Error 6004 Winlogon
Contents |
Add-on Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. TheEventId.Net for Splunk Add-onassumes thatSplunkis event id 6001 winlogon collecting information from Windows servers and workstation via the Splunk Universal Forwarder. read
The Winlogon Notification Subscriber Failed A Notification Event.
more... Event ID: 6004 Source: Microsoft-Windows-Winlogon Source: Microsoft-Windows-Winlogon Type: Warning Description:The Winlogon notification subscriber
Event Id 6004 Dns
a hive such as HKU\user with regedit.exe. Look at the security settings for the hive, and if an unresolved (unknown) SID exists, it is probably the old SID for the user. In advanced settings, note the SID, to be copied and pasted in a moment. Then, obtain setacl.exe and run a command such as the following, where n1 is a paste of the SID that needs replacing, and n2 specifies the Username to replace it with, aka the username of the account whose hive you loaded: setacl.exe -on "HKU\user" -ot reg -actn trustee -rec yes -trst "n1:S-1-5-21-555555555-555555555-5555555555-5555, n2:UserName, s1:y, ta:repltrst, w:dacl" Do this for both ntuser.dat/ntuser.man and UsrClass.dat. x 2 Justin Laing From a newsgroup post:
Detected You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality. We use cookies to let you log in, for ads and for event id 6004 msexchange common analytics. OK User profile service service failed the logon Started by Jovin error 6004 asphalt 8 , Nov 04 2009 05:29 PM Please log in to reply 2 replies to this topic #1 Jovin Jovin Member
Event Id 6005 Winlogon
Established Members 21 posts Posted 04 November 2009 - 05:29 PM When I try to logon as a standard user, for the first time, on my Win2008 Std. server, I get an http://www.eventid.net/display-eventid-6004-source-Microsoft-Windows-Winlogon-eventno-9858-phase-1.htm error message "The User Profile Service service failed the Logon. User Profile cannot be loaded." I checked the event log and reports multiple Events: Event ID: 1530 Description: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. Event ID: 1509 https://www.windows-noob.com/forums/topic/1390-user-profile-service-service-failed-the-logon/ Description: Windows cannot copy file C:\Users\Default\{dafa2cb9-8e15-425a-a53a-3a41b7fde156}\ to location C:\Users\Vin\{dafa2cb9-8e15-425a-a53a-3a41b7fde156}\. This error may be caused by network problems or insufficient security rights. Event ID: 1511 Description: Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off. Event ID: 1500 Description: Windows cannot log you on because your profile cannot be loaded. Check that you are connected to the network, and that your network is functioning correctly. Event ID: 6004 Description: The winlogon notification subscriber
each time due to the user profile service failing to create my profile, and a temp profile. I had never logged into http://myitpath.blogspot.com/2010/06/user-profile-service-failed-login.html this machine in the past, so I was curious as to what the problem was. The application logs were showing multiple events at that time in this order: Event 6004 Winlogon: https://support.symantec.com/en_US/article.TECH108056.html The winlogon notification subscriber failed a critical notification event. Event 1509 User profile general: Windows cannot copy file C:\Users\Default\ntuser.dat to location C:\Users\nlinley\ntuser.dat. This error may be caused by network problems or event id insufficient security rights. DETAIL - Access is denied. Event 1511 User profile service: Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off. Event 1509 User Profile general: Windows cannot copy file C:\Users\Default\ntuser.dat to location C:\Users\TEMP\ntuser.dat. This error may be caused by network problems event id 6004 or insufficient security rights. DETAIL - Access is denied. Event 1500 User Profile General: Windows cannot log you on because your profile cannot be loaded. Check that you are connected to the network, and that your network is functioning correctly. DETAIL - Only part of a ReadProcessMemory or WriteProcessMemory request was completed. Event 6001 Winlogon: The winlogon notification subscriber failed a notification event. Event 6001 Winlogon: The winlogon notification subscriber failed a notification event. The user profile service log was not showing anything useful, just logoff events. From here, I was looking at the security log and found a few failure audits from base filtering engine for domain controller to domain controller on standard domain controller ports. Although this was odd, it didn't seem to explain the issue and the ports did not seem to significant for this point of the login. Checking the access issue and permissions showed normal permissions on c:\users\default folder (Everyone:read, System: full, Administrators:full, Users:read), and on ntuser.dat it was set to inherit. The odd part with this it the ACL was only showing (Admistrators:full, System:full). If it is inheriting, where
PKI Service Identity Access Manager Shop Online Cyber Security Services Managed Security Services DeepSight Intelligence Incident Response Security Simulation Website Security SSL Certificates Complete Website Security Code Signing Certificates Norton Shopping Guarantee Buy SSL Products A-Z Services Services Home Business Critical Services Consulting Services Customer Success Services Cyber Security Services Education Services Solutions Solutions Home Topics Encryption Everywhere Internet of Things Next Generation Endpoint Office 365 Industries Automotive Cyber Insurance Education Financial Services Global Service Providers Industrial Control Systems Healthcare Retail Government Federal Government State & Local Support Center Technical Support Symantec Connect Buying Programs Upgrades Maintenance & Renewals Training Security Center Security Center Home Blogs ISTR Threats Virus Definitions and Security Updates Removal Tools Partner Find a Partner Become a Partner Login Required Login into Partner Portal Partner Licensing Partner Renewals Partner Training Margin Builder Opportunity Registration Financial Benefits English 中文(简体) 中文(繁體) Česká English Français Deutsch Magyar Italiano 日本語 한국어 Polski Português Pусский Español Site: Symantec Enterprise Small Business Norton United States Search Support Home Support Home MySymantec Licensing Products A-Z SYM16-015 Security Advisory Login Profile Subscriptions Logout Login Forgot Password? Don't have a SymAccount? Create a SymAccount now!' Error: "Error 6004: LiveUpdate did not complete successfully . . ." TECH108056 January 18th, 2003 http://www.symantec.com/docs/TECH108056 Support / Error: "Error 6004: LiveUpdate did not complete successfully . . ." Did this article resolve your issue? Thank you for your feedback! Provide feedback on this article Request Assistance Print Article Subscribe to this Article Manage your Subscriptions Search Again Situation While running LiveUpdate, you see the error message "Error 6004: LiveUpdate did not complete successfully. Due to a transmission error, one or more LiveUpdate components failed internal authentication. Please run LiveUpdate again. If the error persists, contact your network administrator or LiveUpdate provider." Solution This error can happen if you are going through a proxy server, with I-Gear installed. It can also happe