New Windows 10 user is logged out immediately after login

6

The problem

I have a Windows 10 laptop with 2 accounts, an administrator and a non-adminitrator. This has worked perfectly for almost a year now. Recently I created a 3rd account, as non-administrator. This account is logged off as soon as the password is confirmed, so I never see the desktop.

Windows event log

To see what Windows event log can tell about this, I did the following test: At 09:44:23 I tried to login on the new account, which failed. At 09:44:27 I logged in on an existing account, which worked.

From System log

09:44:23 Winlogon - event 7001, info (bad login)
09:44:24 Service Control Manager - event 7023, error
09:44:24 DistributedCOM - event 10016, error
09:44:24 DistributedCOM - event 10016, error
09:44:27 Winlogin - event 7002, info (good login)

From Program log

09:44:23 User Profile Service - event 1542, error "Windows cannot read registration database for classes. File not found" (my Translation) -- this error 3 times.
09:44:24 Winlogon - event 6000, info (also present on good login)
09:44:24 igfxCUIService2.0.0.0 - event 0, info (also present on good login)
09:44:24 Winlogin - event 4006, warning "unable to spawn program C:\Windows\System32\userinit.exe" – Peer Sommerlund 20 hours ago  

My attempts at solving it

If I change the user type to administrator, I can log in, but the desktop looks strange.

I have tried deleting the account and creating it again, but the problem persists on any new account I create.

My question

What could I have changed to the system to bring it to this state?

How can I fix the new account so it will work as non-administrator?

Similar solutions found on the net

I found this link, which describes a similar issue. https://answers.microsoft.com/en-us/windows/forum/windows_10-security/windows-10-login-error-keeps-signing-out/f59e6690-20b2-43a4-aad1-2ed1f05c6ba0 My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit key holds C:\Windows\system32\userinit.exe, which works ok for the 2 first accounts (the trailing comma does not appear to cause an issue) so this is not a solution.

Peer Sommerlund

Posted 2017-08-13T09:59:14.270

Reputation: 183

did nullterminatedstring's answer help? – I say Reinstate Monica – 2017-08-16T11:51:41.397

Answers

4

Explanation:

What's the problem?

Your problem is caused by a corrupted NTUSER.DAT file.
Windows creates one user profile folder in C:\Users\ for each user account, excluding special accounts like SYSTEM, and each one of these folders contains a NTUSER.DAT file, which is used to store settings and such things.

Why are only new accounts affected?

Well that's because there's one profile folder called Default which is not associated with any profile instead it gets copied each time a new profile folder is needed to fill that new profile with all necessary files.So every modification/damage of the Default profile will be copied into all new profile folders.

So finally your problem is a corrupted NTUSER.DAT file inside the Default profile folder.

How to fix it?

The only way I know is replacing NTUSER.DAT in the Default profile folder with a fresh one of a new Windows 10 installation or replacing it with a backup. For the first option you will lose some system-wide shortcuts for a program in a new account on the desktop, some system-wide user-specific settings, etc., but it won't affect existing profiles.
Maybe somebody has a better idea.

testeaxeax

Posted 2017-08-13T09:59:14.270

Reputation: 1 315

This solution worked for me: I copied NTUSER.DAT from the existing non-administrator account to Users\Default. Then I created a new non-administrator account. This is acceptable, since I have no data yet in the 3rd account. Out of curiosity, I would still like to know if it is possible to repair the defect NTUSER.DAT - apparently something related to access control is triggering the behaviour as the account works when it has administrator rights. – Peer Sommerlund – 2017-08-16T13:06:47.307

@PeerSommerlund You can't repair the file because normally you don't know what exactly is corrupted.Windows shows that specific logout behavior only in case NTUSER.DAT's header is corrupted, for example if you remove a bunch of random bytes in the first 4096 bytes of the file like I did for testing.The different behavior of admin and non-admin accounts is most likely caused by the "higher failsafeness" of admin accounts, they're supposed to work in as many situations as possible as they're essential for maintenance/recovery. – testeaxeax – 2017-09-09T16:32:53.147