Error of saving session XML File and Saving session error with Roaming profiles

[junk430]

Error of saving session XML File and Saving session error with Roaming profiles

[xomx]

@donho
If I understand it correctly, they are using Citrix terminal server with N++ installed only there (this is a bliss from the SW maintenance POV...). So the users' computers are just dumb terminals there, all their programs are installed and run on the terminal server side. And if the server is not from Dell, the Support Assistant should not be there either.

[xomx]

Is this the info you wanted to see

No no, the PRECEDING line:

[xomx]

@junk430
I have an idea how we could detect what is happening there.
There is already a debugging code for the relevant file output opening CreateFileW WINAPI call but currently it is activated only during the Windows OS shutdown/reboot/logoff phase:

notepad-plus-plus/PowerEditor/src/MISC/Common/FileInterface.cpp

Lines 77 to 85 in 6cd6aa3

	if (_hFile != INVALID_HANDLE_VALUE)
	{
	msg += " is opened.";
	}
	else
	{
	msg += " failed to open, CreateFileW ErrorCode: ";
	msg += std::to_string(::GetLastError());
	}

So you can try to:

• ensure that your installation of N++ has the nppLogNulContentCorruptionIssue.xml zero-sized logging-trigger file in the same dir, where the main notepad++.exe file is (yours seems to be "D:\Program Files\Notepad++\")
• launch single instance of the N++ (there is no need to have any files opened in it, but as you like)
• while the N++ is still running, initiate the Windows restart (or shutdown or logoff, as you like)
• after getting back to a Windows session, check for the %APPDATA%\Notepad++\nppLogNulContentCorruptionIssue.log file and post its content here, if working ok it should look like:

2024-06-03 17:16:27  WM_QUERYENDSESSION (lParam: 1 - ENDSESSION_CLOSEAPP) =====================================
2024-06-03 17:16:27  WM_ENDSESSION (wParam: TRUE, lParam: 1 - ENDSESSION_CLOSEAPP)
2024-06-03 17:16:27  C:\Users\USERNAME\AppData\Roaming\Notepad++\config.xml is opened.
2024-06-03 17:16:27  C:\Users\USERNAME\AppData\Roaming\Notepad++\config.xml  8898/8898 bytes are written.
2024-06-03 17:16:27  C:\Users\USERNAME\AppData\Roaming\Notepad++\config.xml is closed.
2024-06-03 17:16:27  C:\Users\USERNAME\AppData\Roaming\Notepad++\session.xml is opened.
2024-06-03 17:16:27  C:\Users\USERNAME\AppData\Roaming\Notepad++\session.xml  824/824 bytes are written.
2024-06-03 17:16:27  C:\Users\USERNAME\AppData\Roaming\Notepad++\session.xml is closed.
2024-06-03 17:16:27  WM_DESTROY (isEndSessionStarted == true)

---

One more thing - as you stated, your problem just have recently started. You connected it to a Windows upgrade. But for surety - do you by any chance having also the Dell Support Assistant SW installed on your computers (check if you have the C:\Program Files\Dell\SupportAssistAgent\SRE\SRE.exe on your disk)?

From approx. January, we have started to receive user complaints about missing N++ session.xml. It turns out that around this time this Dell SW was upgraded to a version that actively deletes also this N++ file, more on that e.g. here.

[junk430]

@xomx Correct. Citrix/Terminal Server, Virtual Apps deployment, Notepad++ instilled on Server 2019 terminal server users access.
I RDP'd into one of the servers, ran N++ and rebooted computer. I got the blue screen saying this app is preventing shutdown so I forced. Screen shot included

2023-10-27 10:04:01 WM_QUERYENDSESSION (lParam: 3221225472 - ENDSESSION_CRITICAL - ENDSESSION_LOGOFF) =====================================
2023-10-27 10:04:01 WM_ENDSESSION (wParam: TRUE, lParam: 3221225472 - ENDSESSION_CRITICAL - ENDSESSION_LOGOFF)
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml is opened.
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml 8120/8120 bytes are written.
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml is closed.
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\session.xml is opened.
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\session.xml 193/193 bytes are written.
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\session.xml is closed.
2023-10-27 10:04:02 WM_DESTROY (isEndSessionStarted == true)
2024-06-05 12:40:06 WM_QUERYENDSESSION (lParam: 3221225472 - ENDSESSION_CRITICAL - ENDSESSION_LOGOFF) =====================================
2024-06-05 12:40:06 WM_ENDSESSION (wParam: TRUE, lParam: 3221225472 - ENDSESSION_CRITICAL - ENDSESSION_LOGOFF)
2024-06-05 12:40:06 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml is opened.
2024-06-05 12:40:06 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml 8271/8271 bytes are written.
2024-06-05 12:40:06 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml is closed.
2024-06-05 12:40:06 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\session.xml failed to open, CreateFileW ErrorCode: 32

[xomx]

Perfect, it works, I will format the log for better readability:

