Event viewer Issues "Error 0x80070005"

Hello this is the severity: warning i keep getting for a user in event viewer
"Error 0x80070005 occurred while creating known folder {3EB685DB-65F9-4CF6-A03A-E3EF65729F3D} with path 'C:\Windows\system32\config\systemprofile\AppData\Roaming'."
Is someone familiar with this warning/error message and how to stop it from coming up. Also if it helps the user pc is on a domain and im the admin for it.

Hi,
How is the current situation? Have you check its permission?
Please run chkdsk /f /r command to fix and recover the disk error:
Run Check Disk from a Command Line to Check for and fix Disk Errors
https://technet.microsoft.com/en-us/magazine/ee872425.aspx
Meanwhile, please refer to this familiar thread:
https://social.technet.microsoft.com/Forums/windows/en-US/047bdb94-9958-4e8e-a112-4555e1ee3ad4/known-folders-errors-in-event-viewer?forum=w7itproperf
Karen Hu
TechNet Community Support

Similar Messages

Errors for excel - excel service unavailable. Event Viewer has error event ids - 5239 and 5231.

Errors for excel - excel service unavailable. Event Viewer has error event ids - 5239 and 5231.
We restart the excel service app and it solves. Looking for permanent solution.
Regards,
Kunal

To resolved the issue do a simple restart.
Restart the server
Before restarting, verify that this problem occurs often. It may be an intermittent problem that is automatically corrected and does not require you to restart the server.
If the problem occurs often, restart the server running Excel Services Application.
If the problem continues to occur often, and restarting the server did not correct the problem, confirm that the hardware of the server is functioning correctly, or reinstall Excel Services Application and re-add the server to the server farm.
Here's the article with the explanation: Error communicating with Excel Services
Application - Events 5231 5239 5240
Please 'propose as answer' if it helped you, also 'vote helpful' if you like this reply.

Event Viewer ACPI error MBP mid09

Hi, I have installed Win 7 on my MBP 5.5 mid 2009 and although its running well I am getting an error message in event viewer saying:
Error
25/09/2014 00:00:32
ACPI
13
None
something about the embedded controller failed to start in a reasonable time. Would anyone with the same mac please check their event logs to see if they have this error please?
I had this and a HAL error under Win 7 ultimate x64 (used this as a test os) so I installed Win 7 Pro from a Genuine Disc (I do not condone piracy) and I am getting the ACPI error (only after all the drivers were installed, the error message didnt show prior to boot camp 4 install). So before I spend £100 on a Genuine Windows disc (I already purchased Windows 8 at £106 but it seems apple dont support it on this mac :-(...) I'd like to know if its a failing logic board or driver related.
Thanks in advance
Darren

I have been running OSX for around 1 hour and then I rebooted into windows 7, loaded the event logs immediately and found the ACPI error had been recorded precisely 1 hour before windows had booted, I am wondering if this could be a bug between Mac/Windows time feature. after more restarts the ACPI isn't being recorded and other events times are correct.
edit:
I have just disabled the Synchronise with internet time feature in windows. I'll keep a look out.

Event viewer subscriptions error code 0x32

I’m using windows 7 home premium trying to configure event viewer subscriptions.
But getting error code (0x32) .
[hadi-TOSH] -
Error - Last retry time: 4/9/2014 6:28:35 PM. Code (0x32): <f:ProviderFault provider="Event Forwarding Plugin" path="%systemroot%\system32\wevtfwd.dll" xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault"><t:ProviderError
xmlns:t="http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog">Windows Event Forward Plugin failed to create subscription.</t:ProviderError></f:ProviderFault>
Next retry time: 4/9/2014 7:08:35 PM.

