Windows Logon Availability

Applies To: Windows Server 2008

Windows logon availability determines whether the Windows logon process is able to be completed successfully. The logon process is the interface between the account for a user, process, or service and the computer that establishes authenticated credentials for the account and allocates the appropriate system and network resources. Windows logon manages the use of the secure attention key (CTRL-ALT-DELETE) to initiate the login screen, load the user profile on logon, and lock the computer.

Events

Event ID Source Message

1002

Microsoft-Windows-Winlogon

The shell stopped unexpectedly and %1 was restarted.

4002

Microsoft-Windows-Winlogon

The logon hours restriction policy is applied to the logged on user. The user's session has been locked, disconnected or logged off depending on the policy setting. User Name: %1 Domain Name: %2

4003

Microsoft-Windows-Winlogon

The Windows logon process has failed to switch the desktop.

4005

Microsoft-Windows-Winlogon

The Windows logon process has unexpectedly terminated.

4006

Microsoft-Windows-Winlogon

The Windows logon process has failed to spawn a user application. Application name: %1. Command line parameters: %2.

4101

Microsoft-Windows-Winlogon

Windows license validated.

6000

Microsoft-Windows-Winlogon

The winlogon notification subscriber <%1> was unavailable to handle a notification event.

6001

Microsoft-Windows-Winlogon

The winlogon notification subscriber <%1> failed a notification event.

6002

Microsoft-Windows-Winlogon

The winlogon notification subscriber registration database cannot be loaded. Culprit: <%1>.

6003

Microsoft-Windows-Winlogon

The winlogon notification subscriber <%1> was unavailable to handle a critical notification event.

6004

Microsoft-Windows-Winlogon

The winlogon notification subscriber <%1> failed a critical notification event.

Windows Logon

Core Security