Windows Logon Switching

Applies To: Windows Server 2008

Windows logon switching controls the process by which the desktop is prepared and presented to different user accounts. Preparing the desktop includes assigning system and network resources, loading the startup program, and establishing user credentials and privilege level. 

Windows logon switching is handled by User Account Control when switching occurs between currently logged on user accounts.

Events

Event ID Source Message

4004

Microsoft-Windows-Winlogon

The Windows logon process has failed to terminate currently logged on user's processes.

4007

Microsoft-Windows-Winlogon

The Windows logon process has failed to disconnect the user session.

Windows Logon

Core Security