KB5034441 rabbit hole

zbook · 29 Feb 2024

The clean install created a new recovery partition.

The new log files did not report any immediate problems with:
Event ID: 12 Firmware has corrupted memory
Event ID: 41 rebooted without cleanly shutting down
Event ID: 6008 previous system shutdown was unexpected
Event ID: 1001 bad memory regions

The scripts were designed to run in the background.

Please run tuneup plus to modify the startup and recovery system failure settings so that they are optimal for detecting unexpected shutdowns.

And run the net framework troubleshooter to make sure it is up to date.
https://www.microsoft.com/en-us/down....aspx?id=30135

Run the computer for 5 - 7 days and post a new V2.

If the logs report no significant problems then that will complete the troubleshooting.

tns1 · 01 Mar 2024

The clean install recreated my three original partitions 1)system, 2)OS 3)recovery, and now I have a saved disk image. I can restore easily so I am tempted to try once again to prep the partitions for that update, but why did it fail before?
Diskpart doesn't seem to have a move command, so the steps were to delete, recreate, and format the recovery partition which of course erases the original recovery contents.

Using Gparted I can easily:
1) Shrink the OS partition by 250MB minimum
2) Move the recovery partition over the newly created gap
3) Extend the recovery partition to fill the remainder

Seems to avoid the issues. Is there some reason this won't work? Does moving a recovery partition cause problems?

Pentagon · 01 Mar 2024

Run
1. reagentc /disable
2. diskpart
sel disk 0
sel par 3
delete partition override
exit
Open Diskmanagement

Is there an unallocated space? (black bar) If not, you can forget it!
If yes, rightclick on (C:) and select extend/expand and leave the value as it is.
Then rightclick on (C:) again and select shrink volume and type 1024 (MB)
Then rightclick on unallocated space and create a new volume
assign letter =R and select NTFS Label=Recovery

last step
diskpart
sel disk 0
sel par 3
set id=27
exit
reagentc /enable
verify:
reagentc /info

and all that takes less than 5 minutes!
And why didn't you run the new installation with a bigger Recovery-Partition?

zbook · 01 Mar 2024

tns1 said:

I once again have my three original partitions 1)system, 2)OS 3)recovery, and now I have a saved disk image.

The clean install with updates may have addressed more than one of the prior problems.

Please wait the week to see if the logs report problems related to the recovery partition.

Make sure that there are at least one or more manual updates and reboots.

tns1 · 06 Mar 2024

Dropbox - KB5034441-debug - Simplify your life

TuneupPlus runs cleanly, and I don't see anything unusual in the V2 logs other than a critical error when I tried to run the DotNet troubleshooter. Since my network has never had an issue, and it is a clean install, I suspect the tool itself. Not worth pursuing.

I am reluctant to try what looks like an almost identical set of steps to fix the partition issue, without some reasoning as to why the original steps failed. I have used Gparted to shrink, extend and move partitions before. Is there something special about the recovery partition that it can't be found again if I move it with Gparted as proposed earlier instead of deleting and recreating it? Do you suspect an alignment issue with my earlier attempt?

zbook · 07 Mar 2024

Please open a support ticket with Dell for the firmware error.

Open ACP and copy and paste:

diskpart
sel dis 0
det dis
lis vol
lis par
sel par 1
assign letter=U
sel par 3
assign letter=V
lis vol
lis par

Post a new disk management.

Code:

Event[963]:
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2024-03-01T07:53:21.3400000Z
  Event ID: 12
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: DESKTOP-E52D4Q4
  Description: 
The platform firmware has corrupted memory across the previous system power transition.  Please check for updated firmware for your system.

Code:

Event[1762]:
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2024-03-05T09:06:31.4690000Z
  Event ID: 12
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: DESKTOP-E52D4Q4
  Description: 
The platform firmware has corrupted memory across the previous system power transition.  Please check for updated firmware for your system.

