New
#11
Nice work.
Run the beta log collector and post a zip into this thread
BSOD - Posting Instructions - Windows 10 Forums
https://www.tenforums.com/attachment...-v2-beta15.zip
(extract all > open)
@zbook - have been exploring this with Bree and Caledon Ken- similar observations on 1803 and 1709.For the registry backup via task scheduler a computer with windows 1703 displayed 9/26/2018; one with 1803 displayed 9/27/2018 and the one that was upgraded to 1809 displayed: 11/30/1999 (not yet run)
None of these were scheduled.
Prompted by this thread I recalled I'd found (1709) there was no trigger as you show. I added 'run at system startup' and find the files are updated only (it seems so far) on the first restart of the day. (I have fast startup disabled, if that's at all significant here).
Caledon Ken could not get the task to run and update files yesterday- I've asked him to check after the first restart today.
Bearing in mind that using this registry backup is a widely posted fix, useful in particular circumstances, I'm wondering if perhaps MS has removed the trigger either because they think a registry backup is obsolete, slows boot, or perhaps the task is not reliable in all circumstances. Bug or design change?
Bree noted the default last run date for a new 1809 installation was 1999... perhaps indicating when it was introduced first. I have wondered if it's a relic of 'Last Known Good Configuration'.
dalchina,
A computer failed to upgrade from Windows 1703 to 1803.
Microsoft provides free support for upgrade failures.
This includes remote access.
As a troubleshooting step Microsoft level 2 made permission changes in the registry.
Before making the changes they made backup to the applicable portion of the registry.
A full registry backup was an option but they chose the specific backup.
It's unclear why the tool is not used more often but it may be because most end users are discouraged from modifying the registry and system restore is within the Windows advanced troubleshooting menu?
Can you advise how to turn on Registry backup?
Don't quite see where you're coming from there.
Point is, that task used to run routinely, so a recent backup of the registry is available.
That there was such a thing at all is curious, as there's no easy way to know about it or use it.
But plenty of articles refer to using the registry backup.. it just now seems it may be disabled by having had the trigger removed.
I don't understand the relevance of your first 5 or so sentences to the general case I'm discussing. I think we're talking at cross purposes here. Sorry about that. Anyway, don't worry about it- not important.
Copying over Registry files saved this installation. There was no other fix.
I found this quite easy: simply add a trigger to the task RegIdleBackup in the Task scheduler (under Microsoft - Windows- Registry) for that to run at startup.
Another member tried that yesterday but nothing seemed to happen. I have an as yet unproven theory that the action is only effective on the first restart of the day. If you try to run it manually, it won't succeed because of the protection that exists.
You can check the effect by looking at this (you can see mine has been updated today)
Another possibility is that MS has killed this off in 1803 on in some other way. Uncertain at this point.
The logs displayed corruption of the drive file system and bsod.
There were many chkdsk repairs.
The computer had been having bsod with the last logged report on 9/29/2018
Bugchecks were BE and 116.
1) In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings
a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery into the thread.
b) > on the advanced tab under performance > click on settings > under performance options > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory tab into the thread
2) Download and install Everything:
voidtools
3) Use everything to search for: win32k.sys-20181006-1946.dmp
Zip the file and post a share link into the thread using one drive, drop box, or google drive
win32k.sys-20181006-1946.dmp 10/6/2018 8:59:54 PM 355.96
4) Open administrative command prompt and type or copy and paste:
5) sfc /scannow
6) dism /online /cleanup-image /restorehealth
7) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread
8) chkdsk /r /v
Run this command on all partitions using the syntax: chksk /r /v C: or chdsk /r /v D: changing the drive letter to the applicable partition
This may take many hours so plan to run overnight.
C:\WINDOWS\system32>chkdsk /r /v
The type of the file system is NTFS.
Cannot lock current drive.
Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)
Type: Y
reboot
9) Use the txt and images in this thread to find the chkdsk reports in the event viewer > copy and paste > notepad > post a share link into the thread using one drive, drop box, or google drive
10) Run HD Tune on all drives (free version)
Post images of the test resuts for these tabs:
a) Health (SMART)
b) Benchmark
c) Full error scan
11) Turn off Windows fast startup:
Turn On or Off Fast Startup in Windows 10 | Windows 10 Tutorials
12) After performing all of the above steps the startup and recovery system failure settings will be modified. Then update the backup image. Make a brand new restore point.
13) See if you can use the computer applications in a similar fashion to late September to reproduce bsod.
If you are unable to produce bsod you can wait for the next bsod or use windows driver verifier to find any misbehaving drivers.
Enable and Disable Driver Verifier in Windows 10 | Windows 10 Tutorials
Driver Verifier-- tracking down a mis-behaving driver. - Microsoft Community
14) Open device manager > click view > show hidden devices > manually expand all rows > look for any row with a yellow triangle and black exclamation mark or unknown device > post images into the thread
15) Uninstall and reinstall the Logmein software:
LogMeIn 4.1.5022 LogMeIn, Inc.
LogMeIn Client 1.3.1648 LogMeIn, Inc.
