6

The problem

I have a Windows 10 laptop with 2 accounts, an administrator and a non-adminitrator. This has worked perfectly for almost a year now. Recently I created a 3rd account, as non-administrator. This account is logged off as soon as the password is confirmed, so I never see the desktop.

Windows event log

To see what Windows event log can tell about this, I did the following test: At 09:44:23 I tried to login on the new account, which failed. At 09:44:27 I logged in on an existing account, which worked.

From System log

09:44:23 Winlogon - event 7001, info (bad login)
09:44:24 Service Control Manager - event 7023, error
09:44:24 DistributedCOM - event 10016, error
09:44:24 DistributedCOM - event 10016, error
09:44:27 Winlogin - event 7002, info (good login)

From Program log

09:44:23 User Profile Service - event 1542, error "Windows cannot read registration database for classes. File not found" (my Translation) -- this error 3 times.
09:44:24 Winlogon - event 6000, info (also present on good login)
09:44:24 igfxCUIService2.0.0.0 - event 0, info (also present on good login)
09:44:24 Winlogin - event 4006, warning "unable to spawn program C:\Windows\System32\userinit.exe" – Peer Sommerlund 20 hours ago  

My attempts at solving it

If I change the user type to administrator, I can log in, but the desktop looks strange.

I have tried deleting the account and creating it again, but the problem persists on any new account I create.

My question

What could I have changed to the system to bring it to this state?

How can I fix the new account so it will work as non-administrator?

Similar solutions found on the net

I found this link, which describes a similar issue. https://answers.microsoft.com/en-us/windows/forum/windows_10-security/windows-10-login-error-keeps-signing-out/f59e6690-20b2-43a4-aad1-2ed1f05c6ba0 My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit key holds C:\Windows\system32\userinit.exe, which works ok for the 2 first accounts (the trailing comma does not appear to cause an issue) so this is not a solution.

4

Explanation:

What's the problem?

Your problem is caused by a corrupted NTUSER.DAT file.
Windows creates one user profile folder in C:\Users\ for each user account, excluding special accounts like SYSTEM, and each one of these folders contains a NTUSER.DAT file, which is used to store settings and such things.

Why are only new accounts affected?

Well that's because there's one profile folder called Default which is not associated with any profile instead it gets copied each time a new profile folder is needed to fill that new profile with all necessary files.So every modification/damage of the Default profile will be copied into all new profile folders.

So finally your problem is a corrupted NTUSER.DAT file inside the Default profile folder.

How to fix it?

The only way I know is replacing NTUSER.DAT in the Default profile folder with a fresh one of a new Windows 10 installation or replacing it with a backup. For the first option you will lose some system-wide shortcuts for a program in a new account on the desktop, some system-wide user-specific settings, etc., but it won't affect existing profiles.
Maybe somebody has a better idea.

| improve this answer | |
  • This solution worked for me: I copied NTUSER.DAT from the existing non-administrator account to Users\Default. Then I created a new non-administrator account. This is acceptable, since I have no data yet in the 3rd account. Out of curiosity, I would still like to know if it is possible to repair the defect NTUSER.DAT - apparently something related to access control is triggering the behaviour as the account works when it has administrator rights. – Peer Sommerlund Aug 16 '17 at 13:06
  • @PeerSommerlund You can't repair the file because normally you don't know what exactly is corrupted.Windows shows that specific logout behavior only in case NTUSER.DAT's header is corrupted, for example if you remove a bunch of random bytes in the first 4096 bytes of the file like I did for testing.The different behavior of admin and non-admin accounts is most likely caused by the "higher failsafeness" of admin accounts, they're supposed to work in as many situations as possible as they're essential for maintenance/recovery. – testeaxeax Sep 9 '17 at 16:32
0

I had a similar issue with a Dell laptop that came preloaded with an HP Image... weird I know (A whole batch too!). Anyway, we researched this over and over and came to the conclusion that it was likely to do with the NTUSER.dat, however in the final stages of research found another issue that is possible;

If you have uninstalled software, in our case it was HP Security Manager, it may not have properly removed the UserInit entry created for it. The below change should hopefully help other users with the same issue searching in the future;

If you can somehow get logged in in safe mode or under an administrator account, check out the registry.

HKLM/Software/Microsoft/Windows NT/CurrentVersion/Winlogon - Look at the UserInit key.

Make sure it doesn't have anything extra in it. It should only contain C:Windows\system3\userinit.exe

In my case it had the following;

C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe

I changed to the following (via an admin account) and it would login to all users normally;

C:\Windows\system32\userinit.exe

Source: https://answers.microsoft.com/en-us/windows/forum/windows_10-security-winpc/user-account-immediately-logged-off-after-entering/36d98832-5313-4b14-a63a-e919dcd201d2 ( Scroll down to the response by 'Normal user name225' )

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.