Event ID - 4005

Event Id4005
SourceMicrosoft-Windows-Winlogon
DescriptionThe Windows logon process has unexpectedly terminated.
Event InformationAccording to Microsoft :
Cause :
This computer does not have adequate system resources
Resolution :
Make more resources available on the system
During Windows logon, the operating system opens the subscriber notification database and starts the user-level processes so that user accounts can log on to the system. If there are inadequate system resources for Windows logon to do this, the system may start with limited functionality.
To identify the applications or services that are using too many system resources, you can generate a System Diagnostics report by using the Reliability and Performance Monitor.
To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.
To make more resources available on the system:
  1. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Type perfmon /report and press ENTER. The Reliability and Performance Monitor will start collecting data to create the System Diagnostics report.
  3. When the report is ready for viewing, locate the Diagnostic Results section of the report, and check for any Warnings. You can follow links to additional help on resolving warnings from this section. In addition, you can expand each category in the Basic System Checks section to see more details about why warnings appear.The Performance section of the report provides process-level detail about applications or services that are using the most resources.
  4. Identify the applications or services that are not required.
  5. Click Start, and type msconfig.exe to open System Configuration. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
  6. Click the Service tab, clear the check box next to the names of the services that you want to disable, and then click Apply. If you do not know which services you require at startup, note the services that are currently configured to start and then click Disable all to disable all services.
  7. Click the Startup tab, clear the check box next to the names of the programs that you want to disable, and then click OK. If you do not know which programs you require at startup, note the programs that are currently configured to start and then click Disable all to disable all programs.
  8. Restart the computer.
Cause :
This computer has a corrupted registry
Resolution :
Repair a corrupted registry
During Windows logon, the operating system opens the registry and reads the list of user accounts that are configured for the computer. If that data cannot be read, the Windows logon screen is not displayed and users will be unable to log on to Windows. Whether or not Windows will be able to complete the startup process depends on the severity of the registry corruption.
If the Windows registry is slightly or moderately corrupted, you may be able to restart the computer in Safe mode and use System Restore to restore the registry of the computer to the last known good configuration. However, if the Windows registry is severely corrupted, all types of logon will be prevented. Attempting to log on to Windows causes the system to fail and then to restart. In this situation, you will need to boot the system into the Recovery Console instead of into Windows. Once in the Recovery Console, you can use the Startup Repair tool. Startup Repair automates common diagnostic and repair tasks of unbootable Windows installations.
To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.
Repair a corrupted registry by using Startup Repair
To repair a corrupted registry by using Startup Repair:
Caution : Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.
  1. During restart, select the option to restart into the Recovery Console to allow you to restore the system.Your system may restart into the Recovery Console automatically or you may need to start the Recovery Console manually during the system restart process by pressing F8.
  2. On the Advanced Boot Options screen, use the arrow keys to highlight Repair your computer, and then press ENTER. If Repair your computer is not listed, you will need to reboot your computer from the operating system CD/DVD to use Startup Repair because Startup Repair was not configured as a preinstalled recovery option on your computer.
  3. Choose your language settings, and click Next.
  4. Click Repair your computer.
  5. Choose your operating system, and click Next. System recovery options are displayed.
  6. Click Startup Repair. Startup Repair diagnoses your system to identify the cause of the failure. Once it has identified the cause, it automatically starts repairing your computer.
  7. After Startup Repair has run, a text log with diagnostic information and repair results is generated. To view this log, click Details. The details are saved to the log file located at %WINDIR%\System32\LogFiles\Srt\SrtTrail.txt.
  8. After Startup Repair has finished the repairs, click Finish to restart your computer.
Repair a corrupted registry by using System Restore
To repair a corrupted registry by using System Restore:
  1. Click Start, type systempropertiesprotection, and then press ENTER. If you are prompted for an administrator password or a confirmation, type the password or click Allow.
  2. In the System Properties dialog box, on the System Protection tab, click System Restore.
  3. In the System Restore dialog box, click Choose a different restore point, and then click Next.
  4. Select the restore point that you want to use, and then click Next.
  5. Confirm your restore point, and then click Finish. The selected configuration is restored, and the computer restarts.
  6. Log on to the computer.
  7. When the System Restore confirmation page appears, click OK.
Cause :
Services required by the process failed to start
Resolution :
Restart the service
During Windows logon, Windows starts the services that support user interaction with the system.
To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.
To restart services that failed to start:
  1. Use the error code to determine the service that failed to start.
  2. Click Start, type services.msc, and then press ENTER.
  3. In the Services pane, locate the service that failed to start.
  4. Right-click the service, and then click Start.
Verify :
To verify that Windows logon is functioning correctly, observe one or more of the following processes:
  • An account is able to log on to the local computer or to the domain.
  • An account is able to log on during the hours of the day that the account has been granted access.
  • An account is able to log on to the computer with a valid license.
  • A user can press CTRL+ALT+DELETE to log on to the computer or log off from the computer.
Reference LinksEvent ID 4005 from Microsoft-Windows-Winlogon

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.