Hi,
Please make sure the Windows Event Collector service is started. You must be a member of the Administrators group to start this service.
http://technet.microsoft.com/en-us/library/cc748890.aspx
Kate Li
TechNet Community Support

IPod 5G freezes iTunes, Event Viewer System Error

iPod 5G not playing nicely with iTunes, syncs iPod then freezes PC, unable to exit iTunes or disconnect iPod w/o rebooting system.
In Event Viewer>System, I found this:
Event Source: PlugPlayManager
Event ID: 256
Description: Timed out sending notification of device interface change to window of "program or service name and/or GUID."
thx-
c.

cronish
Have you been able to verify that your iPod is functioning properly by hooking it up to another computer?
If so, then here's a REAL shot in the dark.
Restart your computer and go into the Bios and turn off Hyperthreading if it's enabled.
If that doesn't work then re-enable it.
Jim

Windows 8 Event Viewer reports errors

1) Error: Source DistributedCOM; The server {....} did not register with DCOM within the required timeout.
I have changed the service startup to Automatic with delay with no result.
2) Error: Source Service Control Manager; The HP Network Devices Support service terminated with the following error: The specified module could not be found.
I am unable to find a way to reinstall this module. Granted this may be an HP support issue.

Hello @OrygunGuy ,
Thanks for posting on the HP Forums!
I'm sorry to hear about your errors. To resolve all your issues, I would like you to reinstall the operating system. It will clear up any software conflicts and allow you to start fresh, likely on Windows 8.
First, please ensure you backup your files. Here is information on how to do this: Backing Up Your Files (Windows 8)
Once this is done, it is safe to reinstall the operating system. Performing an HP System Recovery (Windows 8)
Please let me know your results. Thanks!
Mario
I worked on behalf of HP.

Unable to refresh the schema of FIM MA.Getting an error in Event viewer ""the current version of database is not compatible with the one expected by Forefront Identity Manager service. The current version of database is : 1116. The expected version is :1"

Hi,
We have installed FIM MA with an account that have all the sufficient rights.It got created successfully and worked for Full Import and Full Sync. But, due to some version incompatabilities, we have installed a patch.PFB link for the patch.
http://support.microsoft.com/en-us/kb/2969673/en-us
Now, we are trying to refresh the schema of FIM MA. While doing that we are facing an error "Failed to connect to database". The user account with which we are connecting has read and write permissions on DB.In the event viewer some errors are
logged like "the current version of database is not compatible with the one expected by Forefront Identity Manager service. The current version of database is : 1116. The expected version is :1122" with event ID 3. PFB images for more detailed
view.
Please advice how to fix the issue.
Thanks
Prasanthi.

Hello,
seems to me that you maybe only updated the syncengine but not portal/webservice.
I had that error once after an recovery from scratch and forgot one of the hotfixes to apply to all services.
-Peter
Peter Stapf - ExpertCircle GmbH - My blog:
JustIDM.wordpress.com

Ati2Mtag error into event viewer

Hi,
each time the system start I found into the event viewer 5 error message.
Source: ati2mtag
Category: DAL
Type: Error
Event ID: 43034
Description: Unknown EDID version
My System is IBM ThinkPad T43p with 2gb RAM Windows XP sp2
I have recently updated the system using Lenovo System update.
I have also uninstalled and reinstalled the video driver but the problem is still here.
Thanks in advance for help

I have the same problem. I have a R52 with WindowsXP Sp2. I have installed/reinstalled all of the latests Windows & Lenovo updates including ATI MOBILITY RADEON X300, 8.383.1.1.3-070621a2-0510 2007/09/04 from Lenovo. If I uninstall the latter and allow Windows to install the driver, the error goes away.
Can anyone help?
Petert
ThinkPad T520 (4240-4EU)
i7-2620M(2.70GHz),4GB RAM,500GB 7200rpm HD,15.6in 1366x768 LCD,Intel HD Graphics,CDRW/DVDRW,Intel 802.11agn wireless,Bluetooth,Modem,1Gb Ethernet,UltraNav,Secure Chip,Fingerprint reader,Camera,6c Li-Ion,Win7 Pro 64

Error in Event viewer - COM Server application security Issue

Dear All,
I am installing one software on windows cluster environment. But while installing I am getting continuous error in System in Event Viewer as 'The application-specific permission settings do not grant Local Activation permission for the COM Server application
with CLSID {xxxxxxxxxxxxx} and APPID {xxxxxxxxxxxxx} to the user NT SERVICE\SQL Server Distributed Replay Client SID (S-1-5-80-3249811479-4343554-65656-65665) from address LocalHost (Using LRPC). The security permission can be modified using the Component
Services administrative tool.'
I have seen in component services, that app ID I am getting for DReplayController service. On security tab if I want to give permission to that particular user then to which user I want to add in 'Launch and Activate permissions'. I am not getting 'SQL Server
Distributed Replay Controller' user in list.
So, please help me.
Thanks in advance.

