The Windows logon process has unexpectedly terminated

Hi

I am struggling to find the right forum for this to go in, so please point me in the right direction if necessary.

I have an Azure hosted Windows server, running as an RDS host for a business application and Office/Outlook for a number of users. Clients log on using RDP from mostly thin clients and some laptops. The server is running 2012 R2 Datacenter and was built from a standard Azure template.

Periodically user logons are failing and I am having to reboot the server to correct the issue. Winlogon Event ID 4005 "The Windows logon process has unexpectedly terminated" is showing in the application event log each time a logon fails. I can't spot any suspicious events logged between the previous most recent successful login and when logins start failing.

Can anyone help shed any light on this?

Thanks,

Lindsay

Lindsay