EventID 6003 - The winlogon notification subscriber was unavailable to handle a critical notification event.

31 May 2016

We updated one of our Citrix XenApp servers and this message started flooding our Application event log:
“The winlogon notification subscriber was unavailable to handle a critical notification event."

So what’s going on here?

Examining the registry on a ‘good’ working system and the ‘bad’ system revealed the following:

2</p>

Good TrustedInstaller - No Error 6003

 

1</p>

Bad TrustedInstaller - Error 6003

How did that value get there?

It turns out we installed Internet Explorer 11 with our patch cycle - but that in and of itself did not cause our issue. Additional components for IE 11 were installed as well:
3

“Microsoft Windows English Spelling Package” and “Microsoft Windows English Hyphenation Package”

Neither of these packages are present on any of the ‘working’ systems. I tested to determine which of them placed the registry key there…

It turns out both of them do. If you uninstall *either* package it will remove the ‘CreateSession’ value. Since these packages are not in our standard build we are removing both.