We updated one of our Citrix XenApp servers and this message started flooding our Application event log:
“The winlogon notification subscriber was unavailable to handle a critical notification event.»
So what’s going on here?
Examining the registry on a ‘good’ working system and the ‘bad’ system revealed the following:
</p>
Good TrustedInstaller — No Error 6003
</p>
Bad TrustedInstaller — Error 6003
How did that value get there?
It turns out we installed Internet Explorer 11 with our patch cycle — but that in and of itself did not cause our issue. Additional components for IE 11 were installed as well:
“Microsoft Windows English Spelling Package” and “Microsoft Windows English Hyphenation Package”
Neither of these packages are present on any of the ‘working’ systems. I tested to determine which of them placed the registry key there…
It turns out both of them do. If you uninstall *either* package it will remove the ‘CreateSession’ value. Since these packages are not in our standard build we are removing both.
Guest
-
-
#1
In the Event Viewer I’ve a lot of errors about «Event ID 6003 winlogon» from
30 January to 28 March (I performed a clean installation on 30 January).
Is it a bug? Do you have these event id 6003 winlogon errors into Event
viewer?
Event ID: 6003 Source: Winlogon and says:
The winlogon notification subscriber <TrustedInstaller> was unavailable to
handle a critical notification event.
And only today I’ve got a similar error during the logon, i.e. I clicked on
my user, typed my password and Vista shown a dialog box with a similar/same
error, then I retried again an login worked.
-
-
#2
Somewhat of a guess but it sounds like some software that is trying to
update itself but is not completely compatible. Probably requires Admin
privs for the update. The obvious culprits would be AV/security software,
anti-spyware, etc. Try running manual updates on these and see if you get
errors.
I had a misbehaving piece of software that activated a UAC message every
time it went to check for updates. Then last week, I get a notice that a new
version is available and everything has been as expected since.
Windows 7 domain PC fails to logon to a certain user.
System event service fails to logon.
Log Name: Application
Source: Microsoft-Windows-Winlogon
Date: 16/04/2018 08:56:36
Event ID: 6003
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: %COMPUTERNAME%.domain.suffix
Description:
The winlogon notification subscriber
was unavailable to handle a critical notification event.
Event Xml:
6003
0
3
0
0
0x80000000000000
748069
Application
%COMPUTERNAME%.domain.suffix
GPClient
D9060000
Sponsor
Want to thank us? Use: Patreon or PayPal or Bitcoins: bc1q4whppe29dw77rm4kv4pln0gqae4yjnxly0dny0hky6yhnafukzjsyrsqhk
All opinions expressed within these pages are sent in by members of the public or by our staff in their spare time, and as such do not represent any opinion held by sircles.net Ltd or their partners.
We actually got around this problem by booting into the Windows Recovery from the Windows 10 boot disk and running SFC /scannow on the system from a command prompt.
-
Network and Sound icon in notification bar ‘stuck together’
(Windows 11)
by
andrewt2m
3 years ago -
Requested action not taken: mailbox unavailable (S2017062302).
(Websites and Apps)
by
drdread
3 years ago
We have a virtual machine with Vista Business installed on it that is connected to our internal domain.
It is being used for some particular network and application testing for our environment.
Every once in a while, it is impossible for any restricted level user to log onto the machine.
We get the following error:
Windows could not connect to the System Event Notification Service service.
Please consult your system administrator.
Well, we are the system administrator! 
After a great deal of searching around, there doesn’t seem to be any «fix» for the situation yet.
The workaround is to reboot the system and hope for the best. In our case, it works, but in investigating this problem, there are people out there supporting classroom systems that are having this hiccup during classes on several hundred machines.
Here is a direct quote from user iquazee about half way down this MSDN Forum post Limited User account cannot log on due to error: «could not connect to the system event notification service» (Note that the registry keys are continuous … they are broken into two lines for formatting reasons):
I did some investigation with a debugger when the problem occurred again on my computer.
And here is what I found so far:1. Although Vista no longer supports Winlogon Notification Packages, there is still a similar mechanism in place used internally by Windows components (see HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
… \Control\Winlogon\Notifications\Components).
It is quite different though — instead of loading each component as an in-process DLL, the new mechanism uses RPC to communicate with the registered components, and each of them runs as a separate service.What’s interesting, the System Event Notification Service, which is the official replacement for now-unsupported Winlogon notification packages depends on this mechanism (see HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
… \Control\Winlogon\Notifications\Components\Sens).2. When a logon event occurs (this can be a logon, logoff, lock, unlock, etc.) Winlogon calls each of these ‘components’ (by binding to a predefined RPC endpoint, the endpoint name seems to be derived from the service SID of each service that is registered for the logon notifications).
There seems to be a timeout if the registered service does not respond quick enough — about a couple of minutes.
