Microsoft Security Client OOBE stopped due to the following error: 0xC000000D

I keep getting this error in my event Viewer and I removed Microsoft Security Client a few weeks ago and replaced it with Bitdefender 2012
Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
I am also getting these aswell...
Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.
Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0x0811960D92F5.  The following error occurred: 0x79. Your computer will continue to try and obtain an address on its own from the
network address (DHCP) server.
A problem prevented Customer Experience Improvement Program data from being sent to Microsoft, (Error 80004005).

If you do not want to reinstall Microsoft Security Essentials to stop this problem, there is a step which you MUST, I repeat, MUST follow.  As indicated above by Zuhl3156, YOU MUST, again, MUST shutdown the security counter.  This is a problem
when you uninstall MSE, it does not remove the security counter.  This is the reason that everyone says to delete the C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl file.  This file is used and created by this counter.
If you have uninstalled the MES, then you MUST delete the C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl.  But, MOST IMPORTANTLY, you MUST go into into Computer Management and drill down into:
System Tools -> Performance -> Data Collector Sets -> Startup Event Tracing Sessions
Then, in the frame to the right on that window, select Microsoft Security Client OOBE, right click on it and select Properties.  Then DISABLE it (uncheck the Enabled box).  Then, when you select OK, if you have uninstalled MSE and NOT reinstalled
it, the entry in the right frame will 'magically' disappear.
This is a problem with the uninstall of MSE and needs to be resolved by Microsoft (hopefully they are reading this).  It has taken me DAYS to discover this, and many different attempts to resolve this.  But, apparently, this has now resolved my
problem.  I have seen performance counters cause many problems in my experience with Windows, and am very confident that this resolves the issue.
I cannot thank Zuhl3156 enough for his suggestion and my willingness to try it (I noticed 'performance counter' and jumped on it).  It seems to work wonderfully for the moment.
I hope this helps someone else who has spent days trying to chase this nightmare down.
Jim

Similar Messages

  • Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D

    i keep getting this Event in my event viewer and dont know what to do. Could use any help

    Hi,
    Regarding the error messages mentioned here, have you checked the below thread?
    Microsoft Security Client OOBE stopped
    due to the following error: 0xC000000D
    Please take a try with the methods suggested by the others above.
    Best regards
    Michael Shao
    TechNet Community Support

  • Bsod Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D

    I have a t540 with all hardawre and software updates running Win 7/64 pro and get this message repeatedly.  Microsoft says to delete  MSSEOOBE.etl but that file doesn't appear to be in the 64 bit version of Microsoft Security Essentials
    If it happen when the PC is in SLEEP mode it  causes an abnormal shutdown/recovery when the PC restarts  Did uninstall and reinstall MSE
    One MS thread says to contact the OEM - so here I am.
    I was also getting Code 10 Disk Errors but there was a MS KB fix for that
    Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
    Source:        Microsoft-Windows-Kernel-EventTracing
    Date:          5/29/2014 8:39:03 AM
    Event ID:      3
    Task Category: Session
    Level:         Error
    Keywords:      Session
    User:          SYSTEM
    Computer:      bill-THINK
    Description:
    Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/ev​ent">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>3</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>2</Task>
        <Opcode>14</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2014-05-29T13:39:03.627614300Z" />
        <EventRecordID>209</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="212" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Adm​in</Channel>
        <Computer>bill-THINK</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="SessionName">Microsoft Security Client OOBE</Data>
        <Data Name="FileName">C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl</Data>
        <Data Name="ErrorCode">3221225485</Data>
        <Data Name="LoggingMode">5</Data>
      </EventData>
    </Event>
    Any thoughts?  I guess I will try another AntiVirus but Microsoft Security Essential is running on 2 other Win 7 laptops
    Thanks

    Hi,
    Regarding the error messages mentioned here, have you checked the below thread?
    Microsoft Security Client OOBE stopped
    due to the following error: 0xC000000D
    Please take a try with the methods suggested by the others above.
    Best regards
    Michael Shao
    TechNet Community Support

