Issue with winlogon on Remote Desktop Services:

Hi kris1975, I’d correlate the failed sessions by exact timestamp across LocalSessionManager, Winlogon, Security, and User Profile Service logs. Event 4005 often points to the logon process failing after the session starts, so I’d also check profile loading, GPO processing, credential provider/CyberArk components, and any antivirus exclusions on the RDS hosts. A test host with the same baseline but without the PSM layer would help separate Windows/RDS from CyberArk-specific behavior.