop the Ssonsvr.exe process. The thread that caused the Ssonsvr.exe process to exit when the user logged off from the application was not being started.

Now the thread that causes the Ssonsvr.exe process to exit is started when the user logs off from the application.

From Hotfix XE103W2K030:



Leave a Reply