Event 6004

Question

Today I got this in the event viewer and I don't know what this is for?

The winlogon notification subscriber <TrustedInstaller> failed a critical notification event.

Answer 1

That specific error trace in the event viewer usually indicates the Windows Modules Installer Service, responsible for updates, failed to respond during login and that event can usually be safely ignored.

Apart from seeing that error in the event viewer, are you experiencing any problems with Windows on your PC?

Answer 2

Event 6004 with the message:

The winlogon notification subscriber <TrustedInstaller> failed a critical notification event.

means that a Winlogon notification callback associated with the TrustedInstaller component did not complete correctly during a logon-related event (such as logon, logoff, lock, unlock, or shutdown).

Key points:

• Winlogon uses notification packages (DLLs) that receive callbacks for logon-related events.
• These packages are registered in the registry under: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
• When an event occurs (for example, user logon), Winlogon calls the registered notification handlers. If one of these subscribers (here, <TrustedInstaller>) fails to process the event, Winlogon logs an event like the one seen.
• The message itself does not necessarily mean immediate system damage; it indicates that the TrustedInstaller-related notification handler did not successfully handle a Winlogon event.

For a home Windows 11 system, if this appears only occasionally and there are no visible problems (logon works, updates install, no repeated crashes), it can typically be treated as informational or transient. If it recurs frequently together with other symptoms (failed updates, repeated logon issues, or system instability), then further investigation would focus on:

1. Checking for repeated related errors around the same time in Event Viewer (Application and System logs).
2. Ensuring Windows is fully updated.
3. Running system health checks such as sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth from an elevated command prompt.

The event itself is about a Winlogon notification subscriber failing its callback; it is not, by itself, a definitive sign of corruption or malware.

---

References:

• Creating a Winlogon Notification Package
• Registering a Winlogon Notification Package