3. If some service fails to respond to the logon event, it may cause the logon to fail.
However, it seems that if the user is a local administrator, the logon does not fail (although it may be slow due to the timeouts).
4. It seems that the service which causes the most problems is the TrustedInstaller service.
This service is used to install Windows components, including Windows updates (.MSU files).
It is not used for the installation of ‘normal’ Windows Installer (.MSI) packages.
What I found is that sometimes, after installation of an update the TrustedInstaller service stops responding to the Winlogon notifications, causing the problem.
The Windows Defender service is not the cause of the problem.
However, when Windows Defender in enabled, most updates installed by Windows Update are the Windows Defender definition updates.
5. The workaround is to kill the TrustedInstaller.exe service using Task Manager (it cannot be stopped otherwise).
Of course, you should not do that while an update is being installed.
The TrustedInstaller service will be automatically restarted when needed (for example, when you use Windows Update).
This is a pretty good description of what is happening in the event logs.
Here is the first error we see:
Event ID 1530: User Profile Service — Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
…
Process ID 868
It is followed by:
Event ID 6003: Winlogon — The winlogon notification subscriber [TrustedInstaller] was unavailable to handle a critical notification event.
Both errors occurred around the time the restricted user was trying to log onto the Vista virtual machine.
In this case, as indicated in the previous MSDN Forums (above MSDN link starting at the first page) posts, the process ID that was holding onto the registry was indeed Windows Defender.
So, we may be seeing another bug within the Update Services setup within Windows Vista. Not that we are software debuggers by any means! 
Links:
- Microsoft Live Search: Vista Cannot Connect to the System Event Notification Service.
- Microsoft MSDN Forums: Limited User account cannot log on due to error: «could not connect to the system event notification service»
- Tablet Questions.com: Event 1530, User Profile Service (Specific to the Event ID 1530)
Hopefully we will be seeing at least a hotfix sometime soon!
Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.
Распознавание голоса и речи на C#
UnmanagedCoder 05.05.2025
Интеграция голосового управления в приложения на C# стала намного доступнее благодаря развитию специализированных библиотек и API. При этом многие разработчики до сих пор считают голосовое управление. . .
Реализация своих итераторов в C++
NullReferenced 05.05.2025
Итераторы в C++ — это абстракция, которая связывает весь экосистему Стандартной Библиотеки Шаблонов (STL) в единое целое, позволяя алгоритмам работать с разнородными структурами данных без знания их. . .
Разработка собственного фреймворка для тестирования в C#
UnmanagedCoder 04.05.2025
C# довольно богат готовыми решениями – NUnit, xUnit, MSTest уже давно стали своеобразными динозаврами индустрии. Однако, как и любой динозавр, они не всегда могут протиснуться в узкие коридоры. . .
Распределенная трассировка в Java с помощью OpenTelemetry
Javaican 04.05.2025
Микросервисная архитектура стала краеугольным камнем современной разработки, но вместе с ней пришла и головная боль, знакомая многим — отслеживание прохождения запросов через лабиринт взаимосвязанных. . .
Шаблоны обнаружения сервисов в Kubernetes
Mr. Docker 04.05.2025
Современные Kubernetes-инфраструктуры сталкиваются с серьёзными вызовами. Развертывание в нескольких регионах и облаках одновременно, необходимость обеспечения низкой задержки для глобально. . .
Создаем SPA на C# и Blazor
stackOverflow 04.05.2025
Мир веб-разработки за последние десять лет претерпел коллосальные изменения. Переход от традиционных многостраничных сайтов к одностраничным приложениям (Single Page Applications, SPA) — это. . .
Реализация шаблонов проектирования GoF на C++
NullReferenced 04.05.2025
«Банда четырёх» (Gang of Four или GoF) — Эрих Гамма, Ричард Хелм, Ральф Джонсон и Джон Влиссидес — в 1994 году сформировали канон шаблонов, который выдержал проверку временем. И хотя C++ претерпел. . .
C# и сети: Сокеты, gRPC и SignalR
UnmanagedCoder 04.05.2025
Сетевые технологии не стоят на месте, а вместе с ними эволюционируют и инструменты разработки. В . NET появилось множество решений — от низкоуровневых сокетов, позволяющих управлять каждым байтом. . .
Создание микросервисов с Domain-Driven Design
ArchitectMsa 04.05.2025
Архитектура микросервисов за последние годы превратилась в мощный архитектурный подход, который позволяет разрабатывать гибкие, масштабируемые и устойчивые системы. А если добавить сюда ещё и. . .
Многопоточность в C++: Современные техники C++26
bytestream 04.05.2025
C++ долго жил по принципу «один поток — одна задача» — как старательный солдатик, выполняющий команды одну за другой. В то время, когда процессоры уже обзавелись несколькими ядрами, этот подход стал. . .