Cause. This issue occurs because of a race condition between the Windows Event Log service and the Event Tracing for Windows (ETW) tracing functions. When the race condition occurs, it causes a deadlock situation. This deadlock situation then causes the Winlogon.exe process to become unresponsive. Resolution. Hotfix information.

Cause. This issue occurs because a critical Windows process (dwm.exe) fails to start. In some circumstances the video driver sends a TDR (Timeout Detect Recovery) which (by design) leads to winlogon to stop and restart the DWM.

Event ID: 64001. Source: Windows File Protection. Description: File replacement was attempted on the protected system file c:\winnt\system32\ file_name . This file was restored to the original version to maintain system stability. The file version of the system file is x.x:x.x.

Security group policy is driven by the Userenv.dll library running within the Winlogon.exe process, or on Windows Vista and later, the Group Policy Service (GPSvc). This is the component that gets the list of policies that are assigned to the machine, and filters out the ones that do not apply.

Cached logon information is controlled by the following key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon\ ValueName: CachedLogonsCount. Data Type: REG_SZ. Values: 0 - 50. Any changes you make to this key require that you restart the computer for the changes to take effect.

This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

Symptoms. The events are logged because the file system security settings of one policy contain an environment variable that is unknown on the client computer. To find out more about the problem, enable logging of the security configuration client-side extension: 324383 Troubleshooting SCECLI 1202 Events.

Symptom 1. You experience slow interactive logons and RDP logons to a computer that is running Windows 8.1, Windows RT 8.1, or Windows Server 2012 R2. The explorer.exe process reads thousands of Windows Push Notification Platform (WPN) and Windows Notification Facility (WNF) values from the following registry subkey during the user logon:

Winlogon.exe. Userinit.exe. The Desktop Window Manager Session Manager service stops on the problematic terminal server. Cause. The problem occurs because of an issue in the Desktop Window Manager Session Manager service. Resolution. Hotfix information. A supported hotfix is available from Microsoft.

This issue occurs because the Winlogon service tries to start the Group Policy Client service during logon. If other services are starting and the start takes a long time, the start of the Group Policy Client service has to queue until those services finish the startup. That delays the user logon.