Event 1796 TPM-WMI

RickC said:

I'm beginning to see a lot of reports emerging about this. From what I read, I'm guessing that Microsoft's algorithm to determine which devices are OK to implement the Secure Boot update is possibly faulty.

What's worrying is that there are reports of BSODs and 'failures to boot' as well as the Event ID 1796 errors reported in this thread.

One thing that is fairly consistent is agreement that an out-of-date BIOS/UEFI may be a cause. As a result, it appears important, when posting about Event ID 1796 errors, to also include the following information:

1. Make/model of your device.
2. BIOS/UEFI date.
3. Whether your device uses UEFI or Legacy BIOS mode to boot.
4. If UEFI mode, whether Secure Boot is enabled.

So I've been tearing my hair out for a few months (probably since this was announced after discovering this retrospectively Microsoft Updating Windows Secure Boot Keys in 2024 -- Redmondmag.com) and I've signed up to these forums specifically for this post. I have a Clevo which randomly started having issues booting up. I sometimes get a POST screen, sometimes I get nothing which made me wonder if the GFX or PSU were on the way out, tried HDMI out no signal to monitor. Trouble is many times even though the screen is blank, keyboard RGB backlight works, keyboard and mouse respond and I can hear Windows sounds so the proverbial lights are on but no one is home. Usually it takes a few force power off and back on situations and I can somehow get it back as if nothing was wrong.

I got to the point I backed everything up and then formatted the NVME and put a fresh Win 10 install on yesterday, ran latest updates but the problem persisted. I checked event viewer and it was easy to see because I shut it off at around 9.30PM last night and didn't try turning it on again until 2PM today.. that's when I came across about a $hiteload of critical system errors in event viewer:

Code:

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service DispBrokerDesktopSvc with arguments "Unavailable" in order to run the server:
DispBrokerDesktop.GlobalBrokerInstance

EVENT 7001, SERVICE CONTROL MANAGER: The Dhcp service depends on the AFD service which failed to start because of the following error: 
A device attached to the system is not functioning.

EVENT 7001, SERVICE CONTROL MANAGER: The nsi service depends on the nsiproxy service which failed to start because of the following error: 
A device attached to the system is not functioning.

EVENT 7001, SERVICE CONTROL MANAGER:  The Dnscache service depends on the AFD service which failed to start because of the following error: 
A device attached to the system is not functioning.

EVENT 7001, SERVICE CONTROL MANAGER:  The Wcmsvc service depends on the nsi service which failed to start because of the following error: 
The dependency service or group failed to start.

EVENT 7001, SERVICE CONTROL MANAGER: The WlanSvc service depends on the Wcmsvc service which failed to start because of the following error: 
The dependency service or group failed to start.

EVENT 7001, SERVICE CONTROL MANAGER: The LanmanWorkstation service depends on the nsi service which failed to start because of the following error: 
The dependency service or group failed to start.

EVENT 7001, SERVICE CONTROL MANAGER: The WinHttpAutoProxySvc service depends on the Dhcp service which failed to start because of the following error: 
The dependency service or group failed to start.

EVENT 7001, SERVICE CONTROL MANAGER: The Netman service depends on the nsi service which failed to start because of the following error: 
The dependency service or group failed to start.

EVENT 7001, SERVICE CONTROL MANAGER: The NlaSvc service depends on the Dhcp service which failed to start because of the following error: 
The dependency service or group failed to start.

EVENT 7001, SERVICE CONTROL MANAGER: The iphlpsvc service depends on the WinHttpAutoProxySvc service which failed to start because of the following error: 
The dependency service or group failed to start.

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service RmSvc with arguments "Unavailable" in order to run the server:
{581333F6-28DB-41BE-BC7A-FF201F12F3F6}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service WpnUserService_336d0 with arguments "Unavailable" in order to run the server:
{1FFE4FFD-25B1-40B1-A1EA-EF633353BB4E}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service WpnUserService_336d0 with arguments "Unavailable" in order to run the server:
{D18705BE-FC2F-44C8-AEFF-1CD49AEA8FC1}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

EVENT 10005, DISTRIBUTED COM: DCOM got error "1084" attempting to start the service WpnUserService_336d0 with arguments "Unavailable" in order to run the server:
{D18705BE-FC2F-44C8-AEFF-1CD49AEA8FC1}

EVENT 1796, TPM-WMI:The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931

https://i.imgur.com/BlyKnf4.png
https://i.imgur.com/UaC3MSb.png

Now as you can see I got hundred of these messages and heaps of the TPM-WMI messages, consistently spread out so it's a recurring issue. My first thought jumped back to KB5028997 which was an issue for me, but being a fresh install now should have eliminated this issue. That's why now I'm guessing this is BIOS/Microsoft related or potentially a piece of hardware on the way out. Given nothing has changed, my HW is not overclocked and not excessively overused and is connected to a power protected UPS I also have my doubts about shorts or surge related issues.