Code:Standard PS/2 Keyboard ACPI\PNP0303\4&2E2B2FDC&0 This device is not present, is not working properly, or does not have all its drivers installed.Code:9/29/2018 10:26 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 116 P2: 8ac374e0 P3: 8d7c1db0 P4: 0 P5: d P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\092918-29125-01.dmp \\?\C:\WINDOWS\TEMP\WER-189015-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C72.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C92.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CFF.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D1F.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_116_fc62659ad61a6a6435083245fa606d1a943d74_00000000_cab_02ab1d2e Analysis symbol: Rechecking for solution: 0 Report Id: f445cfb4-6e35-4955-8b59-8795b9fbabaf Report Status: 4 Hashed bucket: Cab Guid: 0 7/17/2018 6:37 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ba758fc P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-25437-01.dmp \\?\C:\WINDOWS\TEMP\WER-28765-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4CB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF51A.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D4.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF604.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_ed914ce9399550e26a1f306e472391d41bae859_00000000_cab_02c5f622 Analysis symbol: Rechecking for solution: 0 Report Id: 29376a6b-fe9f-4b2b-8dac-8a3c9494694b Report Status: 100 Hashed bucket: Cab Guid: 0 7/17/2018 6:23 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ba758fc P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-25437-01.dmp \\?\C:\WINDOWS\TEMP\WER-28765-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4CB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF51A.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D4.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF604.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_ed914ce9399550e26a1f306e472391d41bae859_00000000_cab_02c5f622 Analysis symbol: Rechecking for solution: 0 Report Id: 29376a6b-fe9f-4b2b-8dac-8a3c9494694b Report Status: 100 Hashed bucket: Cab Guid: 0 7/17/2018 6:22 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ba758fc P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-25437-01.dmp \\?\C:\WINDOWS\TEMP\WER-28765-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4CB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF51A.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D4.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF604.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_ed914ce9399550e26a1f306e472391d41bae859_00000000_cab_02c5f622 Analysis symbol: Rechecking for solution: 0 Report Id: 29376a6b-fe9f-4b2b-8dac-8a3c9494694b Report Status: 100 Hashed bucket: Cab Guid: 0 7/17/2018 6:14 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ba758fc P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-25437-01.dmp \\?\C:\WINDOWS\TEMP\WER-28765-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4CB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF51A.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D4.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF604.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_ed914ce9399550e26a1f306e472391d41bae859_00000000_cab_02c5f622 Analysis symbol: Rechecking for solution: 0 Report Id: 29376a6b-fe9f-4b2b-8dac-8a3c9494694b Report Status: 100 Hashed bucket: Cab Guid: 0 7/17/2018 5:49 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ba758fc P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-25437-01.dmp \\?\C:\WINDOWS\TEMP\WER-28765-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4CB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF51A.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D4.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF604.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_ed914ce9399550e26a1f306e472391d41bae859_00000000_cab_02c5f622 Analysis symbol: Rechecking for solution: 0 Report Id: 29376a6b-fe9f-4b2b-8dac-8a3c9494694b Report Status: 100 Hashed bucket: Cab Guid: 0 7/17/2018 5:39 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ba758fc P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-25437-01.dmp \\?\C:\WINDOWS\TEMP\WER-28765-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4CB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF51A.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D4.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF604.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_ed914ce9399550e26a1f306e472391d41bae859_00000000_cab_02c5f622 Analysis symbol: Rechecking for solution: 0 Report Id: 29376a6b-fe9f-4b2b-8dac-8a3c9494694b Report Status: 100 Hashed bucket: Cab Guid: 0 7/17/2018 5:37 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ba758fc P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-25437-01.dmp \\?\C:\WINDOWS\TEMP\WER-28765-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4CB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF51A.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D4.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF604.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_ed914ce9399550e26a1f306e472391d41bae859_00000000_cab_02c5f622 Analysis symbol: Rechecking for solution: 0 Report Id: 29376a6b-fe9f-4b2b-8dac-8a3c9494694b Report Status: 100 Hashed bucket: Cab Guid: 0 7/17/2018 5:36 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ba758fc P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-25437-01.dmp \\?\C:\WINDOWS\TEMP\WER-28765-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4CB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF51A.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D4.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF604.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_ed914ce9399550e26a1f306e472391d41bae859_00000000_cab_02c5f622 Analysis symbol: Rechecking for solution: 0 Report Id: 29376a6b-fe9f-4b2b-8dac-8a3c9494694b Report Status: 100 Hashed bucket: Cab Guid: 0 7/17/2018 5:36 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ba758fc P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-25437-01.dmp \\?\C:\WINDOWS\TEMP\WER-28765-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4CB.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF51A.