chkdsk /r came back clean
I think I have made some progress with with identifying the problem but not sure of the cause or solution as yet
I have these 2 events spamming app event log (I copied the evtx logs to my laptop to view)
Still googling this right now. Possible bad sectors ? Even though chkdsk said it was fine
Code:
Log Name: ApplicationSource: Application ErrorDate: 12/11/2017 14:23:28Event ID: 1000Task Category: Application Crashing EventsLevel: ErrorKeywords: ClassicUser: N/AComputer: D-PCDescription:Faulting application name: LogonUI.exe, version: 10.0.15063.0, time stamp: 0xccf07184Faulting module name: MrmCoreR.dll, version: 10.0.15063.608, time stamp: 0x4f0e5e1cException code: 0xc0000006Fault offset: 0x0000000000035f18Faulting process ID: 0x6a4Faulting application start time: 0x01d35bc1ceea67adFaulting application path: C:\WINDOWS\system32\LogonUI.exeFaulting module path: C:\Windows\System32\MrmCoreR.dllReport ID: 0a9527cf-3ee5-43b1-830d-2d86ef620aefFaulting package full name: Faulting package-relative application ID: Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Application Error" /> <EventID Qualifiers="0">1000</EventID> <Level>2</Level> <Task>100</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2017-11-12T14:23:28.326464100Z" /> <EventRecordID>190012</EventRecordID> <Channel>Application</Channel> <Computer>D-PC</Computer> <Security /> </System> <EventData> <Data>LogonUI.exe</Data> <Data>10.0.15063.0</Data> <Data>ccf07184</Data> <Data>MrmCoreR.dll</Data> <Data>10.0.15063.608</Data> <Data>4f0e5e1c</Data> <Data>c0000006</Data> <Data>0000000000035f18</Data> <Data>6a4</Data> <Data>01d35bc1ceea67ad</Data> <Data>C:\WINDOWS\system32\LogonUI.exe</Data> <Data>C:\Windows\System32\MrmCoreR.dll</Data> <Data>0a9527cf-3ee5-43b1-830d-2d86ef620aef</Data> <Data> </Data> <Data> </Data> </EventData></Event>
Code:
Log Name: ApplicationSource: Application ErrorDate: 12/11/2017 14:23:28Event ID: 1005Task Category: Application Crashing EventsLevel: ErrorKeywords: ClassicUser: N/AComputer: D-PCDescription:Windows cannot access the file C:\Windows\SystemResources\Windows.UI.Logon\pris\Windows.UI.Logon.en-GB.pri for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program Windows Logon User Interface Host because of this error.Program: Windows Logon User Interface HostFile: C:\Windows\SystemResources\Windows.UI.Logon\pris\Windows.UI.Logon.en-GB.priThe error value is listed in the Additional Data section.User Action1. Open the file again. This situation might be a temporary problem that corrects itself when the program runs again.2. If the file still cannot be accessed and - It is on the network, your network administrator should verify that there is not a problem with the network and that the server can be contacted. - It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.4. If the problem persists, restore the file from a backup copy.5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for further assistance. Additional DataError value: C0000242Disk type: 3Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Application Error" /> <EventID Qualifiers="49152">1005</EventID> <Level>2</Level> <Task>100</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2017-11-12T14:23:28.326464100Z" /> <EventRecordID>190013</EventRecordID> <Channel>Application</Channel> <Computer>D-PC</Computer> <Security /> </System> <EventData> <Data>C:\Windows\SystemResources\Windows.UI.Logon\pris\Windows.UI.Logon.en-GB.pri</Data> <Data>Windows Logon User Interface Host</Data> <Data>C0000242</Data> <Data>3</Data> </EventData></Event>