Hi,
Please try to add this account: NT AUTHORITY\SYSTEM.
More information for you:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 2012
https://social.technet.microsoft.com/forums/systemcenter/en-US/cd8a2c95-70db-4df6-b7f5-eedcc5d898c7/the-applicationspecific-permission-settings-do-not-grant-local-activation-permission-for-the-com
Event ID 10016 issue in SQL Cluster Server
https://social.technet.microsoft.com/Forums/sqlserver/en-US/c5a27692-05c0-4ee4-b97f-1ea438b4e5f7/event-id-10016-issue-in-sql-cluster-server?forum=sqldisasterrecovery
In addition, if there are any further requirements regarding SQL, here are some SQL forums below for you:
https://social.technet.microsoft.com/Forums/sqlserver/en-US/home?category=sqlserver&filter=alltypes&sort=lastpostdesc
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Multiple errors from MsiInstaller with event id 1015 and text "Failed to connect to server. Error: 0x80070005"

Hi,
Every night I get a lot of warnings in the event log from MsiInstaller with event ID 1015 and text "Failed to connect to server. Error: 0x80070005". They are always followed by a new event 1035. Example:
Event 1015, MsiInstaller (Warning)
Failed to connect to server. Error: 0x80070005
Event 1035, MsiInstaller (Information)
Windows Installer reconfigured the product. Product Name: Microsoft Excel Mobile Viewer Components. Product Version: 14.0.4763.1000. Product Language: 0. Manufacturer: Microsoft Corporation. Reconfiguration success or error status: 0.
I probably get around 50 of these each night, and the 1035 events are all related to various SharePoint components. The user in all cases is the sharepoint farm account.
I use SharePoint 2010 enterprise in a farm install on one virtual server. I have a private domain, and the database is on a separate server.
Does anyone have any idea why this happens? Other than the error in the event log I cannot see any issues with my installation. I have searched for this error and seen it related to user profile synchronisation, but profile sync is working fine for me. I
installed using the Technet guide and the user profile sync guide at
http://www.harbar.net/articles/sp2010ups.aspx
Thanks,
Mikael

Hey Trevor. Thanks. I wasn't sure which method it was failing on although I understood it was the Windows Installer Service that was getting called by the job. There are three things that are still interesting to me though:
The job succeeds anyway. How? Does it just continue to run the rest of its checks but fails on this one? If it doesn't fail on this one, why not? If it does fail here, but then continues, should we be concerned about the quality of the data in Manage Patch
Status?
Or... does it somehow succeed once it uses the DCOM rights which appear to clear the 10016 errors? What I've never been able to reconcile with these warnings is that we've granted DCOM rights to launch and activate the Windows Installer Service and
that definitely seems to make a difference to success or failure of the job - so why doesn't it clear these warnings?
Why does granting the file system permissions clear the FIM version of this job's warnings, but not for the Product Version Job? This is particularly vexing since granting the DCOM rights appears to resolve the 10016 errors in exactly the same manner for
both jobs.
All of this has led me to believe that there were missing permissions somewhere, probably on the file system, but I just haven't had any luck pinning that down. One reason why I continued to pursue a solution to this is that the job doesn't actually try
to install anything, it's just trying to use the Windows Installer Service to query the installed version, and the DCOM rights should be sufficient to invoke the service. But getting much further than this has proven pretty difficult since I'm not a dev and
I've kind of pushed my limited reflection skills and understanding of the Windows Installer Service to the limit. If anyone can chip in and make some progress from this point, it'd be great to join forces!