2023-10-27 10:04:01 WM_QUERYENDSESSION (lParam: 3221225472 - ENDSESSION_CRITICAL - ENDSESSION_LOGOFF) =====================================
2023-10-27 10:04:01 WM_ENDSESSION (wParam: TRUE, lParam: 3221225472 - ENDSESSION_CRITICAL - ENDSESSION_LOGOFF)
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml is opened.
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml 8120/8120 bytes are written.
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml is closed.
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\session.xml is opened.
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\session.xml 193/193 bytes are written.
2023-10-27 10:04:02 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\session.xml is closed.
2023-10-27 10:04:02 WM_DESTROY (isEndSessionStarted == true)
2024-06-05 12:40:06 WM_QUERYENDSESSION (lParam: 3221225472 - ENDSESSION_CRITICAL - ENDSESSION_LOGOFF) =====================================
2024-06-05 12:40:06 WM_ENDSESSION (wParam: TRUE, lParam: 3221225472 - ENDSESSION_CRITICAL - ENDSESSION_LOGOFF)
2024-06-05 12:40:06 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml is opened.
2024-06-05 12:40:06 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml 8271/8271 bytes are written.
2024-06-05 12:40:06 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\config.xml is closed.
2024-06-05 12:40:06 \hometown.local\UserFolders\FolderRedirection\Jack.Hanna\AppData\Roaming\Notepad++\session.xml failed to open, CreateFileW ErrorCode: 32

Here is the relevant info for the ErrorCode 32:
ERROR_SHARING_VIOLATION - The process cannot access the file because it is being used by another process.

Edited:
And look into the log - there are two instances of the N++ app Sorry, the correct first one is from the previous year.

The log says that the N++ session.xml file is already being used by someone else and it cannot be another N++ instance as the N++ uses dwAccessParam = GENERIC_READ | GENERIC_WRITE and dwShareParam = FILE_SHARE_READ | FILE_SHARE_WRITE, so even with multiple Notepads++ trying to write to that file at the same time it should proceed... Moreover the N++ design allows only the 1st N++ instance running to save to that session.xml file at its exit.

It looks like that some other process than N++ on that terminal server has opened the N++ session.xml file with exclusive access rights.

[xomx]

@junk430

To identify the culprit:

• launch the N++
• launch the Windows Resource Monitor app
• switch to its "CPU" tab
• input the "session.xml" in to the "Search Handles" edit field in the "Associated Handles" and wait for the search to complete

[junk430]

Very interesting..
I tried several times searching for session.xml with Notepad++ open. I even closed Notepad++ in order to generate the error but still nothing shows up in the search for session.xml.
I've also noticed I can't reproduce this in my QA environment that "should" be the same as my prod. Same OS, Citrix, ect.
I'm having a look in PowerTools to see if I can capture anything and I know I've used some apps in the past that would log all changes/IO ect from apps or to files ect.. let me see if I can find something like that.
Wanted to add, thanks so much for your time and help!

[donho]

@junk430
Could you check if %APPDATA%\notepad++\session.xml is read-only for your users?

[junk430]

The file was created by the user when Notepad++ was run. session.xml is owned by the user and has full control on the file.

[junk430]

Thanks for the reply!
I'll work on getting this ASAP.
This does seem related to upgrading the Citrix servers from 2012R2 to 2019. We also have CIS security policy mandated. So it's possible something in there could be causing this.. but N++ is initially creating this file correct so it has R/W..
We do not use Dell servers.

[donho]

@junk430

We do not use Dell servers.

It's not about Dell Server but Dell's laptop/computer.
If your company use Dell's computers/laptops, SupportAssist could be installed by default in your users laptops/computer, and it causes the session saving problem.

[junk430]

I might have something.. I used Process Monitor to capture a log while I open and close N++. I can see it open cleanly but when closing there are file errors. I'm not sure if a screen cap with info redacted will help.
The both are filtering sessions.xml. The first one is when N+ is opened. The 2nd pic is after it's closed.
See if this works. this WYSIWYG editor keeps adding 3 pictures at a time.

[xomx]

@junk430
Good, I would recommend the ProcMon to you myself.

but when closing there are file errors

If you mean that BUFFER OVERFLOWs, it is most probably ok. These usually means that a process/call requests some data whose length it does not know beforehand (e.g. you start with some initial buffer size, if it is too small, this BUFFER OVERFLOW status is returned along with the current buffer size needed, and the process/call can reissue the request but now with the correct buffer size, this is a common programming pattern in the WIN32 API world). And before your log line with the BUFFER OVERFLOW is visible some QueryDeviceInfo op...

Use these ProcMon filters only and watch:

[junk430]

[junk430]

I'm still checking the config between QA and Prod but I'm not seeing a difference. I'll see if I can reproduce this in a test environment.

[xomx]

@junk430

This is what I've got when I just opened & closed my testing N++, no such problem visible:

From you log-pic is visible that the session.xml CreateFile is used there with different params than mine (Delete, Write DAC...).
Could you show us also the detail of the line preceding the one with the SHARING VIOLATION visible?

We have folder redirection set to a network share

What network storage is used for your folder redirection? (format of the drive, is it a heterogeneous *nix storage, etc...?)

I cannot reproduce your problem even when I redirected my %APPDATA%\Roaming\ to another disk (tested with some local exFAT and NTFS drives, but not with a network drive).

[junk430]

Again thanks so much for your effort.
Is this the info you wanted to see. If not let me know. I wish this was a system where I could upload the capture but that's not possible and I can't reproduce it in my QA env.
The only thing I can think that is different is how the Roaming profiles are redirected. 1 is using a User setting and the other a Computer setting in Group Policy. Let me see if I can configure my test env like this one and reproduce the error.

The redirect is to a SMB share on a Windows server NTFS formatted drive. Permissions set per the MS doc that outlines Roaming Profile shares. The profiles are being redirected using Group Policy with Citrix Profile management added. Or at least feels like it could be related.