Systems Management

Upgrading our agents from 12.x to 13.x has seen a high level of instances where C:\Windows\System32\KUsrInit.exe breaks in two ways:

1. Instead of copying down the executable, an empty directory named KUsrInit.exe is created instead.
2. The executable is copied down, but it is not really the Kace application. Inspecting the properties of the file reveals a different product name. Usually it's 'Microsoft Edge Installer'. Sometimes it's a .NET Runtime installer or something similar.

Int other many instances, we also have a registry problem The HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit registry key still points to C:\Windows\System32\Userinit.exe, and the KUsrInitReplaced key is not created at all. We are not using the NOHOOKS argument during installation. I have not identified any cause or pattern to this behavior. It happens with upgrades from 12.x to 13.x, and also with upgrades within 13.x (13.1.23 -> 13.2.23).

The impact to the user is either being logged out of Windows as soon as they log in, or logging in and getting a black screen because the desktop environment is not initializing. I have a ticket open with our vendor, but it's been a slow ride and I'm interested to see if anyone else has been experiencing the same problems.