Windows 10 Event Log Errors

From Indie IT Wiki
Revision as of 10:23, 21 September 2021 by Gcoles (talk | contribs) (→‎Error 10016)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Fully Clear Event Log

  • Open a command prompt (ensure it is run as Administrator)
  • Run the following command and then reboot:
 for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

Log Reading Utility

http://www.resplendence.com/whocrashed

-

Source – Event ID – Task Category

Kernel-EventTracing - 3 - Session

As is relates to C:\WINDOWS\system32\WDI\LogFiles\ShutdownCKCL.etl

Increase the maximum files size of the Startup Event Trace Sessions.

  • On the desktop, press Windows key + R and type cmd to open the Command Prompt (must be done in Administrator profile, or raised to Administrator via the Start Menu).
  • Type 'perfmon' (without the quotes)
  • The Performance Monitor window should open
  • On the left panel of the Performance Monitor window, expand Data Collector Sets.
  • Click on Startup Event Trace Sessions.
  • Open ReadyBoot Trace Session Property Sheet.
  • Click on the Stop Condition tab and increase the Maximum Size to 40.
  • Click on Apply and OK.

DistributedCOM - 10016 - None

http://www.tomshardware.co.uk/faq/id-3128597/fix-windows-error-10016.html

Kernel-EventTracing - 3 - Session - PerfDiag Logger

  • Open regedit.exe as Administrator
  • Navigate to:
\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}
  • Edit the following keys from 1 to 0
Enabled
EnableProperty

NOTE: This does not cure the error messages, but it prevents them being shown in the event logs.

Thanks to Ten Forums

- -

Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) - 37 - (7)

General (tab) (plain text description):

The speed of processor X in group X is being limited by system firmware. The processor has been in this reduced performance for X seconds since the last report.

Fix - Method One:

Update BIOS/UEFI firmware

Security Center - 16 - None

Error while updating status to SECUIRTY_PRODUCT_STATE_ON (error xxxxxxx).

Microsoft-Windows-AppModel-Runtime - 79 & 80

EventData 

 PackageFamilyName Microsoft.Windows.Photos_8wekyb3d8bbwe 
 ErrorCode 0x3d55

The above is just one example of a programme that may causing the problem.

To fix:

  • Start > Settings > Apps,
  • Find each affected app in the list
  • Click to select it
  • Choose Advanced option
  • Then click 'Terminate' then use the option 'Repair' if it is available, then finish with the 'Reset' option.
  • Restart the system and check the event viewer log.

Error 10016


  • Level - Error
  • Source - Schannel
  • Event ID - 36871

A fatal error occurred while creating a TLS client credential. The internal error state is 10013.

  • Level - Warning
  • Source - User Device Registration
  • Event ID - 360

Windows Hello for Business provisioning will not be launched. Device is AAD joined ( AADJ or DJ++ ): Not Tested User has logged on with AAD credentials: No Windows Hello for Business policy is enabled: Not Tested Windows Hello for Business post-logon provisioning is enabled: Not Tested Local computer meets Windows hello for business hardware requirements: Not Tested User is not connected to the machine via Remote Desktop: Yes User certificate for on premise auth policy is enabled: Not Tested Machine is governed by none policy. Cloud trust for on premise auth policy is enabled: Not Tested User account has Cloud TGT: Not Tested See https://go.microsoft.com/fwlink/?linkid=832647 for more details.

  • Level - Warning
  • Source - DistributedCOM
  • Event ID - 10016

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 

{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}

and APPID 

{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}

to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

  • Level - Warning
  • Source - DeviceSetupManager
  • Event ID - 200 201 202
  • 200 - A connection to the Windows Update service could not be established.
  • 201 - A connection to the Windows Metadata and Internet Services (WMIS) could not be established.
  • 202 - The Network List Manager reports no connectivity to the internet.
Retrieved from ‘https://wiki.indie-it.com/index.php?title=Windows_10_Event_Log_Errors&oldid=1322’