Multiple Event Viewer Error Ids, Corrupt Catalogs, System not working right. Please help.

Since I could not find a list of the Event Ids that was accurate at all or not too general as to be useless and Microsoft won't let us know how to fix these ourselves without having a programming degree, I am begging for help from anyone who can help
me get my computer working right again. I have some important things to get done which I can't do without my computer working. I have tried to get what I could get but I am blocked from many files which makes it difficult to get info. Please help. I appreciate
any help I can get. Thank you,
WhiteFox42
I am not sure which one is more important.
Event id 20
Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 for x64-based Systems
(KB2468871).
Event id 11
Possible Memory Leak. Application (C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted) (PID: 476) has passed a non-NULL pointer to RPC for an [out] parameter marked [allocate(all_nodes)]. [allocate(all_nodes)] parameters are always
reallocated; if the original pointer contained the address of valid memory, that memory will be leaked. The call originated on the interface with UUID ({3f31c91e-2545-4b7b-9311-9529e8bffef6}), Method number (20). User Action: Contact your application
vendor for an updated version of the application.
Event id 455
taskhost (1348) WebCacheLocal: Error -1811 (0xfffff8ed) occurred while opening logfile R:\User\App Data\Roaming\Microsoft\Templates\Local\Microsoft\Windows\WebCache\V01.log.
Event Xml:
Event id 505
wuaueng.dll (1012) SUS20ClientDataStore: An attempt to open the compressed file "C:\Windows\SoftwareDistribution\DataStore\DataStore.edb" for read / write access failed because it could not be converted to a normal file. The open file operation
will fail with error -4005 (0xfffff05b). To prevent this error in the future you can manually decompress the file and change the compression state of the containing folder to uncompressed. Writing to this file when it is compressed is not supported.
Event id 513
Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object
Event id 1000
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.16428, time stamp: 0x525b664c
Faulting module name: IEFRAME.dll, version: 11.0.9600.16476, time stamp: 0x52944cf2
Exception code: 0xc0000005
Fault offset: 0x00025f1d
Faulting process id: 0x1854
Faulting application start time: 0x01cf0735f0e5f0c7
Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Faulting module path: C:\Windows\system32\IEFRAME.dll
Report Id: e3dc1e9a-733f-11e3-b920-00215a2af202
Event id 1000
Faulting application name: msiexec.exe, version: 5.0.7601.17514, time stamp: 0x4ce79d93
Faulting module name: msvcrt.dll, version: 7.0.7601.17744, time stamp: 0x4eeb033f
Exception code: 0xc0000005
Fault offset: 0x00000000000035e1
Faulting process id: 0x1030
Faulting application start time: 0x01cf01b77867a358
Faulting application path: C:\Windows\system32\msiexec.exe
Faulting module path: C:\Windows\system32\msvcrt.dll
Report Id: f7253b17-6daa-11e3-b944-00215a2af202
Event id 1002
Computer:      w7mar-64 "I don't know why it has computer as this when it should not be."
Description:
The IP address lease 192.168.200.195 for the Network Card with network address 0x08002742F261 has been denied by the DHCP server 192.168.200.1 (The DHCP Server sent a DHCPNACK message).
Event id 1008
The Windows Search Service is starting up and attempting to remove the old search index {Reason: Index Corruption}.
Event id 1008
Computer:      w7mar-64
Description:
An errorUser:          LOCAL SERVICE
occurred in initializing the interface. The error code is: 0x2.
Event id 1014
User:          NETWORK SERVICE
Computer:
Description:
Name resolution for the name wpad.westell.com timed out after none of the configured DNS servers responded.
Event id 1015
User:          N/A
Computer:      w7mar-64
Description:
Event ID 1013 for the Windows Search Service has been suppressed 7 time(s) since 12:04:10 PM. This event is used to suppress Windows Search Service events that have occurred frequently within a short period of time. See Event ID 1013 for further details
on this event.
Event id 1015
Failed to connect to server. Error: 0x8007043C
Event id 1018
The description for Event ID 1018 from source EvntAgnt cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
Event id 1020
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.
Event id 1028
Windows Installer has determined that its configuration data cache folder was not secured properly. The owner of the key must be either Local System or Builtin\Administrators. The existing folder will be deleted and re-created with the appropriate security
settings.
Event id 1101
.NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: System.Web.Entity.Design, Version=3.5.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil . Error code = 0x80010108
Event id 1500
The description for Event ID 1500 from source SNMP cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
