Event ID 6001 — Windows Logon Availability

Applies To: Windows Server 2008

Windows logon availability determines whether the Windows logon process is able to be completed successfully. The logon process is the interface between the account for a user, process, or service and the computer that establishes authenticated credentials for the account and allocates the appropriate system and network resources. Windows logon manages the use of the secure attention key (CTRL-ALT-DELETE) to initiate the login screen, load the user profile on logon, and lock the computer.

Event Details

Diagnose

This error might be caused by one of the following conditions:

• System resources are inadequate or unavailable.
• The Windows registry is corrupted.
• A service failed to start.

To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.

System resources are inadequate or unavailable

To determine if system resources are inadequate or unavailable:

1. Right-click the taskbar, and then click Task Manager.
2. Click the Performance tab to monitor the usage of central processing unit (CPU) and memory resources.
3. Observe the top two graphs that show how much CPU is being used, both at the moment and for the past few minutes. (If the CPU Usage History graph appears split, your computer either has multiple CPUs, a single dual-core CPU, or both.) A high percentage means that programs or processes are requiring a lot of CPU resources, which can slow your computer. If the percentage remains at or near 100 percent, then a program might not be responding.
4. Observe the bottom two graphs that display how much random access memory (RAM), or physical memory, is being used in megabytes (MB), both at the current moment and for the past few minutes. The percentage of memory being used is listed at the bottom of the Task Manager window. If memory use seems consistently high or slows your computer's performance noticeably, try reducing the number of programs you have open at one time, or install more RAM.
5. Click the Processes tab to view memory use for individual processes on your computer. The Memory (Private Working Set) column is selected by default. Private working set is a subset of working set that describes how much memory is being used by each process. Private working set specifically describes the amount of memory a process is using that cannot be shared by other processes. Check if any processes are taking substantially large amount of memory.
6. To view additional information about how much memory and CPU resources are being used, click Resource Monitor. Resource Monitor provides more detailed graphical summaries. It also includes more details about resources, such as disk use and network use.
7. If system resources are inadequate or unavailable, see the "Make more resources available on the system" section.

The Windows registry is corrupted

If the Windows registry is corrupted, logon might be prevented and you will need to interrupt the startup process to boot the computer into Safe Mode or the Recovery Console. In Safe Mode, you can use System Restore to restore the Windows registry to a restore point. In the Recovery Console, you can use the Startup Repair utility. Startup Repair is a tool that automates common diagnostic and repair tasks of unbootable Windows installations, such as repairing a corrupted registry.

Note: You may need to have your operating system CD/DVD available if the Startup Repair is not a preinstalled recovery option on your computer.

If your computer will not complete the startup process, see the "Repair a corrupted registry" section.

A service failed to start

To determine if a service failed to start:

1. Click Start, and then click Control Panel.
2. Open Administrative Tools, and then open Event Viewer.
3. In the Event Viewer (Local) pane, double-click Windows Logs.
4. Select the System log. A white exclamation point in a red circle indicates that a service or driver is stopped or has failed to start. A black exclamation point in a yellow triangle indicates warnings, such as low disk space. For more information about an entry, click the entry, and read the General tab.
5. If a service failed to start, see the "Restart the service" section.

Resolve

To resolve this issue, use the resolution that corresponds to the cause you identified in the Diagnose section. After performing the resolution, see the Verify section to confirm that the feature is operating properly

Make more resources available on the system

During Windows logon, the operating system opens the subscriber notification database and starts the user-level processes so that user accounts can log on to the system. If there are inadequate system resources for Windows logon to do this, the system may start with limited functionality.

