Stuck profile/Ghost profile

-Logon to the RDS where the ghostuser (4) is happening and start taskmgr

-Go to users > expand (4) user proceses en rightclick “Windows logon application” > select “go to details”

-You will go to the winlogon.exe proces in the detail tab for this user. Rightclick winlogon.exe en select “analyze wait chain “

-There you will see a svchost process with a particular PID. Remember that PID

-Unfortunately, you can’t kill the svchost PID with taskmgr. Use Process explorer (sysinternals) and run it as admin. Search for the corresponding svchost PID en kill the process.

-After that is done the ghostuserlogon will be killed without a reboot


If there is no processes under the user then try the following

From command line run:

qwinsta

From here you will see a line with a blank username but the status will be “disc”. Short for disconnected. Next to “disc” will be a number like “91”

 run “query process /ID:yourid” no quotes and with the number from the first line

query process /ID:91

This will then give you the PID of the winlogon.exe which you can view in task manager to find the svchost process

Leave a Reply