Cause. This issue occurs because of a race condition between the Windows Event Log service and the Event Tracing for Windows (ETW) tracing functions. When the race condition occurs, it causes a deadlock situation. This deadlock situation then causes the Winlogon.exe process to become unresponsive. Resolution. Hotfix information.

This issue occurs because a critical Windows process (dwm.exe) fails to start. <msonly> In some circumstances the video driver sends a TDR (Timeout Detect Recovery) which (by design) leads to winlogon to stop and restart the DWM.

WFP protects critical system files that are installed as part of Windows (for example, files with a .dll, .exe, .ocx, and .sys extension and some True Type fonts). WFP uses the file signatures and catalog files that are generated by code signing to verify if protected system files are the correct Microsoft versions.

You may want to have a logon script that only runs for a user when he or she connects to a Terminal Server through the Terminal Server client or by the console. Create your logon script and place it in the %SystemRoot%\System32 folder.

Security group policy is driven by the Userenv.dll library running within the Winlogon.exe process, or on Windows Vista and later, the Group Policy Service (GPSvc). This is the component that gets the list of policies that are assigned to the machine, and filters out the ones that do not apply.

Symptom 1. You experience slow interactive logons and RDP logons to a computer that is running Windows 8.1, Windows RT 8.1, or Windows Server 2012 R2. The explorer.exe process reads thousands of Windows Push Notification Platform (WPN) and Windows Notification Facility (WNF) values from the following registry subkey during the user logon:

This issue occurs because the Winlogon service tries to start the Group Policy Client service during logon. If other services are starting and the start takes a long time, the start of the Group Policy Client service has to queue until those services finish the startup. That delays the user logon.

Cached logon information is controlled by the following key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon\ ValueName: CachedLogonsCount. Data Type: REG_SZ. Values: 0 - 50. Any changes you make to this key require that you restart the computer for the changes to take effect.

This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

Open your Windows Security settings. Select Virus & threat protection > Protection history. The Microsoft Defender Offline scan will automatically detect and remove or quarantine malware. Learn how to remove malware from your PC. Use Microsoft Defender Antivirus in Windows 10 or Windows 11 to scan your PC for malware, viruses, or other threats.