  • Session "Microsoft Security Essentials OOBE" stopped due to the following error: 0xC000000D using win 7 64bit over and over BSOD

    Session "Microsoft Security Essentials OOBE" stopped due to the following error: 0xC000000D    using win 7 64bit over and over BSOD
    My event viewer has been coughing the error line above. It has lead to the feeling of a Carotid Artery leak of memory where my whole
    system slowly stops working till BSOD. Windows Explorer just stops working then Death.
    I HAVE HAD THIS HAPPEN MORE AND MORE, AND IT APPEARS TO BE A PROGRAM PROBLEM, ANYBODY ELSE HAVE THIS.
    IT HAS COST ME 2 DAYS WORK NOW.
    MIKE

    Hi,
    When does the issue begin to occur?
    Since Windows system uses separated user mode and kernel mode memory space, stop errors are usually caused by kernel portion components, such as a hardware device,
    third-party drivers, backup software or anti-virus services (buggy services).
    Please refer to the following steps to troubleshoot the issue.
    1. Boot the computer in
    Clean Boot for a test.
    2. Temporarily disable all unnecessary hardware devices in Device Manager, such as Modem, sound card or external device.
    For detail steps, we can refer to the link below:
    Device Clean Boot
    3. Upgrade the virus definition, run antivirus program and perform a full scanning.
    If the issue persists, please upload the minidump file (%systemroot%\minidump) to SkyDrive (
    www.skydrive.live.com ), then share the link to me. I will be glad to assist you to analysis the data.
    Thanks,
    Novak

  • Session "EventLog-Microsoft-Windows-MBAM-Diagnostic" stopped due to the following error: 0xC0000188

    Hi team,
    I find following event logs in my event viewer. It's quite annoying though nothing abnormal happens. I wanna know the root cause and how to fix that.
    Session "EventLog-Microsoft-Windows-MBAM-Diagnostic" stopped due to the following error: 0xC0000188
    My box is 
    Windows 8.1 64
    I can provide more information if you need it.
    Thanks,
    -J
    Keep involved!

    did recently you facing issue with autoshutdown or any power related and PC still attached to any 3rd party USB device?
    This issue addresses as normal behavior and don't affected your Windows
    https://support.microsoft.com/en-us/kb/2001347/
    The logging of this error will not affect the operation of your computer.  ReadyBoot is used by the ReadyBoost service that optimizes the boot time of your computer to a minimum
    this ready boost service normally start when you attached 3rd party removable drive or device, you can disable it if you want. This option will not applicable if you installed SSD
    http://www.sevenforums.com/tutorials/33289-readyboost-setup-use.html

  • Session "ReadyBoot" stopped due to the following error: 0xC0000188

    Just built a new system and every once in a while my computer hangs logging into windows.
    i7 2600k
    16 gigs/ram
    Intel 320 Series SSD x2 in RAID 0
    GTX 580
    Overview of event logs shows the following.
    Intel(R) 82583V Gigabit Network Connection
     Network link is disconnected.
    Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
    A timeout was reached (30000 milliseconds) while waiting for the ASUS Com Service service to connect.
    The ASUS Com Service service failed to start due to the following error:
    The service did not respond to the start or control request in a timely fashion.
    Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events
    cannot be delivered through this filter until the problem is corrected.
    The maximum file size for session "ReadyBoot" has been reached. As a result, events might be lost (not logged) to file "C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl". The maximum files size is currently set to 20971520 bytes.
    Session "ReadyBoot" stopped due to the following error: 0xC0000188
    On Asus connect I changed this service to delayed start I believe it is for my motherboard updates. Superfetch is disabled. My page file is not on my SSD drive but on my regular sata drives configured in RAID 5. It doesn't do this everytime I reboot just
    seems like it happens after my computer has been on for a while and I turn it off for a few hours and turn it back on to log into windows (put in my password it says welcome) and it takes several minutes to log in.
    Tried to do a little research on this but I am turning up 50/50 stuff on rather or not readyboost/superfetch should be on or off and I guess this is what is causing it.... maybe I dont know for sure. Looking for proper information.
    Thanks