So when I checked the TPM-WMI and came across this thread it's made me consider the Secure Boot and BIOS as a more likely source now. I've checked Clevo's website and realise I have the wrong BIOS loaded so I'm going to try updating it now. I'm also going to try and see if the VBIOS has any newer updates and try loading that too. I might trying reinstalling Windows and updating drivers from Clevo first rather than letting Windows do any HW driver updates. I'll check back here with my results shortly. Basically my last attempt at resolution will be to get the BIOS & VBIOS correct, if it keeps occurring I'll try enabling Secure Boot to see if that resolves it. If not then I think I'll have to go down the path of checking hardware for faults.

I very much doubt I'll get a new BIOS from Clevo, think the last update was circa 2018...
Tried troubleshooting as best I can, very open to any suggestions for further troubleshooting & TIA.

Make/model of your device: Clevo P750DM3-G (2016)
BIOS/UEFI date: ALASKA - 1072009 1.06.11 American Megatrends - 5000C
Firmware Boot Mode: The mainboard's firmware mode is: UEFI
Secure Boot status: False

adzify106 said:

I very much doubt I'll get a new BIOS from Clevo, think the last update was circa 2018...

As far as I can make out from the Clevo Computer support site the last BIOS/UEFI update for your Clevo P750DM3-G was 2017... but I could be wrong.

Follow the top link: To the downloads/Server:

Don't use the next link down... it takes you to a Taiwan address (which didn't work for me).

Once you get to the public HiDrive share, drill down through BIOS and EC Firmware > CLEVO.

Note the How to Flash with UEFI CLEVO Laptops Instructions text file.

Find the ZIP file for your laptop. I'm afraid you'll just have to search for it.

That's all I can offer. I haven't experienced this issue myself (as my laptops run in 'Legacy BIOS' mode) so don't have any further relevant experience or information.

Hope this helps...

Thanks for that so I've got the correct FW updated to the latest version updated now, there were no newer VBIOs updates so I just re-flashed it just in case.
Interestingly the BIOS update has rolled back the KBC/EC FW to a lower level was on 1.06.09 and is now 1.06.06.

If it doesn't happen again then we know it's def BIOS related, if it happens again I'll report back and try the following:
1. Reinstall Windows with manufacturer HW drivers only, and if that fails;
2. Enable Secure Boot, and if that fails;
3. Troubleshoot hardware.

Fingers-crossed!

- - - Updated - - -

Don't want to jinx it but after multiple shut-down and wakes from sleep haven't had the issue occur again.

Also managed to install Cumulative Update 2024-05 KB5037849 without any issues, keeping my fingers crossed although I'm still receiving TPM-WMI and DCOM errors in event viewer.

adzify106 said:

Don't want to jinx it but after multiple shut-down and wakes from sleep haven't had the issue occur again.

Also managed to install Cumulative Update 2024-05 KB5037849 without any issues, keeping my fingers crossed although I'm still receiving TPM-WMI and DCOM errors in event viewer.

Fingers crossed...

In my experience, DCOM errors are 'normal' and a regular occurrence - error-free event viewer logs are as rare as unicorns. I only pay attention when there's both an error AND an issue. Life's too short to waste time tracking down every time Windows burps.

So I wiped my event log and shutdown last night. Booted laptop on this morning and bam! Happened again.

Checked event viewer and found:
System ON
2:07:58 Event 29 - Kernel-Boot: Windows failed fast startup with error status 0xC00000D4.
2:08:01 Event 219 - Kernel-PnP: The driver \Driver\WudfRd failed to load for the device USB\VID_06CB&PID_0078\b3a09800462e.
2:08:05 Event 1796 - TPM-WMI: The Secure Boot update failed
2:08:10 Event 1282 - TPM-WMI: The TBS device identifier has been generated.
2:08:11 Event 1025 - TPM-WMI: The TPM was successfully provisioned and is now ready for use.
2:11:38 Event 36871 - Schannel: A fatal error occurred while creating a TLS client credential. The internal error state is 10013.
2:12:00 - Sometime here is when the screen is blank and I have to force the system off.

So based on that Event 29 I've disabled fast startup and Hibernate, I'll see how that goes. Failing this I'll have to push on and try wiping OS update drivers manually from OEM and block WU from updating via OS.. don't know if anything above is of use.