Event ID 1000, 1004

[Cameron Powell]

I have multiple users that are experiencing problems logging in to their
computer in the morning. The error message is displayed below. I've ran SFC
and I've also tried installing the User Profile Hive Cleanup Service. Once
they restart their computer it works just fine it's just the initial try that
seems to fail. I also checked the dump file and one of the machines has
mention of the file rpcrt4.dll if that helps at all.

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 10/22/2008
Time: 8:03:53 AM
User: N/A
Computer: DIVINE
Description:
Faulting application winlogon.exe, version 0.0.0.0, faulting module unknown,
version 0.0.0.0, fault address 0x74ef40c3.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 77 69 6e ure win
0018: 6c 6f 67 6f 6e 2e 65 78 logon.ex
0020: 65 20 30 2e 30 2e 30 2e e 0.0.0.
0028: 30 20 69 6e 20 75 6e 6b 0 in unk
0030: 6e 6f 77 6e 20 30 2e 30 nown 0.0
0038: 2e 30 2e 30 20 61 74 20 .0.0 at
0040: 6f 66 66 73 65 74 20 37 offset 7
0048: 34 65 66 34 30 63 33 4ef40c3

 

[nass]

I have multiple users that are experiencing problems logging in to their
computer in the morning. The error message is displayed below. I've ran SFC
and I've also tried installing the User Profile Hive Cleanup Service. Once
they restart their computer it works just fine it's just the initial try that
seems to fail. I also checked the dump file and one of the machines has
mention of the file rpcrt4.dll if that helps at all.

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 10/22/2008
Time: 8:03:53 AM
User: N/A
Computer: DIVINE
Description:
Faulting application winlogon.exe, version 0.0.0.0, faulting module unknown,
version 0.0.0.0, fault address 0x74ef40c3.

Hi Cameron,
Try to create a new profile on one of these machines and test to see if it
is a file corruption issue (only on one machine as a test).
How to Identify a Damaged User Profile and Create a New Profile
http://support.microsoft.com/kb/811151

Also make sure the Time on these machine is correct.
An access violation error occurs if your Terminal Services information is
corrupted
http://support.microsoft.com/kb/828664/en-us

Event IDs 1000 and 1004 may be logged in the Application event log, and
Windows Server 2003 Terminal Server client connections and logon tries may
sometimes fail, when you try to connect to a remote computer
http://support.microsoft.com/?kbid=914048

http://www.eventid.net/display.asp?eventid=1004&eventno=1990&source=Application Error&phase=1

HTH,
nass

 

[Cameron Powell]

Hi Cameron,
Try to create a new profile on one of these machines and test to see if it
is a file corruption issue (only on one machine as a test).
How to Identify a Damaged User Profile and Create a New Profile
http://support.microsoft.com/kb/811151

Also make sure the Time on these machine is correct.
An access violation error occurs if your Terminal Services information is
corrupted
http://support.microsoft.com/kb/828664/en-us

Event IDs 1000 and 1004 may be logged in the Application event log, and
Windows Server 2003 Terminal Server client connections and logon tries may
sometimes fail, when you try to connect to a remote computer
http://support.microsoft.com/?kbid=914048

http://www.eventid.net/display.asp?eventid=1004&eventno=1990&source=Application Error&phase=1

HTH,
nass

Well I can try the creating a new profile of course that will have to wait
until later on in the week. Both machines are updated via WSUS so the 2nd
item in the list wouldn't apply. The third item would mean that the server is
at fault in which case there would be a lot more then 2 computers having the
issue.

I feel like the profile issue may not be it either. The problem only occurs
in the morning when they first log on to the machine. I found this forum:

http://gathering.tweakers.net/forum/list_messages/1222855

There seems to be a bunch of people there with the EXACT problem. Can anyone
here read dutch? I used google to view the translated version of course that
only helps a little when it comes to making it readable.

 

[Cameron Powell]

So I read http://support.microsoft.com/kb/232575 and it says that I can have
winlogon create a logfile. Where do I go about finding this "checked
version", they mention it, but nowhere do they tell you where/how to get it.