| Event Id | 3004 |
| Source | Microsoft-Windows-Wininit |
| Description | Windows start-up process has failed to synchronize with the local security subsystem during setup. |
| Event Information | According to Microsoft : Cause : This event is logged when Windows start-up process has failed to synchronize with the local security subsystem during setup. Resolution : Check the availability of the Local Security Authority Subsystem Service (LSASS) During Windows startup, Windows starts the services that are necessary for the operating system to function properly. The Local Security Authority Subsystem Service (LSASS) must be running to enable users to log on to the computer. If this service fails to start, the computer will not complete the Windows startup process and you will need to start your computer in Safe Mode to try to determine the cause of the problem. Starting your computer in Safe Mode starts Windows with a limited set of files and drivers. Startup programs do not run in Safe Mode, and only the basic drivers needed to start Windows are enabled. To perform these procedures, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority. Start in Safe Mode To start in Safe Mode: 1.Press and hold F8 as your computer restarts. 2.If your computer has more than one operating system, use the arrow keys to select the operating system that you want to start in Safe Mode, and then press F8. 3.On the Advanced Boot Options screen, use the arrow keys to select the Safe Mode option you want, and then press ENTER. Check the availability of LSASS To check the availability of LSASS: 1.Click Start, point to Administrative Tools, and then click Event Viewer. 2.Open the Application event log, and find the entry for the lsass.exe service that corresponds to the logon event that failed to complete. 3.Verify that the service was able to start properly and that known virus variants such as lsasss.exe and lsassa.exe are not starting as well. If virus variants are present, run an up-to-date antivirus program on the system to remove the virus and then attempt to start Windows normally. Verify To verify that the Windows startup availability process completed successfully after logging on, check the Event Viewer to verify all system processes and services designated to run at startup are set up and synchronized properly. 1.Click Start, point to Administrative Tools, and then click Event Viewer. 2.In the Event Viewer (Local) pane, double-click Windows Logs. 3.Select the System log. A white exclamation point in a red circle indicates that a service or driver is stopped or has failed to start. A black exclamation point in a yellow triangle indicates warnings, such as low disk space. For more information about an entry, click the entry, and read the General tab. |
| Reference Links | Event ID 3004 from Microsoft-Windows-Wininit |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.