Log Name:      Application
Source:        Microsoft-Windows-Winlogon
Date:          9/25/2014 9:48:05 PM
Event ID:      6005
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      Server.INTERNAL
Description:
The winlogon notification subscriber <Sens> is taking long time to handle the notification event (Logoff)

Log Name:      Application
Source:        Microsoft-Windows-EventSystem
Date:          8/22/2014 11:32:47 AM
Event ID:      4627
Task Category: Firing Agent
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      Server.INTERNAL
Description:
The COM+ Event System timed out attempting to fire the Logon method on event class (D5978650-5B9F-11D1-8DD2-00AA004ABD5E) for publisher  and subscriber .  The subscriber failed to respond within 180 seconds. The display name of the subscription is "User Monitor Subscription". The HRESULT was 800705b4.

Receiving the above errors on Application logs, and when running : sc queryex sens

SERVICE_NAME: sens
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 972
        FLAGS              :

Had to kill the PID , winlogon.exe for the logged in user or reboot the Server to resolve this.

Not sure if this is applicable : http://support2.microsoft.com/kb/2383928 as mine is a DC and not a Terminal Server.

Hi Arun,

Since the server is not a remote desktop session host, therefore the KB is not applicable.

Do you have any third party software installed on the server?

I have seen similar issues solved by disable third party software.

Best Regards,

Amy

Hi,

There are no third party Software other than the default required one like Sophos and Symantec Backup client.

Is it fine to disable the SENS on a 2008 R2 Forest Root Domain Controller, if that would fix the issue ?

Now we have to disconnect the session, login as a different user and kill the winlogon process for the previously logged in user.

Thanks,

Arun

Hi Arun,

It is only a possibility, you can try to disable third party software to see if it works.

Does this issue happen to all users or only specific users?

If this issue only happens to specific users, then it could be caused by their user profiles. You can create new user profiles for them to test.

Best Regards,

Amy

• Edited by Amy Wang_Moderator 3 hours 28 minutes ago

Hi,

The third party Software present is Sophos and disabling this will leave this Server in risk.

This error happens to any domain admin user logging off from the Server.

Is it fine to disable the SENS on a 2008 R2 Forest Root Domain Controller, if that would fix the issue ?

Regards,