Jtdylktuy

When I run Windows Simulator it spins the five blue dots on a black background for a while and then exits silently. However, if I create a new user then that user can launch Windows Simulator without any problems. Clearly there's something about my profile which causes problems, but I'm not sure how to work out what it is. I assume there must be some useful information somewhere.

What I've tried is looking in the Event Viewer. In Windows Logs/Application the only thing which I see is

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

    <System>

        <Provider Name="Desktop Window Manager" /> 

        <EventID Qualifiers="16384">9027</EventID> 

        <Level>4</Level> 

        <Task>0</Task> 

        <Keywords>0x80000000000000</Keywords> 

        <TimeCreated SystemTime="2019-01-09T17:08:03.809094200Z" /> 

        <EventRecordID>17991</EventRecordID> 

        <Channel>Application</Channel> 

        <Computer>dev2</Computer> 

        <Security /> 

    </System>

    <EventData /> 

</Event>

In Windows Logs/Security there's a slew of Logons and Special Logons, followed by three User Account Management events and three Logoffs.

In Applications and Services Logs/Microsoft/Windows/TerminalServices-RemoteConnectionManager/Operational there's

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

    <System>

        <Provider Name="Microsoft-Windows-TerminalServices-RemoteConnectionManager" Guid="{C76BAA63-AE81-421C-B425-340B4B24157F}" /> 

        <EventID>261</EventID> 

        <Version>0</Version> 

        <Level>4</Level> 

        <Task>0</Task> 

        <Opcode>0</Opcode> 

        <Keywords>0x1000000000000000</Keywords> 

        <TimeCreated SystemTime="2019-01-09T17:08:03.442581100Z" /> 

        <EventRecordID>488</EventRecordID> 

        <Correlation ActivityID="{F012F02C-0099-4986-A47B-CBEECD70A9FB}" /> 

        <Execution ProcessID="1356" ThreadID="2180" /> 

        <Channel>Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational</Channel> 

        <Computer>dev2</Computer> 

        <Security UserID="S-1-5-20" /> 

    </System>

    <UserData>

        <EventXML xmlns="Event_NS">

            <listenerName>7A78855482A04FA781DC</listenerName> 

        </EventXML>

    </UserData>

</Event>



<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

    <System>

        <Provider Name="Microsoft-Windows-TerminalServices-RemoteConnectionManager" Guid="{C76BAA63-AE81-421C-B425-340B4B24157F}" /> 

        <EventID>1149</EventID> 

        <Version>0</Version> 

        <Level>4</Level> 

        <Task>0</Task> 

        <Opcode>0</Opcode> 

        <Keywords>0x1000000000000000</Keywords> 

        <TimeCreated SystemTime="2019-01-09T17:08:03.540793100Z" /> 

        <EventRecordID>489</EventRecordID> 

        <Correlation ActivityID="{F012F02C-0099-4986-A47B-CBEECD70A9FB}" /> 

        <Execution ProcessID="1356" ThreadID="17332" /> 

        <Channel>Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational</Channel> 

        <Computer>dev2</Computer> 

        <Security UserID="S-1-5-20" /> 

    </System>

    <UserData>

        <EventXML xmlns="Event_NS">

            <Param1 /> 

            <Param2 /> 

            <Param3 /> 

        </EventXML>

    </UserData>

</Event>

In Applications and Services Logs/Microsoft/Windows/TerminalServices-LocalSessionManager/Operational there's

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

    <System>

        <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5D896912-022D-40AA-A3A8-4FA5515C76D7}" /> 

        <EventID>40</EventID> 

        <Version>0</Version> 

        <Level>4</Level> 

        <Task>0</Task> 

        <Opcode>0</Opcode> 

        <Keywords>0x1000000000000000</Keywords> 

        <TimeCreated SystemTime="2019-01-09T17:08:35.313971200Z" /> 

        <EventRecordID>1236</EventRecordID> 

        <Correlation ActivityID="{F012F02C-0099-4986-A47B-CBEECD70A9FB}" /> 

        <Execution ProcessID="1204" ThreadID="1240" /> 

        <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel> 

        <Computer>dev2</Computer> 

        <Security UserID="S-1-5-18" /> 

    </System>

    <UserData>

        <EventXML xmlns="Event_NS">

            <Session>3</Session> 

            <Reason>12</Reason> 

        </EventXML>

    </UserData>

</Event>

But as far as I can see, none of that tells me why it decided to log off the session.

Where should I look for more detail?