Event ID 3004 — Windows Startup Availability

  • Article

Applies To: Windows Server 2008 R2

Windows startup availability checks whether the system is able access the boot sector on the system disk. This boot sector, which can be managed either by the basic input/output system (BIOS) or Extensible Firmware Interface (EFI), then loads the rest of the boot blocks. The boot sector loads the Windows Boot Manager, which accesses the Boot Configuration Data store and uses the information to run all of the processes and services required to start the operating system after the computer is switched on. 

Event Details

Product: Windows Operating System
ID: 3004
Source: Microsoft-Windows-Wininit
Version: 6.1
Symbolic Name: EVENT_SETUP_LSA_STALL
Message: Windows start-up process has failed to synchronize with the local security subsystem during setup.

Resolve

Check the availability of the Local Security Authority Subsystem Service (LSASS)

During Windows startup, Windows starts the services that are necessary for the operating system to function properly. The Local Security Authority Subsystem Service (LSASS) must be running to enable users to log on to the computer. If this service fails to start, the computer will not complete the Windows startup process and you will need to start your computer in Safe Mode to try to determine the cause of the problem. Starting your computer in Safe Mode starts Windows with a limited set of files and drivers. Startup programs do not run in Safe Mode, and only the basic drivers needed to start Windows are enabled.

To perform these procedures, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

Start in Safe Mode

To start in Safe Mode:

  1. Press and hold F8 as your computer restarts.
  2. If your computer has more than one operating system, use the arrow keys to select the operating system that you want to start in Safe Mode, and then press F8. 
  3. On the Advanced Boot Options screen, use the arrow keys to select the Safe Mode option you want, and then press ENTER.

Check the availability of LSASS

To check the availability of LSASS:

  1. Click Start, point to Administrative Tools, and then click Event Viewer.
  2. Open the Application event log, and find the entry for the lsass.exe service that corresponds to the logon event that failed to complete.
  3. Verify that the service was able to start properly and that known virus variants such as lsasss.exe and lsassa.exe are not starting as well. If virus variants are present, run an up-to-date antivirus program on the system to remove the virus and then attempt to start Windows normally.

Verify

To verify that the Windows startup availability process completed successfully after logging on, check the Event Viewer to verify all system processes and services designated to run at startup are set up and synchronized properly.

  1. Click Start, point to Administrative Tools, and then click Event Viewer.
  2. In the Event Viewer (Local) pane, double-click Windows Logs.
  3. Select the System log. A white exclamation point in a red circle indicates that a service or driver is stopped or has failed to start. A black exclamation point in a yellow triangle indicates warnings, such as low disk space. For more information about an entry, click the entry, and read the General tab.

Windows Startup Availability

Core Security