Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: DWM 0x40010004 Winlogon 6000 and User Profile errors at every startup

28 Oct 2012   #1

Win 7 64bit Ultimate
 
 
DWM 0x40010004 Winlogon 6000 and User Profile errors at every startup

I have Win 7 64bit Ultimate.
At every startup I get the following errors in that sequence:

First comes the notorious "winlogon notification subscriber SessionEnv was unavailable to handle a notification event" (ID 6000)"
- <System>
<Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />

<EventID Qualifiers="32768">6000</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:26:58.000000000Z" />

<EventRecordID>31623</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>Application</Channel>

<Computer>.....</Computer>

<Security />

</System>


- <EventData>
<Data>SessionEnv</Data>

<Binary>D9060000</Binary>

</EventData>


</Event>



Then always "the DWM has exited with code 0x40010004" - <System>
<Provider Name="Desktop Window Manager" />

<EventID Qualifiers="16384">9009</EventID>

<Level>4</Level>

<Task>0</Task>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:26:58.000000000Z" />

<EventRecordID>31622</EventRecordID>

<Channel>Application</Channel>

<Computer>......</Computer>

<Security />

</System>


- <EventData>
<Data>0x40010004</Data>

</EventData>


</Event>


Then the again"the winlogon notification subscriber SessionEnv was unavailable to handle a notification event" (ID 6000):

<Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />

<EventID Qualifiers="32768">6000</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:26:58.000000000Z" />

<EventRecordID>31623</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>Application</Channel>

<Computer>......</Computer>

<Security />

</System>


- <EventData>
<Data>SessionEnv</Data>

<Binary>D9060000</Binary>

</EventData>


</Event>

Then always something about user profile (not always the same), for example:
- <System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />

<EventID>1530</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:26:58.586516100Z" />

<EventRecordID>31624</EventRecordID>

<Correlation ActivityID="{036B2A48-F800-0001-A2D4-9E108FB4CD01}" />

<Execution ProcessID="1028" ThreadID="4768" />

<Channel>Application</Channel>

<Computer>......</Computer>

<Security UserID="S-1-5-18" />

</System>


- <EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">7 user registry handles leaked from \Registry\User\S-1-5-21-2087956268-840787211-4146391690-1000: Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Microsoft\Internet Explorer\Main Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Policies Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software Process 1028 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Microsoft\RAS AutoDial</Data>





Then comes User Profile has stopped (event 1532)
- <Event xmlns="Error">
- <System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />

<EventID>1532</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:27:02.268122500Z" />

<EventRecordID>31625</EventRecordID>

<Correlation />

<Execution ProcessID="1028" ThreadID="1192" />

<Channel>Application</Channel>

<Computer>......</Computer>

<Security UserID="S-1-5-18" />





Then the "suppress duplicate events" 4625:
- <Event xmlns="Error">
- <System>
<Provider Name="Microsoft-Windows-EventSystem" Guid="{899daace-4868-4295-afcd-9eb8fb497561}" EventSourceName="EventSystem" />

<EventID Qualifiers="16384">4625</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:27:55.000000000Z" />

<EventRecordID>31626</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>Application</Channel>

<Computer>.....</Computer>

<Security />

</System>


- <EventData>
<Data Name="param1">86400</Data>

<Data Name="param2">SuppressDuplicateDuration</Data>

<Data Name="param3">Software\Microsoft\EventSystem\EventLog</Data>

</EventData>


</Event>

And all of a sudden the "user profile service has started successfully".

Then comes again "the winlogon notification subscriber SessionEnv was unavailable to handle a notification event" (ID 6000)" and, finally, winlogon id 4101 "windows license validated".From then on all is normal.

The PC has no actual symptoms at all. The AERO works great and the dwm.exe always runs at task manager. Also aero themes working.

The only symptom is at restart, when the welcome screen disappears for a split second, then comes back (probably at the time when dwm exits and restarts?). Then I have a black screen with the mouse for 2-3 or 3-4 secs (as if the pc struggles to log on to the account) and then normally to desktop. That of course delays the startup but from then on all is normal.

From googling around I interpret those errors something like AERO exits at the beginning but comes back, then problems with logging into the user account but finally logging in is normal. I only have one administrative account and nothing else.
I suspect some kind of user profile corruption but cannot pinpoint it, since I get no errors apart from the log.
I have only managed to reproduce the following: I get into safe mode and aero is (normally) auto-disabled. When I restart in normal mode, aero is not activated automatically but the computer starts in basic display mode and I activate aero manually.
I ran aero troubleshooting and of course sfc/scannow without results.
I don't even know if the two problems are somehow connected.

Any help/suggestions would be greatly appreciated!


My System SpecsSystem Spec
.

28 Oct 2012   #2
Arc

Microsoft Community Contributor Award Recipient

Windows 7 Home Premium 64 Bit SP 1
 
 

First you try SFC /SCANNOW : Run in Command Prompt at Boot

If the issue persists, do a Startup Repair.
My System SpecsSystem Spec
Reply

 DWM 0x40010004 Winlogon 6000 and User Profile errors at every startup




Thread Tools




Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 05:52 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33