Solved

event id 4005 the windows logon process has unexpectedly terminated

Posted on 2013-01-11
7
12,998 Views
Last Modified: 2013-09-11
Hello,

We have a SBS 2008. I noticed that from time to time the server logs event ID 4005 The windows logon process has unexpectedly terminated. No other errors logged before or after the event. I read some articles of Microsoft about that, but it does not seems that the overloaded, or that the accounts are corrupted.
0
Comment
Question by:goliveuk
  • 3
  • 3
7 Comments
 
LVL 6

Expert Comment

by:SebastianAbbinanti
ID: 38768165
Often times that occurs because a service failed to start, or a services has not yet started.
Check the event view to see if services failed to start in proximity to this message.


Other reasons include insufficient resources (common on a SBS), or a corrupt registry. How much memory do you have installed in your server?

Thanks,
S.
0
 

Author Comment

by:goliveuk
ID: 38773486
Did not noticed any failed services, when this error appeared. The server has 14GB of memory.
0
 
LVL 6

Expert Comment

by:SebastianAbbinanti
ID: 38774292
I don't know how many users you have, but 14 GB (an odd amount) should be fine. Does the server run sluggishly?

Thanks,
S.
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 

Author Comment

by:goliveuk
ID: 38792048
The server seems to be running fine.
0
 
LVL 6

Expert Comment

by:SebastianAbbinanti
ID: 38799976
Other than the event log entry, are you experiencing any issues?

Thanks,
S.
0
 

Author Comment

by:goliveuk
ID: 38800993
No other issues. I was wondering if a remote user leaves his remote session without logging off, can that cause the issue ?
0
 
LVL 1

Accepted Solution

by:
cmcfarling09 earned 500 total points
ID: 39468093
I was experiencing the same errors on a SBS 2008 machine. This server had RDP open to the internet which was allowing many daily failed login attempts. After disabling inbound RDP at the firewall and stopping the login attempts, the winlogon errors stopped.
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now