    I apologize I have not responded sooner. Also I wanted to wait for it to happen again and compare logs from that time and this time because it still happens.
    Activation context generation failed for "c:\program files\microsoft security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft security client\MSESysprep.dll" on line 10. The element imaging appears as a child of element
    urn:schemas-microsoft-com:asm.v1^assembly which is not supported by this version of Windows.
    Intel(R) 82579V Gigabit Network Connection
    Network link is disconnected.
    This error is
    repeated three times. I have vmware workstation installed I am actually going to uninstall it and move it to spinning drives and get it off my SSD drives.
     The
    description for Event ID 1000 from source vmauthd cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
    If the event originated on another computer, the display information had to be saved with the event.
    The following information was included with the event:
    2012-01-20T07:58:27.786-06:00| vthread-4| W110: TicketLimitFileAccess: Successfully added access-allowed ACE to file's DACLthe message resource is present but the message is not found in the string/message table
    Intel(R)
    82579V Gigabit Network Connection
    Network link is disconnected.
    Intel(R) 82579V Gigabit Network Connection
    Network link is disconnected.
    Name resolution for the name wpad.westell.com timed out after none of the configured DNS servers responded. (im having internet provider issues today so this can be ignored)
    Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D

  • Microsoft Security Client OOBE Error plus 2 CSRSS Processes?

    This has to be a bit abnormal, but apparently this concerns what happened 30 minutes ago, System just flat out Froze up and then after the restart an error that received the Microsoft Security Client OOBE Error Code 0xc000000D had happened in the Kernel
    Tracing event, following the restart 2 CSRSS Process are now present, normally it should be 1 as a priority, and in turn that tells me an Exploit that Microsoft Might have missed some how hit my system and this issue is now concerning.

    Hi,
    Do you still get OOBE Error Code now?
    Regarding  your problems getting Microsoft Security Essentials OOBE error code 0xc000000D.
    Please navigate to C:/program data/microsoft/microsoft security essentials/support/  , and then locate the file: "MSSEOOBE.etl" and simply delete it.
    The MSE will recreate it after your restarting your computer. That could solve the issue.
    Please refer to the following thread for more details.
    Session "Microsoft Security Essentials OOBE" stopped due to the following error: 0xC000000D
    http://answers.microsoft.com/en-us/protect/forum/mse-protect_start/session-microsoft-security-essentials-oobe-stopped/387c21ed-75db-47e3-9baf-687f6c66f0eb
    My Windows 7 has two csrss processes too.
    We can locate the file in the folder C: Windows/System32. Please test.
    If they are located in other folder, we could suspect them as virus. I suggest you to conducting a Antivirus scan.
    Please refer to the following thread for more detail.
    2 csrss.exe running Windows 8.1.
    http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/2-csrssexe-running-windows-81/cdbaf6d0-4920-4595-9f4f-b0d6e45b9d2a
    If there are any problems, please let me know.
    Best regards

  • Microsoft Intune was unable to set the desired mobile device policy for one or more users due to the following error: A2CE0100

    Hi!
    We have fatal or critical error message on Microsoft Intune Portal but all agents are working just fine. Before opening support ticket we would like to hear comments from the experts on this forum. We would also like to fix this error before starting to
    manage mobile devices with Intune.
    Error message on Intune Portal:
    "Microsoft Intune was unable to set the desired mobile device policy for one or more users due to the following error: A2CE0100"
    Repeated: 19 times.
    Class: (System) Policy
    Random Fatal error message on C:\Program Files\Microsoft\OnlineManagement\Logs\PolicyAgent.log found from one Windows 8.1 client:
    2015-02-21 08:49:20:704 2852 1ab0 FATAL: DocumentProvider::IndicateToConsumer/pp->ProcessPolicies(NULL, NULL, NULL, NULL) failed with error 0x800704d5.
    That said, we are not facing any specific problem but we would like to find symptom of this repeating error message on Intune Portal . We would appreciate to get any thoughts about this case.
    Br.
    Jukka

    Hi Jukka,
    Mobile policy doesn't apply to clients using the Full Client download.  Please open a support case so the team can assist in further troubleshooting.
    Thanks,
    Jon L. - MSFT - This posting is provided "AS IS" with no warranties and confers no rights.

