7th Novermber 2016
Webroot Antivirus causing login issues on remote desktop/terminal servers.
The Winlogon processes will lock-up due to webroot and you will be able to see this as event 4005.
Webroot are currently diagnosing the issue but do not have a permanent solution at this stage, the work around is to uninstall and install an older version of webroot.
Create a global policy that has the auto-update feature turned off (Basic Configuration > Automatically download and apply updates), apply this to the impacted server.
Uninstall Webroot from the server from the Webroot console by using the Agent Commands menu and selecting Agent > Uninstall
This may take a few minutes to complete. Retry if agent hasn’t uninstalled after 5 minutes.
Install version 8 of Webroot with the following switches:
Grab the key from the clients Webroot portal