Event id 1530
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
Event id 1530
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
6 user registry handles leaked from \Registry\User\S-1-5-21-2959539970-205720217-4182857889-1000:
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software\Microsoft\Internet Explorer\Main
Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2959539970-205720217-4182857889-1000\Software\Policies
Event id 3028
Context: Windows Application, SystemIndex Catalog
Details:
   The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
Event id 3029
Context: Windows Application, SystemIndex Catalog
Details:
   The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
Event id 3036
The content source <csc://{S-1-5-21-2959539970-205720217-4182857889-1001}/> cannot be accessed.
Event id 3036
No protocol handler is available. Install a protocol handler that can process this URL type. (HRESULT : 0x80040d37) (0x80040d37)
Event id 4104
Description:
The backup was not successful. The error is: Access is denied. (0x80070005).
Event id 4228
TCP/IP has chosen to restrict the scale factor due to a network condition. This could be related to a problem in a network device and will cause degraded throughput.
Event id 4321
The name "WHITEFOXPC     :0" could not be registered on the interface with IP address 192.168.1.21. The computer with the IP address 192.168.1.19 did not allow the name to be claimed by this computer.
Event id 4373
The description for Event ID 4373 from source NtServicePack cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
Event id 4879
MSDTC encountered an error (HR=0x80000171) while attempting to establish a secure connection with system WHITEFOXPC.
Event id 6000
The winlogon notification subscriber <GPClient> was unavailable to handle a notification event.
Event id 6006
The winlogon notification subscriber <TrustedInstaller> took 186 second(s) to handle the notification event (CreateSession).
Event id 7000
The Windows Audio service failed to start due to the following error:
A privilege that the service requires to function properly does not exist in the service account configuration. You may use the Services Microsoft Management Console (MMC) snap-in (services.msc) and the Local Security Settings MMC snap-in (secpol.msc) to view
the service configuration and the account configuration.
Event id 7001
The Computer Browser service depends on the Server service which failed to start because of the following error:
The dependency service or group failed to start.
Event id 7010
The index cannot be initialized.
Details:
   The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
Event id 7023
The Block Level Backup Engine Service service terminated with the following error:
%%-2147024713
Event id 7024
The Windows Search service terminated with service-specific error %%-1073473535.
Event id 7026
The following boot-start or system-start driver(s) failed to load:
aswKbd
aswRvrt
aswSnx
aswSP
aswTdi
aswVmm
discache
spldr
Wanarpv6
Event id 7030 & 7031
The dldw_device service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
Event id 7032
The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Installer service, but this action failed with the following error:
An instance of the service is already running.
Event id 7040
The search service has detected corrupted data files in the index {id=4700}. The service will attempt to automatically correct this problem by rebuilding the index.
Event id 7042
The Windows Search Service is being stopped because there is a problem with the indexer: The catalog is corrupt.
Details:
   The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
Event id 8210
An unspecified error occurred during System Restore: (Installed Java 7 Update 45). Additional information: 0x80070003.
Event id 9000
The Windows Search Service cannot open the Jet property store.
Details:
   0x%08x (0xc0041800 - The content index database is corrupt. (HRESULT : 0xc0041800))
Event id 10005
DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server:
{000C101C-0000-0000-C000-000000000046}
Event id 10010
15 of these with different server codes which I can't copy unless I copy all the details.
The server {3EEF301F-B596-4C0B-BD92-013BEAFCE793} did not register with DCOM within the required timeout.
Event id 12348
Volume Shadow Copy Service warning: VSS was denied access to the root of volume \\?\Volume{8e79517c-6c41-11e3-b621-cb03f0618d54}\. Denying administrators from accessing volume roots can cause many unexpected failures, and will prevent VSS from functioning
properly. Check security on the volume, and try the operation again.
Event id 15006
9 of these.
Description:
Owner of the log file or directory \SystemRoot\System32\LogFiles\HTTPERR\httperr1.log is invalid. This could be because another user has already created the log file or the directory.
Event id 31004
33 of tese.
The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
The End.
Kimberly D. White-Fox

