| Event Id | 4004 |
| Source | Microsoft-Windows-Winlogon |
| Description | The Windows logon process has failed to terminate currently logged on user's processes. |
| Event Information | According to Microsoft : Cause : This event is logged when Windows logon process has failed to terminate currently logged on user's processes. Resolution : Restart the system During Windows logon switching, Windows logon will prepare the desktop for the user that has attempted to log on. If an error is encountered that prevents the setup of the desktop, the service will keep trying to switch the desktop until it succeeds. If it is unable to succeed, the system will be in an unusable state and must be restarted. If the system has become completely unresponsive to user input, then the system will have to be shut down by interrupting the power supply to the computer for sufficient time to allow the system to completely shut down. Verify :To verify that Windows logon switching is functioning correctly, observe one or more of the following processes: An account is able to log on to the local computer or to the domain. An account is able to log on during the hours of the day that the account has been granted access. An account is able to log on to the computer with a valid license. A user can press CTRL+ALT+DELETE to log on to the computer or log off from the computer. A user can log on as another user from the desktop by using Fast User Switching. Note: Fast User Switching is a method to change users on a computer without closing programs and files first. It is installed and enabled by default on computers running Windows Vista operating systems. To verify that Fast User Switching is operational: 1.Click Start, and then click the arrow next to the lock button. 2.Click Switch User, and then click the user you want to switch to. |
| Reference Links | Event ID 4004 from Microsoft-Windows-Winlogon |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.