Windows Logon Availability

Applies To: Windows Server 2008

Windows logon availability determines whether the Windows logon process is able to be completed successfully. The logon process is the interface between the account for a user, process, or service and the computer that establishes authenticated credentials for the account and allocates the appropriate system and network resources. Windows logon manages the use of the secure attention key (CTRL-ALT-DELETE) to initiate the login screen, load the user profile on logon, and lock the computer.

Events

Event ID	Source	Message
1002	Microsoft-Windows-Winlogon	The shell stopped unexpectedly and %1 was restarted.
4002	Microsoft-Windows-Winlogon	The logon hours restriction policy is applied to the logged on user. The user's session has been locked, disconnected or logged off depending on the policy setting. User Name: %1 Domain Name: %2
4003	Microsoft-Windows-Winlogon	The Windows logon process has failed to switch the desktop.
4005	Microsoft-Windows-Winlogon	The Windows logon process has unexpectedly terminated.
4006	Microsoft-Windows-Winlogon	The Windows logon process has failed to spawn a user application. Application name: %1. Command line parameters: %2.
4101	Microsoft-Windows-Winlogon	Windows license validated.
6000	Microsoft-Windows-Winlogon	The winlogon notification subscriber <%1> was unavailable to handle a notification event.
6001	Microsoft-Windows-Winlogon	The winlogon notification subscriber <%1> failed a notification event.
6002	Microsoft-Windows-Winlogon	The winlogon notification subscriber registration database cannot be loaded. Culprit: <%1>.
6003	Microsoft-Windows-Winlogon	The winlogon notification subscriber <%1> was unavailable to handle a critical notification event.
6004	Microsoft-Windows-Winlogon	The winlogon notification subscriber <%1> failed a critical notification event.

Related Management Information

Windows Logon

Core Security