Issue with winlogon on Remote Desktop Services:

Hi Kris,

Given the correlation between TerminalServices-LocalSessionManager Event ID 36 and Winlogon Event ID 4005, I'd focus on what happens during the session initialization rather than Winlogon itself.

A few areas I'd investigate:

• Verify the server is fully patched with the latest Windows Server 2019 cumulative updates, as several RDS stability fixes have been included over time.
• Review whether CyberArk PSM components, endpoint security/EDR, or credential providers are injecting into the logon process. Third-party authentication hooks can sometimes introduce delays or deadlocks during session initialization.
• Monitor LSASS, Winlogon, and TermService resource utilization when the issue occurs. Intermittent CPU, memory, or handle exhaustion can prevent new sessions while existing sessions continue to function normally.
• Capture an ETW trace or use ProcMon during a failure window to identify where the session initialization is stalling. The Event IDs indicate where the failure surfaces, but not necessarily the underlying cause.
• If this only affects new sessions, I'd also review RDS limits (maximum sessions, disconnected session cleanup, ephemeral port exhaustion, and GPOs affecting session creation).

Since you mentioned the issue resembles the old Server 2012 RDS deadlock, it would also be worth opening a Microsoft support case with the ETW traces and memory dumps. Even if the root cause is different, the telemetry will help determine whether you're encountering a regression in the RDS session initialization path or an interaction with a third-party component such as CyberArk.