1. Join Date : Aug 2015
    Norwich, UK
    Posts : 33
    Windows 10 Pro
       12 Aug 2016 #1

    Event Viewer queries on my Windows 10 laptop


    I have been looking through my Windows 10 (14393) Event Log lately and see a lot of errors that I would like to get cleaned up if possible, and was hoping I could have some advice on why they might be occurring and how to fix them?

    The main ones occurring consistently are ESENT (ID varies), Kernel-PNP (219) and DistributedCOM (10010 and 10016).

    The most common are ESENT and DistributedCOM errors and I would like to fix them if possible:

    DistributedCOM error:

    ID 10010 - "The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout."

    ID 10016 - "The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160}
    and APPID
    {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
    to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool."


    These above happen multiple times a day.

    Kernel-PNP

    ID 219 - "The driver \Driver\WudfRd failed to load for the device ROOT\WPD\0000."

    ESENT Errors

    ID 508 - "SettingSyncHost (568) {464A087D-ED25-4EFB-8D27-26C8A01E5F89}: A request to write to the file "C:\Users\Alex\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb" at offset 16384 (0x0000000000004000) for 16384 (0x00004000) bytes succeeded, but took an abnormally long time (15 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem."

    ID 489 - "SettingSyncHost (568) An attempt to open the file "C:\Users\Alex\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\meta.edb" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8)."

    ID 507 - "RemindersServer (5336) CortanaCoreInstance: A request to read from the file "C:\Users\Alex\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ESEDatabase _CortanaCoreInstance\CortanaCoreDb.dat" at offset 278528 (0x0000000000044000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (17 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem."

    ID 507 - "svchost (4444) Unistore: A request to read from the file "C:\Users\Alex\AppData\Local\Comms\UnistoreDB\store.vol" at offset 7667712 (0x0000000000750000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (18 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem."

    ID 636 - "wuaueng.dll (1144) SUS20ClientDataStore: Flush map file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.jfm" will be deleted. Reason: ReadHdrFailed."

    ID 640 - "wuaueng.dll (1144) SUS20ClientDataStore: Error -1919 validating header page on flush map file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.jfm". The flush map file will be invalidated. Additional information: [SignDbHdrFromDb:Create time:08/10/2016 23:27:45.874 Rand:339180914 Computer:] [SignFmHdrFromDb:Create time:08/10/2016 23:27:45.868 Rand:82576924 Computer:] [SignDbHdrFromFm:Create time:08/10/2016 23:28:02.533 Rand:2986111576 Computer:] [SignFmHdrFromFm:Create time:08/10/2016 23:28:05.669 Rand:1313424785 Computer:]"

    These are just a few examples of the errors that are constantly appearing in the event log viewer multiple times daily. I don't know if they are impacting performance but I would certainly like to rule them out. Anyone have any ideas how?

    Any help much appreciated.

    Alex

    Click image for larger version. 

Name:	event.jpg 
Views:	4 
Size:	315.2 KB 
ID:	95678
      My System SpecsSystem Spec


  2. Join Date : Jan 2015
    UK, Midlands
    Posts : 6,191
    Win 10 Pro (1607)
       12 Aug 2016 #2

    Hi, just a couple of thoughts..
    1. Start with basics:
    From an elevated command prompt run
    chkdsk c: /F
    Post back the result, which you can get after a restart as follows:
    How do I see the results of a CHKDSK that ran on boot? - Ask Leo!

    Considering those related to Windows update, you could try this:
    Windows Update - Reset in Windows 10 - Windows 10 Forums
    http://www.thewindowsclub.com/softwa...der-in-windows
      My System SpecsSystem Spec


  3. Join Date : Aug 2015
    Norwich, UK
    Posts : 33
    Windows 10 Pro
       12 Aug 2016 #3

    Thanks for the speedy response, Dalchina.

    I have run all sorts of disk checks recently and they all come back OK, but I did run another one as you requested, and here is the report:


    Checking file system on C:
    The type of the file system is NTFS.
    Volume label is ACER.




    A disk check has been scheduled.
    Windows will now check the disk.