  • A client made a DirSync LDAP request for a directory partition. Access was denied due to the following error

    We started getting this error when we installed Lync Server. I already verified that the "RTCHSUniversalServices" group has “Replicating Directory Changes" permission.
    ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    A client made a DirSync LDAP request for a directory partition. Access was denied due to the following error.
    Directory partition:
    DC=<domain>,DC=com
    Error value:
    8453 Replication access was denied.
    User Action
    The client may not have access for this request. If the client requires it, they should be assigned the control access right "Replicating Directory Changes" on the directory partition in question.
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    Domain Controllers and Lync server are running on Windows 2008 SP2. Any other things that I could check?

    A client made a DirSync LDAP request for a directory partition. Access was denied due to the following error.
    Directory partition:
    DC=<domain>,DC=com
    Error value:
    8453 Replication access was denied.
    User Action
    The client may not have access for this request. If the client requires it, they should be assigned the control access right "Replicating Directory Changes" on the directory partition in question.
    oas4ever

  • Retrieving the COM class factory for component with CLSID {01732742-D1A2-11D7-99EB-505054503030} failed due to the following error: 80040154.

    An unhandled exception occurred and the process was terminated.
    Application ID: /LM/W3SVC/1/ROOT/OPA
    Process ID: 10296
    Exception: System.TypeInitializationException
    Message: The type initializer for 'Microsoft.MSCOM.MemberServices.Passport.Interop.RPSCoreSingleton' threw an exception.
    StackTrace:    at Microsoft.MSCOM.MemberServices.Passport.Interop.RPSCoreSingleton.Finalize()
    InnerException: System.Runtime.InteropServices.COMException
    Message: Retrieving the COM class factory for component with CLSID {01732742-D1A2-11D7-99EB-505054503030} failed due to the following error: 80040154.
    StackTrace:    at Microsoft.MSCOM.MemberServices.Passport.Interop.RPSCore..ctor()
       at Microsoft.MSCOM.MemberServices.Passport.Interop.RPSCoreSingleton..ctor(String reserved)
       at Microsoft.MSCOM.MemberServices.Passport.Interop.RPSCoreSingleton..ctor()
       at Microsoft.MSCOM.MemberServices.Passport.Interop.RPSCoreSingleton..cctor()
    can any one help me with this?

    Try running the SharePoint Product Configuration Wizard and see if that clears up this issue.
    Cheers
    Michael Wharton, MVP, MBA, PMP, MCT, MCTS, MCSD, MCSE+I, MCDBA
    Website http://www.WhartonComputer.com
    Blog http://MyProjectExpert.com contains my field notes and SQL queries

  • Error: the QueryInterface call on the COM component for the interface with IID '{00063033-0000-0000-C000-000000000046}' failed due to the following error: Library not registered.

    I have a outlook 2007 plugin created in VS 2008 that reads calendar meetings. This plugin also works with outlook 2010. I used to debug this application from VS 2010 as well.
    Last month, I installed Office 365 to test something. Later I uninstalled this version but after that my plugin application is crashing, every time a new appointment/meeting is created in calendar.
    I get the below error:
    Unable to cast COM object of type 'System.__ComObject' to interface type 'Microsoft.Office.Interop.Outlook._AppointmentItem'. This operation failed because the QueryInterface call on the COM component for the interface with IID '{00063033-0000-0000-C000-000000000046}'
    failed due to the following error: Library not registered. (Exception from HRESULT: 0x8002801D (TYPE_E_LIBNOTREGISTERED)).
    Tekriti Software

    Thanks for your sharing and have a nice day.
    Yoyo Jiang[MSFT]
    MSDN Community Support | Feedback to us
    Develop and promote your apps in Windows Store
    Please remember to mark the replies as answers if they help and unmark them if they provide no help.