Please provide a copy of your System Information file. Type System Information in the Search Box above the start Button and press the ENTER key
(alternative is Select Start, All Programs, Accessories, System Tools, System Information). Select File, Export and give the file a name noting where it is located. The system creates a new System Information file each time system information is accessed.
You need to allow a minute or two for the file to be fully populated before exporting a copy. Please upload to your Sky Drive, share with everyone and post a link here. Please say if the report has been obtained in safe mode.
Please upload and share with everyone copies of your System and Application logs from your Event Viewer to your Sky Drive and post a link here.
To access the System log select Start, Control Panel, Administrative Tools, Event Viewer, from the list in the left side of the window select Windows
Logs and System. Place the cursor on System, select Action from the Menu and Save All Events as (the default evtx file type) and give the file a name. Do the same for the Applications log. Do not provide filtered files.
For help with Sky Drive see paragraph 9.3:
http://www.gerryscomputertips.co.uk/MicrosoftCommunity1.htm
Some Event Viewer reports are generated solely because the computer is in safe mode or safe mode with networking. You have at least one example of this in your long list. If you do not see the same report for a time when
the computer was in normal mode then it can be disregarded.
You will find some general advice on interpreting Event Viewer reports here:
http://www.gerryscomputertips.co.uk/syserrors5.htm
Hope this helps, Gerry

Windows is Scanning and repairing drive... (- Errors in Event Viewer)

Long post, please be patient... :)
I have a fairly new (purchased 8/2013) Lenovo ThinkPad T431s with Windows 8.1 Pro 64-bit (updated from 8.0 -> 8.1). It has a very tricky error coming basically 8 / 10 boots:
Windows is Scanning and repairing drive...
Error details from Windows Event Viewer (a new similar error appears on every boot to event viewer):
A corruption was discovered in the file system structure on volume \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}.
A file on the volume is no longer reachable from its parent directory. The parent file reference number is 0x2000000000002. The name of the parent directory is "". The parent index attribute is ":$I30:$INDEX_ALLOCATION". The file reference
number of the file that needs to be reconnected is 0x400000003db80. There may be additional files on the volume that also need to be reconnected to this parent directory.
What has been done 1st trying to fix that:
SSD disk has been changed (image from previous SSD copied back) ->
no solution, error remains
chkdsk /F /R -> no solution, error remains
SFC /scannow -> no solution, error remains
dism /online /cleanup-image /restorehealth -> no solution, error remains after a few boots
TRIED using Windows 8.1 "Update & Recovery -> Refresh Your PC without affecting your files" -> Inserted the Lenovo "Operating System Recovery Disk Windows 8 Pro (OEM Activation 3.0 Required)" BUT Windows did not accept
that DVD claiming "The media inserted is not valid"... ???
Ended up calling Lenovo Support and they instructed me to order the Recovery DVD from
Lenovorecovery.com -> Unfortunatelly Windows does not recognice the DVD(s)...
mountvol returns:
\\?\Volume{4d337687-0033-42f7-8a8e-b6968b533cb3}\
(This is my C:\ drive where Windows installation resides)
\\?\Volume{e010cf9d-c04d-4c82-b517-3cda1b647fe7}\
*** NO MOUNT POINTS ***
\\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}\
*** NO MOUNT POINTS ***
\\?\Volume{33f0062f-0aff-4fd2-8402-1c7911d86897}\
*** NO MOUNT POINTS ***
Then running fsutil dirty query on each returns:
Volume - \\?\Volume{4d337687-0033-42f7-8a8e-b6968b533cb3} is NOT Dirty
Volume - \\?\Volume{e010cf9d-c04d-4c82-b517-3cda1b647fe7} is NOT Dirty
Volume - \\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} is Dirty
Volume - \\?\Volume{33f0062f-0aff-4fd2-8402-1c7911d86897} is NOT Dirty
The chkdsk on the dirty volume
\\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}\ returned:
The type of the file system is NTFS.
Insufficient storage available to create either the shadow copy storage file or
other shadow copy data.
A snapshot error occured while scanning this drive. Run an offline scan and fix.
Diskpart output on the same volume:
DISKPART> lis par
Partition ### Type Size Offset
Partition 1 Reserved 128 MB 17 KB
Partition 2 Recovery 1000 MB 129 MB
Partition 3 System 260 MB 1129 MB
Partition 4 Primary 146 GB 1389 MB
Partition 5 Recovery 350 MB 147 GB
Partition 6 Recovery 19 GB 148 GB
Questions:
1) Are my Partitions OK, haven't "touched" anything?
2) Excluded the dirty volume from boot checking with chkntfs /x
-> still the Error appears in Event viewer log (but Scanning is skipped/not shown anymore during the boot).
What is causing the error?
3) Why do I have three (3) recovery partitions?