    Stage 1: Examining basic file system structure ...
    676352 file records processed. File verification completed.
    17332 large file records processed. 0 bad file records processed.
    Stage 2: Examining file name linkage ...
    873822 index entries processed. Index verification completed.
    0 unindexed files scanned. 0 unindexed files recovered to lost and found.
    Stage 3: Examining security descriptors ...
    Cleaning up 77 unused index entries from index $SII of file 0x9.
    Cleaning up 77 unused index entries from index $SDH of file 0x9.
    Cleaning up 77 unused security descriptors.
    Security descriptor verification completed.
    98736 data files processed. CHKDSK is verifying Usn Journal...
    36626904 USN bytes processed. Usn Journal verification completed.


    Windows has scanned the file system and found no problems.
    No further action is required.


    717603985 KB total disk space.
    260677932 KB in 521192 files.
    342764 KB in 98737 indexes.
    0 KB in bad sectors.
    811585 KB in use by the system.
    65536 KB occupied by the log file.
    455771704 KB available on disk.


    4096 bytes in each allocation unit.
    179400996 total allocation units on disk.
    113942926 allocation units available on disk.


    Internal Info:
    00 52 0a 00 36 73 09 00 7b 46 11 00 00 00 00 00 .R..6s..{F......
    5b 52 00 00 1b 00 00 00 00 00 00 00 00 00 00 00 [R..............


    Windows has finished checking your disk.
    Please wait while your computer restarts.

    Is there anything else I can look at? All of these errors are filling my Event Viewer and they are bugging me somewhat. Especially the DistributedCOM and ESENT ones.

    Hope someone can help me resolve these

    Thanks
      My System SpecsSystem Spec


  4. Join Date : Jan 2015
    UK, Midlands
    Posts : 6,191
    Win 10 Pro (1607)
       13 Aug 2016 #4

    Ok, have you looked at the other two links I posted?

    Note that each fault type requires separate thought analysis and action as you may appreciate.

    The hardware issues do seem disconcerting. Don't know what exactly to suggest there.
    A web search suggests some ideas:
    How can I test for hardware failures in my computer?
    Pc-CheckĀ® Diagnostic Software
    Use This Powerful System Tool to Check Windows Hardware | Gizmo's Freeware
    How To Test Your PC For Failing Hardware
    How to Identify Which Hardware Component is Failing in Your Computer
      My System SpecsSystem Spec


  5. Join Date : Aug 2015
    Norwich, UK
    Posts : 33
    Windows 10 Pro
       13 Aug 2016 #5

    dalchina said: View Post
    Ok, have you looked at the other two links I posted?

    Note that each fault type requires separate thought analysis and action as you may appreciate.

    The hardware issues do seem disconcerting. Don't know what exactly to suggest there.
    A web search suggests some ideas:
    How can I test for hardware failures in my computer?
    Pc-CheckĀ® Diagnostic Software
    Use This Powerful System Tool to Check Windows Hardware | Gizmo's Freeware
    How To Test Your PC For Failing Hardware
    How to Identify Which Hardware Component is Failing in Your Computer
    I somehow didn't see the other two links that you posted. I will have a look at them and see if I can find any solutions.

    Do you think I can rule the hard disk out as the problem? I have done disk checks and RAM checks and there doesn't appear to be anything wrong with the hardware.
      My System SpecsSystem Spec


  6. Join Date : Jan 2015
    UK, Midlands
    Posts : 6,191
    Win 10 Pro (1607)
       13 Aug 2016 #6

    I would suggest the obvious- focus on the most frequently occurring hardware-related report, and try to get further information on that. Work with the report detail.

    Run stress tests on your PC as per suggestions above.

    If you wanted some sort of reference, you could, say, swap out your disk and install Windows alone, see what event viewer says then.

    You might prefer this view of the event log using freeware: note no hardware related reports there.
    Click image for larger version. 

Name:	Snap 2016-08-13 at 14.23.11.jpg 
Views:	3 
Size:	123.2 KB 
ID:	95883
      My System SpecsSystem Spec


  7. Join Date : Aug 2015
    Norwich, UK
    Posts : 33
    Windows 10 Pro
       17 Aug 2016 #7

    Thanks for the reply again Dalchina.

    I have noticed something about this specific DCOM error during my investigations:

    The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {D63B10C5-BB46-4990-A94F-E40B9D520160}
    and APPID
    {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
    to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


    It occurs every single time I lock the system (windows logo + L), without fail. This may be linked in with the lock screen problems I have been having.

