Windows Event ID 1704 – Winlogon: User Profile Service Failed

Start by examining the complete event details and related events to understand the scope of the profile failure.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter for Event ID 1704 using the filter option in the Actions pane
4. Double-click the event to view detailed information including the affected user SID
5. Check for related events around the same time, particularly Event IDs 1500, 1502, and 1511
6. Use PowerShell to gather comprehensive event data:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1704} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

7. Export relevant events for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1704} | Export-Csv -Path "C:\Temp\Event1704_Analysis.csv" -NoTypeInformation

Examine and repair corrupted registry entries in the ProfileList key that may be preventing proper profile loading.

1. Open Registry Editor as Administrator by pressing Win + R, typing regedit, and pressing Enter
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
3. Look for duplicate SID entries or entries with .bak extensions
4. Use PowerShell to audit profile registry entries:

   Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" | ForEach-Object { Get-ItemProperty $_.PSPath | Select-Object PSChildName, ProfileImagePath, State }

5. Identify problematic entries where the ProfileImagePath is missing or incorrect
6. For corrupted entries, rename the problematic SID key by adding .old to the end
7. If a .bak version exists, rename it to remove the .bak extension
8. Restart the system and test user logon
9. Verify the fix using PowerShell:

   Get-WmiObject -Class Win32_UserProfile | Where-Object {$_.Special -eq $false} | Select-Object LocalPath, SID, Loaded

Verify that adequate disk space exists and that proper permissions are set on user profile directories.

1. Check available disk space on the system drive:

   Get-WmiObject -Class Win32_LogicalDisk | Where-Object {$_.DriveType -eq 3} | Select-Object DeviceID, @{Name="Size(GB)";Expression={[math]::Round($_.Size/1GB,2)}}, @{Name="FreeSpace(GB)";Expression={[math]::Round($_.FreeSpace/1GB,2)}}

2. Examine user profile directory permissions:

   Get-Acl "C:\Users\*" | Format-Table Path, Owner, AccessToString -Wrap

3. Navigate to C:\Users in File Explorer and verify that user folders exist and are accessible
4. Check for profile folders with unusual names or permissions issues
5. Reset permissions on a problematic user profile folder:

   $ProfilePath = "C:\Users\[USERNAME]"\nicacls $ProfilePath /reset /T /C

6. Verify the User Profile Service is running:

   Get-Service -Name "ProfSvc" | Select-Object Name, Status, StartType

7. If the service is stopped, start it:

   Start-Service -Name "ProfSvc"

8. Monitor disk space usage during profile loading:

   while ($true) { Get-WmiObject -Class Win32_LogicalDisk | Where-Object {$_.DriveType -eq 3} | Select-Object DeviceID, @{Name="FreeSpace(GB)";Expression={[math]::Round($_.FreeSpace/1GB,2)}}; Start-Sleep 30 }

Use Windows built-in tools to rebuild a corrupted user profile while preserving user data.

1. Create a backup of the user's data before proceeding:

   $SourcePath = "C:\Users\[USERNAME]"\n$BackupPath = "C:\Temp\ProfileBackup_$(Get-Date -Format 'yyyyMMdd_HHmmss')"\nrobocopy $SourcePath $BackupPath /E /COPYALL /R:3 /W:10

2. Log off the affected user and log on as a local administrator
3. Open System Properties by pressing Win + R, typing sysdm.cpl, and pressing Enter
4. Click the Advanced tab, then click Settings under User Profiles
5. Select the corrupted profile and click Delete
6. Alternatively, use PowerShell to remove the profile:

   $UserSID = (New-Object System.Security.Principal.NTAccount("[USERNAME]")).Translate([System.Security.Principal.SecurityIdentifier]).Value\nGet-WmiObject -Class Win32_UserProfile | Where-Object {$_.SID -eq $UserSID} | Remove-WmiObject

7. Remove the profile registry entry:

   Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$UserSID" -Recurse -Force

8. Have the user log on again to create a new profile
9. Restore user data from the backup:

   $NewProfilePath = "C:\Users\[USERNAME]"\nrobocopy $BackupPath $NewProfilePath /E /XD "AppData\Local\Temp" "AppData\Local\Microsoft\Windows\Temporary Internet Files" /R:3 /W:10

Perform deep system analysis to identify underlying causes of profile service failures.

1. Download and run Process Monitor (ProcMon) from Microsoft Sysinternals
2. Set filters to monitor Winlogon.exe and related profile processes:

   # Filter for profile-related processes\nProcess Name contains winlogon\nProcess Name contains userinit\nPath contains ProfileList

3. Reproduce the logon issue while ProcMon is running
4. Analyze the captured data for ACCESS DENIED or PATH NOT FOUND errors
5. Run System File Checker to identify corrupted system files:

   sfc /scannow

6. Check the SFC log for details:

   findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > C:\Temp\SFC_Results.txt

7. Run DISM to repair the Windows image if SFC finds issues:

   DISM /Online /Cleanup-Image /RestoreHealth

8. Check Windows Update history for recent changes:

   Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

9. Examine Group Policy settings affecting user profiles:

   gpresult /h C:\Temp\GPResult.html\nInvoke-Item C:\Temp\GPResult.html

10. Test with a new local user account to isolate domain-related issues:

    net user TestUser P@ssw0rd123 /add\nnet localgroup administrators TestUser /add