What has happened in the past days:
A) Lenovo on-site-Support changed the motherboard -> had no impact on the error (which I expected).
B) I found
instructions how to manually create USB Flash stick with a booting Custom (OEM) Recovery Image.
C) Booted with USB and performed "Refresh your PC without affecting your files."
D) Windows was refreshed but...
-->>
Still the error remains (Windows scanning and repairing drive \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} on each and every boot.
1) Related Error in Event viewer (NTFS):
A corruption was discovered in the file system structure on volume \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984}.
A file on the volume is no longer reachable from its parent directory. The parent file reference number is 0x2000000000002. The name of the parent directory is "". The parent index attribute is ":$I30:$INDEX_ALLOCATION". The file reference number of the
file that needs to be reconnected is 0x400000003db80. There may be additional files on the volume that also need to be reconnected to this parent directory.
2) Related Error in Event viewer (NTFS - Microsoft Windows NTFS):
Volume \\?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} (\Device\HarddiskVolume5) needs to be taken offline to perform a Full Chkdsk. Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via
PowerShell.
-->>
Now Lenovo support is proposing a full re-install (to be performed by myself) of Windows as this is SW issue.
Summary:
- Refreshing my T431s with OEM Image does not help
- The error remains on \?\Volume{f62db2cf-efe4-4b55-a3f7-0e7db991a984} (\Device\HarddiskVolume5; Lenovo Recovery partition) OR at least Windows thinks so...

BI 4.1 Multiple Errors on Event Viewer

Hi
My client uses BI Platform 4.1 Support Pack 1 Patch 1. During the past 2 days, there have been several errors logged on the Event Viewer on the BO server. Now, the infoview platform is unresponsive and just hangs for all the users. On having a look at the Services in CMC, the WebI Processing Server status was "STARTING" though nobody had manually tried to stop/start it. So, when I checked the event viewer fr any further errors, there were several repetitive errors which were logged:
1) Log Name:      Application
Source:        Server Intelligence Agent
Date:          22/07/2014 20:04:44
Task Category: Error
Level:         Error
Description:
Server Intelligence Agent: server BO.WebIntelligenceProcessingServer is being recycled.
2) Log Name: Application
Source: BusinessObjects_cms
Date: 23/07/2014 06:29:57
Task Category: Database
Level:         Warning
Description:
Database access error. Reason [Microsoft][SQL Server Native Client 10.0][SQL Server]Transaction (Process ID 60) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction.. (FWB 00090)
(This warning is recorded multiple times)
3) Log Name: Application
Source: BusinessObjects_cms
Date: 23/07/2014 09:47:38
Task Category: OSCA_Services
Level: Error
Description:
CMS Server Watcher: server named 'W2K8R2_BO.WebIntelligenceProcessingServer' is being marked as down because it is unresponsive
(This error is recorded multiple times within 20 minutes). IT restarted the server and BO is now working fine.
I could not locate any other errors which would give me some more insight to the root cause of these errors. Could someone share some useful posts/links about similar kinds of errors? I tried to search on the forum, and i see suggestions stating that it could be related to network or connectivity. I'm not quite sure though.
Many Thanks
DE

