For this situation the setup consisted of four Windows Server 2012 R2 servers running Citrix XenApp 7.15. They host a desktop as well as several published applications.
Recently I had multiple users with disconnected sessions that just would not log off. I suspect the server was running into resourcing issues as there was a high number of sessions on there previously. As a result, these hung sessions meant that they could no longer launch the hosted shred desktop or any of the published applications. The usual course of action in this case is to reboot the server when appropriate however these users needed access sooner rather than later and I couldn’t reboot whilst other users are logged on to those same production servers.
I worked out a way around this and documented the steps below.
These are the offending sessions (below). The same processes hung within each one. Winlogon.exe appears to be the culprit. Attempting to end these via task manager doesn’t work and with taskkill results in – This is critical system process. Taskkill cannot end this process.
Log on to the affected XenApp server and run qwinsta from an elevated command prompt to find the session ID of the disconnected sessions (disc state). Note no username against the session.
Run query process /ID:[session_id] to get the PID of the hung winlogon.exe process within that session.
At this point I tried taskkill /f /t however this didn’t work.
Switching to powershell and using kill –id [PID] does the job effectively.
You can see that there are no longer any process running within that session.
I did this for all disconnected sessions.
I attempted a logoff however the sessions no longer exist, the entries in task manager must just be blank placeholders for the old sessions.
I closed and reopened task manager to confirm and sure enough the sessions disappeared.
I checked in with the users and there were able to launch published applications successfully again.
Hopefully someone finds this useful. Any comments welcome.