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D4.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF604.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_ed914ce9399550e26a1f306e472391d41bae859_00000000_cab_02c5f622 Analysis symbol: Rechecking for solution: 0 Report Id: 29376a6b-fe9f-4b2b-8dac-8a3c9494694b Report Status: 4 Hashed bucket: Cab Guid: 0 7/17/2018 6:37 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ce53024 P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-23968-01.dmp \\?\C:\WINDOWS\TEMP\WER-25984-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6107.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6175.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6D7A.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6DC9.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_c916466a622e561a1c5f19812650285841a62542_00000000_cab_02cd6df7 Analysis symbol: Rechecking for solution: 0 Report Id: 885fee41-41b2-44b8-9b8b-29cecb8a55fe Report Status: 100 Hashed bucket: Cab Guid: 0 7/17/2018 6:23 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ce53024 P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-23968-01.dmp \\?\C:\WINDOWS\TEMP\WER-25984-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6107.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6175.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6D7A.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6DC9.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_c916466a622e561a1c5f19812650285841a62542_00000000_cab_02cd6df7 Analysis symbol: Rechecking for solution: 0 Report Id: 885fee41-41b2-44b8-9b8b-29cecb8a55fe Report Status: 100 Hashed bucket: Cab Guid: 0 7/17/2018 6:23 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 124 P2: 0 P3: 8ce53024 P4: 0 P5: 0 P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\071718-23968-01.dmp \\?\C:\WINDOWS\TEMP\WER-25984-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6107.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6175.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6D7A.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6DC9.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_124_c916466a622e561a1c5f19812650285841a62542_00000000_cab_02cd6df7 Analysis symbol: Rechecking for solution: 0 Report Id: 885fee41-41b2-44b8-9b8b-29cecb8a55fe Report Status: 4 Hashed bucket: Cab Guid: 0 9/29/2018 8:20 PM Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: be P2: af356012 P3: 3ffe5021 P4: b5c8f950 P5: b P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\092918-19046-01.dmp \\?\C:\WINDOWS\TEMP\WER-171031-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE015.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE035.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0A2.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0D2.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_be_18d2c1a9c301866264cc8243341b4c475df8789_00000000_cab_02b2e0e0 Analysis symbol: Rechecking for solution: 0 Report Id: 054afcdd-1615-4c6d-87c6-99e7e5481ddb Report Status: 4 Hashed bucket: Cab Guid: 0Code:9/29/2018 10:27 PM Windows Error Reporting Fault bucket 0x116_TdrBCR:D_Tdr:2_IMAGE_igdkmd32.sys_GEN3.5_DX9_RINGERROR, type 0 Event Name: BlueScreen Response: Not available Cab Id: eec8cd91-5532-4986-afa3-7668aa9b7050 Problem signature: P1: 116 P2: 8ac374e0 P3: 8d7c1db0 P4: 0 P5: d P6: 10_0_17134 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\092918-29125-01.dmp \\?\C:\WINDOWS\TEMP\WER-189015-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C72.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C92.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CFF.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D1F.tmp.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_116_fc62659ad61a6a6435083245fa606d1a943d74_00000000_cab_1e7f5e2e Analysis symbol: Rechecking for solution: 0 Report Id: f445cfb4-6e35-4955-8b59-8795b9fbabaf Report Status: 268435456 Hashed bucket: Cab Guid: 0Code:Event[1974]: Log Name: System Source: Microsoft-Windows-Kernel-General Date: 2018-10-06T18:16:25.265 Event ID: 5 Task: N/A Level: Error Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: MEETINGROOM Description: {Registry Hive Recovered} Registry hive (file): '\??\Volume{8b573ad7-0000-0000-0000-100000000000}\System Volume Information\SystemRestore\New-software' was corrupted and it has been recovered. Some data might have been lost.Code:Event[1745]: Log Name: System Source: Ntfs Date: 2018-09-29T20:39:45.390 Event ID: 55 Task: N/A Level: Error Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: MEETINGROOM Description: A corruption was discovered in the file system structure on volume C:. A corruption was found in a file system index structure. The file reference number is 0x3500000000010b. The name of the file is "\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-3482173909-2635372711-1078958036-1000\ReadOnly\LockScreen_O". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".Code:Event[888]: Log Name: System Source: Microsoft-Windows-Kernel-Boot Date: 2018-09-29T11:39:26.435 Event ID: 29 Task: N/A Level: Error Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: MEETINGROOM Description: Windows failed fast startup with error status 0xC000007B.Code:Event[1919]: Log Name: System Source: Service Control Manager Date: 2018-10-06T18:07:03.397 Event ID: 7000 Task: N/A Level: Error Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: MEETINGROOM Description: The LMIRfsDriver service failed to start due to the following error: LMIRfsDriver is not a valid Win32 application.Code:LMIRfsDriver.sys RemotelyAnywhere Mirror Miniport Driver or LogMeIn Mirror Miniport Driver https://secure.logmein.com/US/home.aspxCode:Event[1796]: Log Name: System Source: Ntfs Date: 2018-09-30T12:42:49.104 Event ID: 130 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: MEETINGROOM Description: The file system structure on volume C: has now been repaired. Event[1797]: Log Name: System Source: Ntfs Date: 2018-09-30T12:42:49.107 Event ID: 132 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: MEETINGROOM Description: Too many repair events have occurred in a short period of time. Temporarily suspending posting of further repair events.Code:Operating System: Windows 10 Pro 32-bit (10.0, Build 17134) (17134.rs4_release.180410-1804)