http://schemas.microsoft.com/win/2004/08/events/event

Question

heres where i think it all started

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-AppID" Guid="{3cb2a168-fe19-4a4e-bdad-dcf422f13473}" /> 
  <EventID>4006</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2022-12-21T21:23:57.7839046Z" /> 
  <EventRecordID>1</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="12436" ThreadID="12528" /> 
  <Channel>Microsoft-Windows-AppID/Operational</Channel> 
  <Computer>jns</Computer> 
  <Security UserID="S-1-5-19" /> 
  </System>
  <EventData /> 
  </Event>

Answer 1

Hello there,

This event is logged when Windows logon process has unexpectedly terminated

During Windows logon, the operating system opens the subscriber notification database and starts the user-level processes so that user accounts can log on to the system. If there are inadequate system resources for Windows logon to do this, the system may start with limited functionality.

To identify the applications or services that are using too many system resources, you can generate a System Diagnostics report by using the Reliability and Performance Monitor.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--