Source: Microsoft-Windows-Winlogon ; EventSourceName="Wlclntfy"

Question

Installed Windows 7 Professional O.E.M. Dell, from a USB.

Now after Windows Updates (about 6 hrs from 3:pm to almost 10:pm) last night, (now it is downloading more, at this minute), I get this message inside of the event viewer. I did a registry search and only found 1 instance of 'Wlclntfy' which is supposed to be a .Dll file. I also searched dir /s /a Wlclntfy*.* but found nothing. No Such File. Not even wlc*.* found.

Here is one Event viewer post:

Log Name: Application

Source: Microsoft-Windows-Winlogon

Date: 11/23/2019 10:38:33 AM

Event ID: 6000

Task Category: None

Level: Information

Keywords: Classic

User: N/A

Computer: VSSHER-PC

Description:

The winlogon notification subscriber < SessionEnv > was unavailable to handle a notification event.

Event Xml:

Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"

System

Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy"

EventID Qualifiers="32768" 6000

Version 0

Level 4

Task 0

Opcode 0

Keywords 0x80000000000000

TimeCreated SystemTime="2019-11-23T15:38:33.000000000Z"

EventRecordID 1052

Execution ProcessID="0" ThreadID="0"

Channel Application

Computer VSSHER-PC

EventData

Data SessionEnv

Binary D9060000

I have searched this site, a lot of people have the same question, but have yet to find an answer. Has anyone heard of or seen before?

Someone posting the same said it might have been from an update which only should have installed on Server 2008.

I would appreciate the help. Thanks in advance.

Answer 1

I use NTRegOpt or ERUNT to backup my registry. I run it to save the hives and compress the registry. This saves the hives next to the originals. I have also used others, Run a linux repair disk and rename the hives if needed to replace the Windows Registry. You must replace them all... Also I have created an image of the system on a seperate partition. It saved 'System Reserve' and C:\Win7....

This is for Windows SP1 Professional for those of us who had problems with

< SessionEnv > "Wlclntfy" File Not FOUND, etc. (Please read above question)

Only for people who have knowledge of the Windows Registry.

Remove only SessionEnv items.

Example:

Winlogon\Notifications\Components\SessionEnv]

Remove the whole key, but backup every key first.

If there is a multi String value such as "netsvcs" SessionEnv,*

ONLY REMOVE Session,

@Moab This is the Wlclntfy.txt file which was available, via your link

---

Fix for "Wlclntfy"

BACKUP YOUR SYSTEM AND THEN BACKUP THE ENTIRE REGISTRY.....

1. Search windows updates for KB2775511. If found uninstall.

2. Now the hard part. Run Regedit as administrator.

3. Search for sessionenv. Delete all instances everywhere.

You will be denied access in some cases so you will need to

set "persmissions" by choosing properties and changing the

owner from TrustedInstaller to you. Then delete.

4.This is time consuming especially if you have more than

sessionenv, i.e. dot3svc and wlansvc errors.

These must be removed also using the procedure.

---