Code:

Event[1570]:
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2024-03-04T19:54:46.3390000Z
  Event ID: 98
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-E52D4Q4
  Description: 
Volume \\?\Volume{7fe07e32-0000-0000-0000-100000000000} (\Device\HarddiskVolume1) needs to be taken offline to perform a Full Chkdsk.  Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via PowerShell.

Code:

Event[676]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2024-02-29T11:13:10.5750000Z
  Event ID: 41
  Task: N/A
  Level: Critical
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-E52D4Q4
  Description: 
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Code:

Event[652]:
  Log Name: System
  Source: EventLog
  Date: 2024-02-29T11:13:27.1100000Z
  Event ID: 6008
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-E52D4Q4
  Description: 
The previous system shutdown at 8:19:33 AM on ?2/?29/?2024 was unexpected.

Code:

Windows has found problems that must be fixed offline.

Code:

SYSTEM PRODUCT NAME	Dell Inc XPS 630i
BIOS	1.0.13 05/05/2009

tns1 · 08 Mar 2024

There was a problem installing Dell SupportAssist and I believe the system became unresponsive and had to be hard reset, explaining both the appcrash report and the unexpected shutdown event. SupportAssist installed OK on 2nd attempt. This is not unique as I have had this happen on other some other Dell PCs. Once installed it ran through its paces fine but didn't find any problems to fix or any newer FW to install.

The error events don't help identify the "platform firmware" causing memory issues. If it is the Bios, 1.0.13 is the latest and there is nothing to be done. Dell support clearly states that W10 is not officially supported, so maybe these error events are examples of that. Outside of these logs there is no obvious problem operating the PC - everything seems to work as it should. Time will tell if new error events are logged.

Attachment 406645

Microsoft Windows [Version 10.0.19045.4123]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>diskpart

Microsoft DiskPart version 10.0.19041.3636

Copyright (C) Microsoft Corporation.
On computer: DESKTOP-E52D4Q4

DISKPART> sel dis 0

Disk 0 is now the selected disk.

DISKPART> det dis

WDC WD10 EZEX-08M2NA0 SCSI Disk Device
Disk ID: 7FE07E32
Type : RAID
Status : Online
Path : 1
Target : 1
LUN ID : 0
Location Path : PCIROOT(0)#PCI(0E00)#RAID(P01T01L00)
Current Read-only State : No
Read-only : No
Boot Disk : Yes
Pagefile Disk : Yes
Hibernation File Disk : No
Crashdump Disk : Yes
Clustered Disk : No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 1 System Rese NTFS Partition 50 MB Healthy System
Volume 2 C NTFS Partition 930 GB Healthy Boot
Volume 3 NTFS Partition 522 MB Healthy Hidden

DISKPART> lis vol

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 E DVD-ROM 0 B No Media
Volume 1 System Rese NTFS Partition 50 MB Healthy System
Volume 2 C NTFS Partition 930 GB Healthy Boot
Volume 3 NTFS Partition 522 MB Healthy Hidden

DISKPART> lis par

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 50 MB 1024 KB
Partition 2 Primary 930 GB 51 MB
Partition 3 Recovery 522 MB 931 GB

DISKPART> sel par 1

Partition 1 is now the selected partition.

DISKPART> assign letter=U

DiskPart successfully assigned the drive letter or mount point.

DISKPART> sel par 3

Partition 3 is now the selected partition.

DISKPART> assign letter=V

DiskPart successfully assigned the drive letter or mount point.

DISKPART> lis vol

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 E DVD-ROM 0 B No Media
Volume 1 U System Rese NTFS Partition 50 MB Healthy System
Volume 2 C NTFS Partition 930 GB Healthy Boot
* Volume 3 V NTFS Partition 522 MB Healthy Hidden

DISKPART> lis par

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 50 MB 1024 KB
Partition 2 Primary 930 GB 51 MB
* Partition 3 Recovery 522 MB 931 GB

DISKPART>

zbook · 08 Mar 2024

Please run:

1) chkdsk /b /v U:

2) chkdsk /b /v V:

3) chkdsk /b /v C: (run overnight)

C:\WINDOWS\system32>chkdsk /b /v C:
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: y

Reboot as needed.

