Elastic Windows Event Explorer


Publisher - LsaSrv

Event ID 6035

Message:

During a logon attempt, the user's security context accumulated too many security IDs. This is a very unusual situation. Remove the user from some global or local groups to reduce the number of security IDs to incorporate into the security context.
User's SID is %{SID}
If this is the Administrator account, logging on in safe mode will enable Administrator to log on by automatically restricting group memberships.

Event Data:

# Name In Type
Out Type
1 SID win:SID xs:string

Observed Windows Versions:

Version: 0

Fingerprint: XBL3J65XPPLNA