    Having looked around, I find the guides on fixing this error look quite complex. Does anyone have any basic guides for doing so? This error is clearly related to either the lock screen or locking the PC, has anyone else experienced this?

    Alex

    UPDATE:

    I gave one of the guides online a go for this and managed to sort it I think as the error no longer appears. But two issues:


    1) My system seems sluggish since doing this - I followed the guides properly, was there anything else I was supposed to do at the end? I set the permissions for the CLSID and the APPID in regedit back to TrustedInstaller

    2) A new 10016 error!

    The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
    and APPID
    {F72671A9-012C-4725-9D2F-2A4D32D65169}
    to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    These are different APPIDs and CLSIDs and I can't find a guide for this one regarding the DCOMCNFG part of the process. The error in my initial thread related to Runtime Broker. What does this latest one refer to?

    Thanks for any advice



    Last edited by alexncfc; 17 Aug 2016 at 13:20. Reason: UPDATE
      My System SpecsSystem Spec


  8. Join Date : Aug 2015
    Posts : 3
    win 10
       06 Oct 2016 #8

    I have been having the exact same problems as you show for the last few... months now with the /unistore/DB error event id 532 and the DCOM with the exact same keys you show above.

    I have tried to modify the permissions as per several articles on the web trying both my admin name and TrustedInstaller, both with no effect, the errors still keep coming. Apart from the mass of events recorded (> 1000) there doesn't seem to be any effect on my PC. However, like you I would like to get to the bottom of this. Any constantly recurring error CAN'T be good.... can it?
      My System SpecsSystem Spec


  9. Join Date : Jan 2015
    UK, Midlands
    Posts : 6,191
    Win 10 Pro (1607)
       07 Oct 2016 #9

    Hi, you might try- nothing to lose- Tweaking.com's free cautious repair tool.
    Observing the cautious steps, apply registry permissions repairs only, then, if you feel appropriate, other permissions repairs.
      My System SpecsSystem Spec


  10. Join Date : Aug 2015
    Posts : 3
    win 10
       10 Oct 2016 #10

    Good call dalchina. Downloaded Tweaking.com's prog and gave it a whirl. It actually fixed a number of minor issues which were bugging me such as 'Tile' issues and fixed them.

    I 'think' it also speeded up the PC just a tad however, I got carried away and decided to set up chkdisk at next startup and Bamm....... Had a few issues, the main being the PC would not boot into windows. Got stuck on 10% for 3hrs. Eventually I powered off then went back in and cancelled the chkdisk feature.

    For a while the "The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
    and APPID
    {F72671A9-012C-4725-9D2F-2A4D32D65169}
    to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool." Error disappeared but after next boot is back,

    It doesn't seem to affect much, but, it is still an 'error'.

    Wish I could find the answer.

    Thanks for your help anyway.
      My System SpecsSystem Spec


 


Similar Threads
Thread Forum
Event Viewer - Clear All Event Logs in Windows
How to Clear All Event Logs in Event Viewer in Windows Event Viewer is a tool that displays detailed information as event logs about significant events on your PC. Event logs are special files that record significant events on your PC, such as...
Tutorials
A couple of event queries
In the last weeks I had been experiencing numerous errors showing up in Event Viewer. The retained Win 7 files, now deleted, seem to have reduced those a great deal. Two in particular persist. 1. The app didn't start. See the...
General Support
Event Viewer Errors: SettingSyncHost, Source ESENT, Event 467
Hello everyone, I keep seeing this error appear several times a day, even during idle, in my Event Viewer. I did a clean install of build 10586 less than a month ago. I'm not having any overt issues yet, but the error is disturbing. ...
General Support
Event Viewer Errors: SettingSyncHost, Source ESENT Event 467
EDIT: ARGH, sorry, meant to post this in General Discussion forum, I have no idea if it is a network issue. Hello everyone, I keep seeing this error appear several times a day, even during idle, in my Event Viewer. I did a clean install of...
Network and Sharing
Event ID 5 Kernel-General error in Event Viewer
Welcome, I have a problem. Every day I have this error in event viewer, system log: {Registry Hive Recovered} Registry hive (file):\??\C:\ProgramData\Malwarebytes\Malwarebytes...
AntiVirus, Firewalls and System Security
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 18:47.
Find Us
Twitter Facebook Google+



Windows 10 Forums