Run: https://www.tenforums.com/attachment...kfromevent.bat

Code:

Event[1639]:
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2024-03-04T19:57:43.2850000Z
  Event ID: 98
  Task: N/A
  Level: Warning
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-E52D4Q4
  Description: 
Volume \\?\Volume{7fe07e32-0000-0000-0000-10c0e8000000} (\Device\HarddiskVolume3) requires an Online Scan.  An Online Scan will automatically run as part of the next scheduled maintenance task.  Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell.

Code:

Event[1574]:
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2024-03-04T19:55:05.7920000Z
  Event ID: 98
  Task: N/A
  Level: Warning
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-E52D4Q4
  Description: 
Volume \\?\Volume{7fe07e32-0000-0000-0000-10c0e8000000} (\Device\HarddiskVolume3) requires an Online Scan.  An Online Scan will automatically run as part of the next scheduled maintenance task.  Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell.

Code:

Event[1570]:
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2024-03-04T19:54:46.3390000Z
  Event ID: 98
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-E52D4Q4
  Description: 
Volume \\?\Volume{7fe07e32-0000-0000-0000-100000000000} (\Device\HarddiskVolume1) needs to be taken offline to perform a Full Chkdsk.  Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via PowerShell.

Code:

Event[954]:
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2024-03-01T07:34:55.6170000Z
  Event ID: 98
  Task: N/A
  Level: Warning
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-E52D4Q4
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy2) requires an Online Scan.  An Online Scan will automatically run as part of the next scheduled maintenance task.  Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell.

tns1 · 08 Mar 2024

Cant run on recovery partition

2) chkdsk /b /v V:
Cannot open volume for direct access

Using diskpart and list vol again shows the drive letter assign for that partition did not 'stick'. I repeated the steps with the same result but was able to chkdsk the volume. The check of C: is in process:

====================================================
C:\Windows\system32>chkdsk /b /v U:
The type of the file system is NTFS.

Chkdsk cannot run because the volume is in use by another
process. Chkdsk may run if this volume is dismounted first.
ALL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
Would you like to force a dismount on this volume? (Y/N) y
Volume dismounted. All opened handles to this volume are now invalid.
Volume label is System Reserved.

Stage 1: Examining basic file system structure ...
256 file records processed.
File verification completed.
Phase duration (File record verification): 7.57 milliseconds.
0 large file records processed.
Phase duration (Orphan file record recovery): 0.49 milliseconds.
0 bad file records processed.
Phase duration (Bad file record checking): 0.49 milliseconds.

Stage 2: Examining file name linkage ...
1 reparse records processed.
370 index entries processed.
Index verification completed.
Phase duration (Index verification): 174.12 milliseconds.
0 unindexed files scanned.
Phase duration (Orphan reconnection): 1.03 milliseconds.
0 unindexed files recovered to lost and found.
Phase duration (Orphan recovery to lost and found): 3.17 milliseconds.
1 reparse records processed.
Phase duration (Reparse point and Object ID verification): 2.39 milliseconds.

Stage 3: Examining security descriptors ...
Cleaning up 9 unused index entries from index $SII of file 9.
Cleaning up 9 unused index entries from index $SDH of file 9.
Cleaning up 9 unused security descriptors.
Security descriptor verification completed.
Phase duration (Security descriptor verification): 17.52 milliseconds.
57 data files processed.
Phase duration (Data attribute verification): 1.40 milliseconds.

Stage 4: Looking for bad clusters in user file data ...
240 files processed.
File data verification completed.
Phase duration (User file recovery): 332.14 milliseconds.

Stage 5: Looking for bad, free clusters ...
6051 free clusters processed.
Free space verification is complete.
Phase duration (Free space recovery): 0.00 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

51199 KB total disk space.
24184 KB in 101 files.
88 KB in 59 indexes.
0 KB in bad sectors.
2723 KB in use by the system.
2048 KB occupied by the log file.
24204 KB available on disk.

