| Event Id | 4006 |
| Source | Microsoft-Windows-Winlogon |
| Description | The Windows logon process has unexpectedly terminated. |
| Event Information | According to Microsoft : Cause : This event is logged when Windows logon process has unexpectedly terminated. Resolution : Make more resources available on the system During Windows logon, the operating system opens the subscriber notification database and starts the user-level processes so that user accounts can log on to the system. If there are inadequate system resources for Windows logon to do this, the system may start with limited functionality. To identify the applications or services that are using too many system resources, you can generate a System Diagnostics report by using the Reliability and Performance Monitor. To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority. To make more resources available on the system: 1.Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. 2.Type perfmon /report and press ENTER. The Reliability and Performance Monitor will start collecting data to create the System Diagnostics report. 3.When the report is ready for viewing, locate the Diagnostic Results section of the report, and check for any Warnings. You can follow links to additional help on resolving warnings from this section. In addition, you can expand each category in the Basic System Checks section to see more details about why warnings appear. The Performance section of the report provides process-level detail about applications or services that are using the most resources. 4.Identify the applications or services that are not required. 5.Click Start, and type msconfig.exe to open System Configuration. If you are prompted for an administrator password or confirmation, type the password or provide confirmation. 6.Click the Service tab, clear the check box next to the names of the services that you want to disable, and then click Apply. If you do not know which services you require at startup, note the services that are currently configured to start and then click Disable all to disable all services. 7.Click the Startup tab, clear the check box next to the names of the programs that you want to disable, and then click OK. If you do not know which programs you require at startup, note the programs that are currently configured to start and then click Disable all to disable all programs. 8.Restart the computer. Verify : To verify that Windows logon is functioning correctly, observe one or more of the following processes: An account is able to log on to the local computer or to the domain. An account is able to log on during the hours of the day that the account has been granted access. An account is able to log on to the computer with a valid license. A user can press CTRL+ALT+DELETE to log on to the computer or log off from the computer. |
| Reference Links | Event ID 4006 from Microsoft-Windows-Winlogon |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.