Log Name: Application Source: Microsoft-Windows-Winlogon Date: 9/25/2014 9:48:05 PM Event ID: 6005 Task Category: None Level: Warning Keywords: Classic User: N/A Computer: Server.INTERNAL Description: The winlogon notification subscriber <Sens> is taking long time to handle the notification event (Logoff) Log Name: Application Source: Microsoft-Windows-EventSystem Date: 8/22/2014 11:32:47 AM Event ID: 4627 Task Category: Firing Agent Level: Warning Keywords: Classic User: N/A Computer: Server.INTERNAL Description: The COM+ Event System timed out attempting to fire the Logon method on event class (D5978650-5B9F-11D1-8DD2-00AA004ABD5E) for publisher and subscriber . The subscriber failed to respond within 180 seconds. The display name of the subscription is "User Monitor Subscription". The HRESULT was 800705b4.
Receiving the above errors on Application logs, and when running : sc queryex sens
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 972
Had to kill the PID , winlogon.exe for the logged in user or reboot the Server to resolve this.
Not sure if this is applicable : http://support2.microsoft.com/kb/2383928 as mine is a DC and not a Terminal Server.