I'm trying to pinpoint a login issue for a user. When RDPing into a Windows Server 2008 R2 server, they got a partial error message saying Login Failed. You are. I assume this is supposed to be You are connected to the remote computer. However, an error occurred while an initial user program was starting, so you are being logged off., which seems to be a possible error message.
I checked into the event logs, and compared a successful authentication from the same user with the failed ones. The sequence of process created events show that in the successful authentication, explorer.exe was started after userinit.exe, then some user specific processes. In the failed authentications, the process sequence stopped as userinit.exe.
Another difference between successful and failed authentications is the start of the Portable Device Enumerator Service service. During successful authentications, it starts normally, while during failed authentications it fails, with the following error message:
The Portable Device Enumerator Service service failed to start due to the following error:
A thread could not be created for the service.
Could this be the cause of the login sequence stopping and the user being unable to login? Or is it more probable that the cause of this error ("a thread could not be created") also caused other issues? And how do I more details about this issue, or even its source?
