Event ID 1000, 1004

[Donnell]

From today there are some 2-3 users who are facing some issues login into their computer. I have already tried to run SFC and have also installed the User profile cleanup service, if the computer is restarted once then it will work without any issues, its just the first try that is having problems. When I checked the dump files then there was one machine that mentioned some rpcrt4.dll file, dont know if that is having some sort of problems. Below is the error message that I am getting:

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 10/22/2008
Time: 8:03:53 AM
User: N/A
Computer: DIVINE
Description:
Faulting application winlogon.exe, version 0.0.0.0, faulting module unknown,
version 0.0.0.0, fault address 0x74ef40c3.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 77 69 6e ure win
0018: 6c 6f 67 6f 6e 2e 65 78 logon.ex
0020: 65 20 30 2e 30 2e 30 2e e 0.0.0.
0028: 30 20 69 6e 20 75 6e 6b 0 in unk
0030: 6e 6f 77 6e 20 30 2e 30 nown 0.0
0038: 2e 30 2e 30 20 61 74 20 .0.0 at
0040: 6f 66 66 73 65 74 20 37 offset 7
0048: 34 65 66 34 30 63 33 4ef40c3

[Hockson]

Have you tried creating a new profile on one of the machines and then tested to see if there is a file corruption problem. You can try to follow the below different links that will help things sort out:

How to Identify a Damaged User Profile and Create a New Profile
http://support.microsoft.com/kb/811151

An access violation error occurs if your Terminal Services information is corrupted
http://support.microsoft.com/kb/828664/en-us

Event IDs 1000 and 1004 may be logged in the Application event log, and Windows Server 2003 Terminal Server client connections and logon tries may sometimes fail, when you try to connect to a remote computer
http://support.microsoft.com/?kbid=914048

[Donnell]

I can try to create a new profile but will have to wait until the next week of this month. The machines are usually updated with the WSUS, so the second item in the list would not apply. And the item would mean that the server is at fault in which case there would be a lot more then 2 computers having the issue.

[etienne]

This issue occurs when a font package that is not valid is installed on the Windows Server 2003-based server that is running Terminal Server. When you try to log on, the font package that is not valid causes data structure corruption that finally cannot be handled by the Winlogon service. Therefore, a Terminal Server connection session cannot be established. For a workaround, check this link - http://support.microsoft.com/kb/914048