I have a straight up RDSH environment, everyone logs in and gets a full desktop. Lately we have been dealing with a rash of events whereby the Group Policy Client service crashes. Once it crashes, none of the users can log in on that host. They get a message Windows could not connect to the Group Policy Client service.
Rebooting the server brings the services back online, and the server generally is available till the next day, when the GPC is back down, the option to restart the service is greyed out.
We have scanned the volume for malware using MSE, and MalwareBytes, which found nothing
Performed a sfc /scannow which reported that all files were correct.
We have run all windows updates. When the GPC service fails, the only event in the eventlogs seems to be this entry
the winlogon notification subscriber <GPClient> was unavailable to handle a critical notification event
We had normally responded to system failures by spinning up additional servers, but the problem seems to not be related to how long the image has been in service. We did have some evidence that MRT did indeed remove a cridex.B from some of the servers, this one included.
Is there any logs I should be reading, other than the mrt.log file, that might give me more information about what is causing the service to become unresponsive?
one of the good guys