Windows 10 Event Log Errors

From Indie IT Wiki
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

Fully Clear Event Log

  • Open a command prompt (ensure it is run as Administrator)
  • Run the following command and then reboot:
 for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

Log Reading Utility

http://www.resplendence.com/whocrashed

-

Source – Event ID – Task Category

Kernel-EventTracing - 3 - Session

As is relates to C:\WINDOWS\system32\WDI\LogFiles\ShutdownCKCL.etl

Increase the maximum files size of the Startup Event Trace Sessions.

  • On the desktop, press Windows key + R and type cmd to open the Command Prompt (must be done in Administrator profile, or raised to Administrator via the Start Menu).
  • Type 'perfmon' (without the quotes)
  • The Performance Monitor window should open
  • On the left panel of the Performance Monitor window, expand Data Collector Sets.
  • Click on Startup Event Trace Sessions.
  • Open ReadyBoot Trace Session Property Sheet.
  • Click on the Stop Condition tab and increase the Maximum Size to 40.
  • Click on Apply and OK.

DistributedCOM - 10016 - None

http://www.tomshardware.co.uk/faq/id-3128597/fix-windows-error-10016.html

Kernel-EventTracing - 3 - Session - PerfDiag Logger

  • Open regedit.exe as Administrator
  • Navigate to:
\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}
  • Edit the following keys from 1 to 0
Enabled
EnableProperty

NOTE: This does not cure the error messages, but it prevents them being shown in the event logs.

Thanks to Ten Forums

- -

Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) - 37 - (7)

General (tab) (plain text description):

The speed of processor X in group X is being limited by system firmware. The processor has been in this reduced performance for X seconds since the last report.

Fix - Method One:

Update BIOS/UEFI firmware

Security Center - 16 - None

Error while updating status to SECUIRTY_PRODUCT_STATE_ON (error xxxxxxx).

Microsoft-Windows-AppModel-Runtime - 79 & 80

EventData 

 PackageFamilyName Microsoft.Windows.Photos_8wekyb3d8bbwe 
 ErrorCode 0x3d55

The above is just one example of a programme that may causing the problem.

To fix:

  • Start > Settings > Apps,
  • Find each affected app in the list
  • Click to select it
  • Choose Advanced option
  • Then click 'Terminate' then use the option 'Repair' if it is available, then finish with the 'Reset' option.
  • Restart the system and check the event viewer log.

Error 10016


  • Level - Error
  • Source - Schannel
  • Event ID - 36871

A fatal error occurred while creating a TLS client credential. The internal error state is 10013.

  • Level - Warning
  • Source - User Device Registration
  • Event ID - 360

Windows Hello for Business provisioning will not be launched. Device is AAD joined ( AADJ or DJ++ ): Not Tested User has logged on with AAD credentials: No Windows Hello for Business policy is enabled: Not Tested Windows Hello for Business post-logon provisioning is enabled: Not Tested Local computer meets Windows hello for business hardware requirements: Not Tested User is not connected to the machine via Remote Desktop: Yes User certificate for on premise auth policy is enabled: Not Tested Machine is governed by none policy. Cloud trust for on premise auth policy is enabled: Not Tested User account has Cloud TGT: Not Tested See https://go.microsoft.com/fwlink/?linkid=832647 for more details.

  • Level - Warning
  • Source - DistributedCOM
  • Event ID - 10016

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 

{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}

and APPID 

{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}

to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

  • Level - Warning
  • Source - DeviceSetupManager
  • Event ID - 200 201 202
  • 200 - A connection to the Windows Update service could not be established.
  • 201 - A connection to the Windows Metadata and Internet Services (WMIS) could not be established.
  • 202 - The Network List Manager reports no connectivity to the internet.
Retrieved from ‘https://wiki.indie-it.com/index.php?title=Windows_10_Event_Log_Errors&oldid=1322’