Windows Event ID 1125 – User32: User Logon Session Notification

Start by examining the event details in Event Viewer to understand the context and timing of the session notification.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter for Event ID 1125 by right-clicking System → Filter Current Log
4. Enter 1125 in the Event IDs field and click OK
5. Double-click on recent Event ID 1125 entries to examine details including timestamp, process ID, and session information
6. Note the frequency and timing patterns of these events relative to user logon activities

Use PowerShell to analyze Event ID 1125 patterns and correlate with other authentication events for comprehensive session monitoring.

1. Open PowerShell as Administrator
2. Query recent Event ID 1125 occurrences:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1125} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize

3. Analyze event frequency over the past 24 hours:

   $events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1125; StartTime=(Get-Date).AddDays(-1)}
   $events | Group-Object {$_.TimeCreated.Hour} | Sort-Object Name

4. Correlate with successful logon events:

   $logonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-2)}
   $sessionEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1125; StartTime=(Get-Date).AddHours(-2)}
   Compare-Object $logonEvents.TimeCreated $sessionEvents.TimeCreated

5. Export events for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1125} -MaxEvents 100 | Export-Csv -Path "C:\temp\Event1125_Analysis.csv" -NoTypeInformation

Monitor session establishment performance by tracking Event ID 1125 timing relative to other logon events to identify potential bottlenecks.

1. Enable detailed logon auditing in Group Policy:
   Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Logon/Logoff
2. Create a PowerShell monitoring script:

   $scriptBlock = {
       $events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1125; StartTime=(Get-Date).AddMinutes(-5)}
       foreach ($event in $events) {
           Write-Host "Session notification at $($event.TimeCreated) - Process ID: $($event.ProcessId)"
       }
   }
   Register-ScheduledJob -Name "Monitor1125" -ScriptBlock $scriptBlock -Trigger (New-JobTrigger -RepeatInterval (New-TimeSpan -Minutes 5) -RepeatIndefinitely -At (Get-Date))

3. Check User32 service status and dependencies:

   Get-Service | Where-Object {$_.Name -like "*User*" -or $_.DisplayName -like "*User*"}
   Get-WmiObject Win32_Service | Where-Object {$_.Name -eq "Themes"} | Select-Object Name, State, StartMode

4. Monitor session establishment timing:

   $startTime = Get-Date
   $events1125 = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1125; StartTime=$startTime.AddMinutes(-10)}
   $events4624 = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$startTime.AddMinutes(-10)}
   $timeDiff = ($events1125.TimeCreated - $events4624.TimeCreated).TotalSeconds
   Write-Host "Average session notification delay: $($timeDiff) seconds"

Examine registry settings and system configuration that affect User32 session notifications and authentication processes.

1. Check User32 service registration in registry:

   Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\Themes" -Name DisplayName, Start, Type

2. Review session manager configuration:

   Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" -Name GlobalFlag, CriticalSectionTimeout

3. Examine authentication package settings:HKLM\SYSTEM\CurrentControlSet\Control\Lsa
   Check the Authentication Packages and Security Packages values
4. Verify User32 DLL integrity:

   sfc /verifyfile=C:\Windows\System32\user32.dll
   Get-FileHash -Path "C:\Windows\System32\user32.dll" -Algorithm SHA256

5. Check for Group Policy settings affecting logon:

   gpresult /r /scope:computer
   gpresult /h "C:\temp\GPReport.html"

Use Event Tracing for Windows (ETW) and advanced diagnostic tools to capture detailed session establishment data when Event ID 1125 patterns indicate issues.

1. Enable User32 ETW tracing:

   wevtutil sl Microsoft-Windows-User32/Diagnostic /e:true
   wevtutil sl Microsoft-Windows-Winlogon/Diagnostic /e:true

2. Create custom ETW trace session:

   logman create trace "SessionTrace" -p "Microsoft-Windows-User32" 0xFFFFFFFF 0xFF -o "C:\temp\SessionTrace.etl" -ets
   logman create trace "WinlogonTrace" -p "Microsoft-Windows-Winlogon" 0xFFFFFFFF 0xFF -o "C:\temp\WinlogonTrace.etl" -ets

3. Reproduce the logon scenario and stop tracing:

   logman stop "SessionTrace" -ets
   logman stop "WinlogonTrace" -ets

4. Analyze trace files using Windows Performance Toolkit:

   wpa.exe "C:\temp\SessionTrace.etl"

5. Generate comprehensive system report:

   msinfo32 /report "C:\temp\SystemInfo.txt"
   Get-ComputerInfo | Out-File "C:\temp\ComputerInfo.txt"
   Get-EventLog -LogName System -After (Get-Date).AddDays(-1) | Where-Object {$_.EventID -in @(1125, 4624, 4634)} | Export-Csv "C:\temp\AuthEvents.csv"