To identify the applications or services that are using too many system resources, you can generate a System Diagnostics report by using the Reliability and Performance Monitor.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To make more resources available on the system:

1. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
2. Type perfmon /report and press ENTER. The Reliability and Performance Monitor will start collecting data to create the System Diagnostics report.
3. When the report is ready for viewing, locate the Diagnostic Results section of the report, and check for any Warnings. You can follow links to additional help on resolving warnings from this section. In addition, you can expand each category in the Basic System Checks section to see more details about why warnings appear. The Performance section of the report provides process-level detail about applications or services that are using the most resources.
4. Identify the applications or services that are not required.
5. Click Start, and type msconfig.exe to open System Configuration. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
6. Click the Service tab, clear the check box next to the names of the services that you want to disable, and then click Apply. If you do not know which services you require at startup, note the services that are currently configured to start and then click Disable all to disable all services.
7. Click the Startup tab, clear the check box next to the names of the programs that you want to disable, and then click OK. If you do not know which programs you require at startup, note the programs that are currently configured to start and then click Disable all to disable all programs.
8. Restart the computer.

Repair a corrupted registry

During Windows logon, the operating system opens the registry and reads the list of user accounts that are configured for the computer. If that data cannot be read, the Windows logon screen is not displayed and users will be unable to log on to Windows. Whether or not Windows will be able to complete the startup process depends on the severity of the registry corruption.

If the Windows registry is slightly or moderately corrupted, you may be able to restart the computer in Safe mode and use System Restore to restore the registry of the computer to the last known good configuration. However, if the Windows registry is severely corrupted, all types of logon will be prevented. Attempting to log on to Windows causes the system to fail and then to restart. In this situation, you will need to boot the system into the Recovery Console instead of into Windows. Once in the Recovery Console, you can use the Startup Repair tool. Startup Repair automates common diagnostic and repair tasks of unbootable Windows installations.

To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.

Repair a corrupted registry by using Startup Repair

To repair a corrupted registry by using Startup Repair:

Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.

1. During restart, select the option to restart into the Recovery Console to allow you to restore the system. Your system may restart into the Recovery Console automatically or you may need to start the Recovery Console manually during the system restart process by pressing F8.  
2. On the Advanced Boot Options screen, use the arrow keys to highlight Repair your computer, and then press ENTER. If Repair your computer is not listed, you will need to reboot your computer from the operating system CD/DVD to use Startup Repair because Startup Repair was not configured as a preinstalled recovery option on your computer.
3. Choose your language settings, and click Next.
4. Click Repair your computer.
5. Choose your operating system, and click Next. System recovery options are displayed.
6. Click Startup Repair. Startup Repair diagnoses your system to identify the cause of the failure. Once it has identified the cause, it automatically starts repairing your computer.
7. After Startup Repair has run, a text log with diagnostic information and repair results is generated. To view this log, click Details. The details are saved to the log file located at %WINDIR%\System32\LogFiles\Srt\SrtTrail.txt.
8. After Startup Repair has finished the repairs, click Finish to restart your computer.

Repair a corrupted registry by using System Restore

To repair a corrupted registry by using System Restore:

1. Click Start, type systempropertiesprotection, and then press ENTER. If you are prompted for an administrator password or a confirmation, type the password or click Allow.
2. In the System Properties dialog box, on the System Protection tab, click System Restore.
3. In the System Restore dialog box, click Choose a different restore point, and then click Next.
4. Select the restore point that you want to use, and then click Next.
5. Confirm your restore point, and then click Finish. The selected configuration is restored, and the computer restarts.
6. Log on to the computer.
7. When the System Restore confirmation page appears, click OK.

For more information about backing up and restoring the registry, including guided help, see article 322756 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkID=101847).

Restart the service

During Windows logon, Windows starts the services that support user interaction with the system.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To restart services that failed to start:

1. Use the error code to determine the service that failed to start.
2. Click Start, type services.msc, and then press ENTER.
3. In the Services pane, locate the service that failed to start.
4. Right-click the service, and then click Start.

Verify

To verify that Windows logon is functioning correctly, observe one or more of the following processes:

• An account is able to log on to the local computer or to the domain.
• An account is able to log on during the hours of the day that the account has been granted access.
• An account is able to log on to the computer with a valid license.
• A user can press CTRL+ALT+DELETE to log on to the computer or log off from the computer.

Related Management Information

Windows Logon Availability

Core Security