4096 bytes in each allocation unit.
12799 total allocation units on disk.
6051 allocation units available on disk.
Total duration: 551.74 milliseconds (551 ms).

=========================================================================
C:\Windows\system32>mountvol
Creates, deletes, or lists a volume mount point.

MOUNTVOL [drive:]path VolumeName
MOUNTVOL [drive:]path /D
MOUNTVOL [drive:]path /L
MOUNTVOL [drive:]path /P
MOUNTVOL /R
MOUNTVOL /N
MOUNTVOL /E

path Specifies the existing NTFS directory where the mount
point will reside.
VolumeName Specifies the volume name that is the target of the mount
point.
/D Removes the volume mount point from the specified directory.
/L Lists the mounted volume name for the specified directory.
/P Removes the volume mount point from the specified directory,
dismounts the volume, and makes the volume not mountable.
You can make the volume mountable again by creating a volume
mount point.
/R Removes volume mount point directories and registry settings
for volumes that are no longer in the system.
/N Disables automatic mounting of new volumes.
/E Re-enables automatic mounting of new volumes.

Possible values for VolumeName along with current mount points are:

\\?\Volume{7fe07e32-0000-0000-0000-100000000000}\
U:\

\\?\Volume{7fe07e32-0000-0000-0000-300300000000}\
C:\

\\?\Volume{7fe07e32-0000-0000-0000-10c0e8000000}\
*** NO MOUNT POINTS ***

\\?\Volume{cf95e677-d6bb-11ee-92dc-806e6f6e6963}\
E:\

C:\Windows\system32>chkdsk /b /v "\\?\Volume{7fe07e32-0000-0000-0000-10c0e8000000}"
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
256 file records processed.
File verification completed.
Phase duration (File record verification): 5.07 milliseconds.
0 large file records processed.
Phase duration (Orphan file record recovery): 1.19 milliseconds.
0 bad file records processed.
Phase duration (Bad file record checking): 1.21 milliseconds.

Stage 2: Examining file name linkage ...
282 index entries processed.
Index verification completed.
Phase duration (Index verification): 29.64 milliseconds.
0 unindexed files scanned.
Phase duration (Orphan reconnection): 0.83 milliseconds.
0 unindexed files recovered to lost and found.
Phase duration (Orphan recovery to lost and found): 1.00 milliseconds.
0 reparse records processed.
0 reparse records processed.
Phase duration (Reparse point and Object ID verification): 2.50 milliseconds.

Stage 3: Examining security descriptors ...
Cleaning up 3 unused index entries from index $SII of file 9.
Cleaning up 3 unused index entries from index $SDH of file 9.
Cleaning up 3 unused security descriptors.
Security descriptor verification completed.
Phase duration (Security descriptor verification): 8.45 milliseconds.
13 data files processed.
Phase duration (Data attribute verification): 0.91 milliseconds.

Stage 4: Looking for bad clusters in user file data ...
240 files processed.
File data verification completed.
Phase duration (User file recovery): 4.74 seconds.

Stage 5: Looking for bad, free clusters ...
21997 free clusters processed.
Free space verification is complete.
Phase duration (Free space recovery): 0.00 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

534527 KB total disk space.
441516 KB in 10 files.
76 KB in 15 indexes.
0 KB in bad sectors.
4943 KB in use by the system.
4256 KB occupied by the log file.
87992 KB available on disk.

4096 bytes in each allocation unit.
133631 total allocation units on disk.
21998 allocation units available on disk.
Total duration: 4.80 seconds (4805 ms).

chkdsk of C: completed. chkdskFromEvent log added:

Dropbox - KB5034441-debug - Simplify your life

erpster4 · 08 Mar 2024

aww screw the dang KB5034441 rabbit hole and I'll just follow this woman's advice, avoid running some MS script and block/hide the KB5034441 update using wushowhide.diagcab or wumgr

Microsoft released a new script for the KB5034441/KB5034440 issues. My take? Skip it. I still recommend hiding the offending update and not installing it on consumer Windows machines.

not worth the friggin trouble of running some script to fix such mess from MS