Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9009 Source: DesktopWindowManager

The Desktop Window Manager has exited with code (0x40010004).
Error code : 0x40010004 - For us, the problem came from a bad remoteapp RDP package. We have regenerated it and the problem was solved. We suspect an automatic update of the software which changed the exe file called by the RDP package.
This is happening on a Windows Vista Home computer. It happens right before the computer performs a shutdown and it may indicate that there was some sort of problem during the shutdown process that requested interaction with the user (such us confirmation of forcefully closing some applications, etc.). Look for other events that may provide additional information. In our case we had event id 1074 from USER32, saying that the shutdown had been initiated by the process C:\Windows\system32\winlogon.exe.
Error code 0x88980406 - I found an additional event (id 9020) that indicated that the Window Desktop Manager has encountered a fatal error. I may be related to a faulty driver.
Some users discovered that on Citrix servers (Windows 2008 Server 32bit and XenAPP 5.0), this issue occurs when Fair Sharing of CPU between Sessions is turned on. When the CPU utilization has been disabled (with the server having two CPUs), the problem was fixed. See CTX120258 for information about CPU sharing.

In most cases, event id 9003 is also recorded, but that is just an informational event recording the fact that themes cannot be used.

See EV100200 and EV100201 for two discussion threads about this type of problem on Citrix Support Forum.
Citrix releases some hotfixes for similar problems: "Launched Applications Disappear when Using CPU Sharing Based on Resource Allotments with Preferential Load Balancing"

LIMITED RELEASE - Hotfix XAE500W2K8013 - For Citrix XenApp 5.0 for Windows Server 2008 x86 - CTX121648 (requires Citrix login):

Starting the CPU Management Service on a single processor system can cause published applications to fail intermittently. This fix introduces support for the following registry key to exclude the processes you specify from optimization:

On 32-bit Windows:

Name: ProcessesToExclude
Data: <path to process to be excluded; path to process to be excluded>

On 64-bit Windows:

Name: ProcessesToExclude
Data: <path to process to be excluded; path to process to be excluded>

This event shows up in Windows Server 2008 if you have enabled the Desktop Experience feature and are using the Aero theme then try and RDP to the server. Currently Windows Server 2008 does not support Aero (Glass or Basic) over RDP like Vista does so the DWM that drives Aero quits when the RDP connection is opened.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.