Thanks Sebastian
We had to restart the SIA and the deadlock issues stopped appearing. For a couple of hours everything was running fine, until we noticed the following errors.
Log Name: Application
Source: Application Error
Date: 23/07/2014 13:04:16
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Description:
Faulting application name: WIReportServer.exe, version: 14.1.1.1072, time stamp: 0x52310a77
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000374
Fault offset: 0x00000000000c40f2
Faulting process id: 0x1b68
Faulting application start time: 0x01cfa65efeb52f5b
Faulting application path: C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\WIReportServer.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: d95bdba2-1269-11e4-x3x3ds-6c3be5befa0c
Log Name: Application
Source: Server Intelligence Agent
Date: 23/07/2014 13:04:22
Event ID:      4096
Task Category: Error
Level:         Error
Keywords: Classic
User:          N/A
Description:
[Node Name:BO]
[User Name: BO$]
Server Intelligence Agent: server BO.WebIntelligenceProcessingServer stopped unexpectedly.
The WIPS restarted itself. Is there a definite root cause for this issue?
Many thanks
DE

What is this error in Event Viewer policy file "C:\Program Files (x86)\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST

Hi,
One of my users is using Citrix Receiver on windows 8.1
Below is something I encountered while looking at her event viewer on her PC.
Please advise if MFC80.DLL is corrupted or missing and how I can fix this.
Activation context generation failed for "C:\Program Files (x86)\Citrix\ICA Client\MFC80.DLL".Error in manifest or policy file "C:\Program Files (x86)\Citrix\ICA
Client\Microsoft.VC80.MFCLOC.MANIFEST" on line 5. Component identity found in manifest does not match the identity of the component requested. Reference is Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Definition is Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Please use sxstrace.exe for detailed diagnosis.
Thank you.
Regards,
Joshua Tay

Hello Joshua Tay,
Please take a look at the following thread similar to this issue.
http://discussions.citrix.com/topic/326071-receiver-34-windows-8-sidebyside-error-starts-loading-then-exits/
Please note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
As this issue is relate to Citrix, to receive better support, it is recommended to ask in the related forum.
Best regards,
Fangzhou CHEN
Fangzhou CHEN
TechNet Community Support

ACPIEC Embedded Controller error in Event Viewer on XP Partition

So, when in my XP (SP2) partittion I recently started to get hangs when I try to put the system to stand by/hybernation at the blue "preparing to go into Stand by..." screen. It just sits there, locks up and I end up having to reboot. In the XP's Event Viewer I see this ACPIEC error and that seems to be related to the BIOS. But, as we know, I am on a Mac so there is no "BIOS".
It says "The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible."
So, that is the only error I consistently see in the Event Viewer so I assume it is related, but if I am on a Mac and have no "BIOS" or "EC" how can I source this issue out in XP given it is a partition on my Mac?

Hi,
Please try to add this account: NT AUTHORITY\SYSTEM.
More information for you:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 2012
https://social.technet.microsoft.com/forums/systemcenter/en-US/cd8a2c95-70db-4df6-b7f5-eedcc5d898c7/the-applicationspecific-permission-settings-do-not-grant-local-activation-permission-for-the-com
Event ID 10016 issue in SQL Cluster Server
https://social.technet.microsoft.com/Forums/sqlserver/en-US/c5a27692-05c0-4ee4-b97f-1ea438b4e5f7/event-id-10016-issue-in-sql-cluster-server?forum=sqldisasterrecovery
In addition, if there are any further requirements regarding SQL, here are some SQL forums below for you:
https://social.technet.microsoft.com/Forums/sqlserver/en-US/home?category=sqlserver&filter=alltypes&sort=lastpostdesc
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Event viewer Issues "Error 0x80070005"

Similar Messages

Maybe you are looking for