Event ID 4006 — Windows Logon Availability

  • Article

Applies To: Windows Server 2008 R2

Windows logon availability determines whether the Windows logon process is able to be completed successfully. The logon process is the interface between the account for a user, process, or service and the computer that establishes authenticated credentials for the account and allocates the appropriate system and network resources. Windows logon manages the use of the secure attention key (CTRL-ALT-DELETE) to initiate the login screen, load the user profile on logon, and lock the computer.

Event Details

Product: Windows Operating System
ID: 4006
Source: Microsoft-Windows-Winlogon
Version: 6.1
Symbolic Name: EVENT_CREATE_PROCESS_FAILURE
Message: The Windows logon process has failed to spawn a user application. Application name: %1. Command line parameters: %2.

Resolve

Make more resources available on the system

During Windows logon, the operating system opens the subscriber notification database and starts the user-level processes so that user accounts can log on to the system. If there are inadequate system resources for Windows logon to do this, the system may start with limited functionality.

To identify the applications or services that are using too many system resources, you can generate a System Diagnostics report by using the Reliability and Performance Monitor.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To make more resources available on the system:

  1. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Type perfmon /report and press ENTER. The Reliability and Performance Monitor will start collecting data to create the System Diagnostics report.
  3. When the report is ready for viewing, locate the Diagnostic Results section of the report, and check for any Warnings. You can follow links to additional help on resolving warnings from this section. In addition, you can expand each category in the Basic System Checks section to see more details about why warnings appear. The Performance section of the report provides process-level detail about applications or services that are using the most resources.
  4. Identify the applications or services that are not required.
  5. Click Start, and type msconfig.exe to open System Configuration. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
  6. Click the Service tab, clear the check box next to the names of the services that you want to disable, and then click Apply. If you do not know which services you require at startup, note the services that are currently configured to start and then click Disable all to disable all services.
  7. Click the Startup tab, clear the check box next to the names of the programs that you want to disable, and then click OK. If you do not know which programs you require at startup, note the programs that are currently configured to start and then click Disable all to disable all programs.
  8. Restart the computer.

Verify

To verify that Windows logon is functioning correctly, observe one or more of the following processes:

  • An account is able to log on to the local computer or to the domain.
  • An account is able to log on during the hours of the day that the account has been granted access.
  • An account is able to log on to the computer with a valid license.
  • A user can press CTRL+ALT+DELETE to log on to the computer or log off from the computer.

Windows Logon Availability

Core Security