tblAutorun table growing alarmingly quickly

[sticky]

Hi,

I've just noticed that the 'tblAutorun' table in the lansweeper database is now the biggest table in our database server! And still growing 100Mb/day or so... currently the size is about 1.8Gb.

We have ~6,000 machines in lansweeper. Even so, I wouldn't have thought there would be enough things in the startup folders/run registry locations across all these computers to warrant a table of that size.

Looking at the table, I can see that a lot of our computers have literally thousands of records in this table - one machine has 18,072!

Looking closer at the entries, it looks like every system file on the machine has been added as being in the location 'startup', under the users NT AUTHORITY\SYSTEM and .DEFAULT. Here's a sample of the entries in the tblAutorun table:

145814926	IT041357	mciseq	mciseq.dll	Startup	NT AUTHORITY\SYSTEM	2009-05-13 09:54:41.170
145814928	IT041357	mciseq	mciseq.drv	Startup	NT AUTHORITY\SYSTEM	2009-05-13 09:54:41.170
145814930	IT041357	mciwave	mciwave.dll	Startup	NT AUTHORITY\SYSTEM	2009-05-13 09:54:41.170
145814932	IT041357	mciwave	mciwave.drv	Startup	NT AUTHORITY\SYSTEM	2009-05-13 09:54:41.170
145814934	IT041357	mdhcp	mdhcp.dll	Startup	NT AUTHORITY\SYSTEM	2009-05-13 09:54:41.170
145820474	IT041357	napstat	napstat.exe	Startup	.DEFAULT	2009-05-13 09:54:47.717
145820475	IT041357	narrator	narrator.exe	Startup	.DEFAULT	2009-05-13 09:54:47.733
145820476	IT041357	narrhook	narrhook.dll	Startup	.DEFAULT	2009-05-13 09:54:47.750
145820477	IT041357	NavLogon	NavLogon.dll	Startup	.DEFAULT	2009-05-13 09:54:47.750
145820478	IT041357	nbtstat	nbtstat.exe	Startup	.DEFAULT	2009-05-13 09:54:47.763

Is this a bug or normal operation? I'm hoping a bug as I'm getting nervous about how quickly it is growing! As it is I'm going to set up a maintenance task to remove any entries in the 'startup' location.

Thanks
Michael

[sticky]

Oh and yeah, that reg key was definitely the problem. I set it to a blank folder on a number of machines and triggered a manual scan - the number of autorun entries dropped from thousands to less than 20.

[sticky]

lol yeah figured that out :-).

Since doing this, my lansweeper server is behaving much better. Before having to process all that data cpu usage was typically 80-100%. Now it's a much more sensible 2-5%!

Thanks for your help.

[Hemoco]

Could you confirm that the "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" setting was indeed the problem.

[sticky]

That's true, although if you know about the issue and the problems it can cause - you can now program around it so that the effect of the problem is mitigated. Even if you just drop the query if it returns too many results.

For now I want to disable collecting the Autorun information. Using a GPO to set the registry key is going to take some time to get approval to do etc (and even then probably isn't going to happen!). If I set the AUTORUN 'scan every X days' to 0 I guess I can stop it updating, but is there a way to prevent lansweeper from collecting the autorun information at all?

[Hemoco]

sticky wrote:
If I set the AUTORUN 'scan every X days' to 0 I guess I can stop it updating, but is there a way to prevent lansweeper from collecting the autorun information at all?

Don't set it to 0 !!!!
because it will update every time.

Preventing to collect information will be in the next version.

For now you can set it to a really high number.

[Hemoco]

Technically speaking WMI is reporting the correct information because this setting is not correct on the computers.
This might also problems in other software and slower boot times.

I suggest changing this on your pc's with a GPO or startup script.

[sticky]

Ok but I still have the issues that approx 2,000 machines are exhibiting this problem. So you're saying I have to do this on every one of them and then monitor for new machines that exhibit the same problem so that I can apply the 'fix' to them as well??

I'm sorry, but a client-based solution isn't really going to work for me here as it is unmanageable. I'd rather lansweeper have some logic in it that says if an unrealistic number of results are returned (e.g. 100), then it ignores the data. Or ignore any results that appear to be windows system32 files in the 'startup' location.

[Hemoco]

You don't need to reinstall WMI:

"HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" has no value or points to a non-existent folder then the problem described above occurs. This folder can be pointed to a dummy folder that is empty to prevent this problem or you can set this value to:

"C:\Documents and Settings\Default User\Start Menu\Programs\Startup"

[sticky]

Thanks but it looks like the resolution in that thread was to reinstall WMI... which isn't really an option for me on all my devices!

You mentioned there that you fixed the problem in runscanner. Are you intending to fix this in Lansweeper also? Or has the fix already been done and I just need to clear out my db? Although I'm guessing not, as I'm running the latest version and the table is still getting larger very quickly...