Windows Stop Code 0x00000046: DEREF_UNKNOWN_LOGON_SESSION

Quick Answer

DEREF_UNKNOWN_LOGON_SESSION (0x00000046) is a Windows stop code that Microsoft describes as very infrequent. Its dedicated documentation confirms the name and value but does not provide a detailed cause, parameter definitions, or a specific repair procedure. The name alone does not establish a damaged user profile, incorrect password, or compromised account. Microsoft Learn

If the crash repeats, record when it occurs, review recent system changes, and preserve a crash dump. This guide provides initial recovery steps for users and a diagnostic path for IT support.

What Microsoft Documents

Although the name refers to logon-session handling, Microsoft’s published description does not identify a particular account, service, or driver responsible for an individual crash. Diagnosis requires evidence from the affected system. Microsoft Learn

Before You Begin

• Back up important files before changing drivers or recovery settings.
• Record the complete stop code, crash time, and any displayed driver filename.
• Note whether the crash occurs during startup, sign-in, sign-out, or another operation.
• Record recent driver, application, and Windows updates.
• Have administrator access available for driver rollback.
• Keep the BitLocker recovery key available before entering recovery options. support.microsoft.com

For a managed computer, coordinate changes to security or authentication software with IT support. The stop code alone does not justify deleting a profile, resetting credentials, or changing domain membership.

Recommended Troubleshooting

1. Establish the Crash Pattern

Record what happened immediately before each crash and whether the same action reproduces it.

A crash during sign-in is useful timing information. It does not, by itself, prove that the user account caused the failure.

2. Review Recent Changes

Compare the first crash with recent hardware installations, driver updates, and software changes.

If newly added external hardware is a plausible lead:

1. Shut down the PC.
2. Disconnect the new device, provided Windows does not depend on it to start.
3. Restart and observe whether the same error returns.

Removing recently added hardware is part of Microsoft’s general stop-error troubleshooting. support.microsoft.com

3. Roll Back a Relevant Driver Update

If timing or dump evidence points to a recently updated driver:

1. Right-click Start and select Device Manager.
2. Open the affected device’s Properties.
3. Select Driver > Roll Back Driver, when available.
4. Follow the prompts and restart if requested.

If rollback is unavailable or unsuitable, obtain a compatible driver through Windows Update or the manufacturer’s official website. Match the package to the device and Windows version. support.microsoft.com

Make one targeted change at a time. If the change causes a new problem, restore the previous driver where possible or reinstall the appropriate vendor package.

4. Install Applicable Windows Updates

In Windows 11, open Settings > Windows Update > Check for updates. Install applicable updates and restart when required.

This is general stop-error troubleshooting. Microsoft does not document a particular update as a universal fix for 0x46. support.microsoft.com

If Windows Cannot Start Normally

1. Access the Windows Recovery Environment.
2. Select Troubleshoot > Advanced options > Startup Settings > Restart.
3. Press 4 or F4 to enable Safe Mode.
4. Investigate or reverse the suspected recent change.
5. Restart normally to test.

Safe Mode starts Windows with a limited set of drivers and services. An encrypted device may request its BitLocker recovery key. These menu steps apply to current Windows versions; older versions can differ. support.microsoft.com

Advanced Troubleshooting: Analyze the Crash Dump

Preserve the Relevant Dump

Common default locations are:

A dump exists only if Windows was configured and able to write it. learn.microsoft.com

Run WinDbg Analysis

Open the dump in WinDbg with appropriate symbols and run:

!analyze -v

Review the stop code, call stack, module information, and captured arguments alongside the recent-change history. This command provides diagnostic information; it does not repair Windows. learn.microsoft.com

Microsoft does not publish 0x46-specific parameter meanings. Do not interpret its arguments using another bug check’s parameter table. A module appearing in the stack also requires investigation before being treated as the cause. Microsoft Learn

A small dump can omit information needed for diagnosis. If analysis is inconclusive, support personnel may request a more complete capture. learn.microsoft.com

How to Verify the Fix

1. Restart Windows normally after the targeted correction.
2. Repeat the operation that previously preceded the crash.
3. Confirm that sign-in, affected devices, and applications function correctly.
4. Monitor across multiple sessions if the failure was intermittent.
5. Preserve the newest dump if the error returns.

A successful restart alone does not establish that an intermittent crash has been resolved.

Frequently Asked Questions

Does this mean my password is incorrect?

No such conclusion follows from the stop code. Microsoft documents it as a system bug check and does not identify a password problem as its cause. Microsoft Learn

Should I delete and recreate my Windows profile?

The code alone does not justify that action. Preserve the profile and its data while investigating the crash.

Does “unknown logon session” prove unauthorized access?

No. The stop-code name is not evidence of an intrusion. Investigate security concerns using separate account and security-log evidence.

Should I remove security software?

Only when diagnostic evidence supports investigating that product, and then through its supported procedure. On managed systems, involve IT support before making changes.

What should I provide to technical support?

Provide the Windows version, computer model, crash times, reproduction steps, recent changes, and WinDbg findings. Share the dump through an approved support channel.

Conclusion

For recurring DEREF_UNKNOWN_LOGON_SESSION crashes, preserve evidence and investigate recent changes. Microsoft provides limited detail for this rare code, so use crash analysis to guide corrections rather than making account or profile changes based on the name.

Sources

• Microsoft Learn — Bug Check 0x46: DEREF_UNKNOWN_LOGON_SESSION.
• Microsoft Learn — Stop code error or bug check troubleshooting.
• Microsoft Learn — Small Memory Dump.
• Microsoft Support — Update drivers through Device Manager in Windows.
• Microsoft Support — Windows startup settings.
• Microsoft Support — Troubleshooting Windows unexpected restarts and stop code errors.