New
#1
Mystery shut downs on 1903--help me diagnose!
Summary:
My laptop sometimes mysteriously shuts down, and I have no idea why.
I need advice on trouble shooting this, especially seeing if my Windows event logs hold any clues.
Details:
I have a 7 month old Dell Precision 7530 laptop. It is running Windows 10 Pro for Workstations version 1903 patched thru the latest updates. If Dell Command update is to be believed, all my hardware related software (e.g. BIOS, drivers) is also fully patched.
Several times in the last couple of weeks I have come back to my laptop after being away for several hours only to find it shut down. And I mean, totally shut down, not in sleep or hibernation: after pressing on the power button it boots up and no programs are there, like it was a clean start.
The last 2 times this happened were sometime early Sunday morning (1 day ago, between ~02:30 and ~10:37) and sometime later on again on Sunday (perhaps ~10:50); more on those times below.
In the first case, I started a backup process around 02:30 before going to bed. When I came to my laptop at ~10:30, it was shut down. Had to press the power key to get it running once more. Minutes after it booted, I needed to leave the house.
When I was next able to return to my laptop in the afternoon, around ~14:40, it was again shut down just like in the morning.I started examining my Windows event logs for clues.
This link led to this link which had some suggestions. One way is to use Event Viewer; good tutorial for this is here. Another way is to execute the program TurnedOnTimesView. However, to get text output for this post, yet another way is to execute this in Powershell:
The relevant part of the output for the 2 mystery shut downs on Sunday are these lines:Code:Get-WinEvent -FilterHashtable @{Logname='System';ID=6006,6008,1074}
Those 2 6008 Error lines are surely the 2 mystery shut downs, but other than give me the time, they are not telling me anything! I have no idea what process caused this!Code:ProviderName: EventLog TimeCreated Id LevelDisplayName Message ----------- -- ---------------- ------- 2019-06-23 14:42:05 6008 Error The previous system shutdown at 10:36:59 AM on ?6/?23/?2019 was unexpected. 2019-06-23 10:36:59 6008 Error The previous system shutdown at 6:42:46 AM on ?6/?23/?2019 was unexpected. 2019-06-23 01:20:37 6006 Information The Event log service was stopped.
Because I use BitLocker to fully software encrypt my SSD, I have disabled all Sleep, and only allow Hibernate; see this link.
This may be unrelated, but I should mention that this evening my Start Menu and search bar stopped working! Clicking on them did nothing I have never experienced this before. Found a web link that suggested ctrl-alt-delete and then sign out. That cured it, altho it forcefully killed some processes that I would have preferred to manually gracefully terminate.
I do not see either shut downs or loss of Start Menu in Brink's list of open 1903 issues.
My symptoms are distinct from the shut down issues reported in this post.
This post suggested to execute in an elevated cmd shell
I examined the report, but it did not tell me anything new.Code:powercfg /SYSTEMPOWERREPORT
- - - Updated - - -
As a followup to my original post, I opened Event Viewer -> Windows Logs --> System and started looking for suspects. Below are some of the things that I found. Nothing stands out as a cause to me, but maybe it will to someone more experienced.
Critical logs:
I see one Event ID 41 at 10:36:49 with the message
Code:The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Error logs:
I see bursts of Event ID 2505; i think that all have the message
I see a few Event ID 4207; I think that all have the messageCode:The server could not bind to the transport \Device\NetBT_Tcpip_{5F182740-E841-4CF8-A439-D3F5954BA1C2} because another computer on the network has the same name. The server could not start.I see a few Event ID 5010; I think that all have the messageCode:The IPv6 TCP/IP interface with index 17 failed to bind to its provider.I see one Event ID 7000 with the messageCode:Intel(R) Wireless-AC 9260 160MHz : The network adapter has returned an invalid value to the driver.
There may be more; I am doing this manually...Code:The DellWAL service failed to start due to the following error: The system cannot find the file specified.
Warning logs:
I see a few Event ID 219; they have different messages, for example
orCode:The driver \Driver\WudfRd failed to load for the device ACPI\INT3400\2&daba3ff&0.
Code:The driver \Driver\WudfRd failed to load for the device USB\VID_0A5C&PID_5832&MI_01\6&528937a&0&0001.
I see a few Event ID 10016; they have different messages, for example
orCode:The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Code:The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.