  • Can't launch itunes due to the following error; The procedure entry point AVCFPlayerAppliesMediaSelectionCriteriaKey could not be located in the dynamic link library AVFoundationCF.dll.

    Can't launch itunes due to the following error; The procedure entry point AVCFPlayerAppliesMediaSelectionCriteriaKey could not be located in the dynamic link library AVFoundationCF.dll.

    Hey bcolden,
    I would try uninstalling and reinstalling following the directions in here:
    Removing and reinstalling iTunes and other software components for Windows Vista, Windows 7, or Windows 8
    http://support.apple.com/kb/HT1923
    This section in particular contains important information in the uninstall process:
    Use the Control Panel to uninstall iTunes and related software components in the following order and then restart your computer:
    iTunes
    Apple Software Update
    Apple Mobile Device Support
    Bonjour
    Apple Application Support (iTunes 9 or later)
    Important: Uninstalling these components in a different order, or only uninstalling some of these components may have unintended affects.
    Let us know if following that article and uninstalling those components in that order helped the situation.
    Welcome to Apple Support Communities!
    Best,
    Delgadoh

  • OEM12c :: Agent has stopped monitoring. The following errors are reported :  DISK_FULL

    Hello sir,
    I am new to EM12c Cloud Control.
    Problem is that EM shows "Agent Unreachable" as status for an agent.
    and also shows following error ::Agent has stopped monitoring. The following errors are reported :  DISK_FULL.
    Agent status is as follows:
    E:\Agent_Grid\agent_inst\bin>emctl status agent
    Oracle Enterprise Manager Cloud Control 12c Release 3
    Copyright (c) 1996, 2013 Oracle Corporation.  All rights reserved.
    Agent Version     : 12.1.0.3.0
    OMS Version       : 12.1.0.3.0
    Protocol Version  : 12.1.0.1.0
    Agent Home        : E:/Agent_Grid/agent_inst
    Agent Binaries    : e:/Agent_Grid\core\12.1.0.3.0
    Agent Process ID  : 7164
    Parent Process ID : 5816
    Agent URL         :
    Repository URL    :
    Started at        : 2013-11-20 11:58:25
    Started by user   :
    Last Reload       : (none)
    Last successful upload                       : 2013-11-20 12:02:58
    Last attempted upload                        : 2013-11-20 12:02:58
    Total Megabytes of XML files uploaded so far : 0.06
    Number of XML files pending upload           : 0
    Size of XML files pending upload(MB)         : 0
    Available disk space on upload filesystem    : 1.15%
    Collection Status                            : [COLLECTIONS_HALTED(
      UPLOAD SYSTEM Threshold (UploadMaxDiskUsedPct: 98) exceeded with 98.84559)]
    Heartbeat Status                             : Ok
    Last attempted heartbeat to OMS              : 2013-11-20 12:19:04
    Last successful heartbeat to OMS             : 2013-11-20 12:19:04
    Next scheduled heartbeat to OMS              : 2013-11-20 12:20:04
    Agent is Running and Ready
    I also found some help at
    Agent has stopped monitoring. The following errors are reported : COLL_DISABLED|DISK_FULL | Sunkupuli DBA
    but didn't help me.
    Please, help How can Agent start Monitoring again?
    Many Thanks in advance

    Free disk space or Add disk space - such that the Disk usage is less than 95%
    The Agent Collections will be re-enabled (when Disk usage falls below 95%)
    Wait for a few minutes; the Agent and Host Targets should now be shown Up in Console.
    Symptoms are almost similar to MOS note 1501904.1

  • The SAProuter service failed to start due to the following error:

    I installed the SAP router 710 on windows server 2003 NON_SAP SYSTEM. I installed it successfully using the command:
    >ntscmgr install SAProuter -b c:\saprouter\saprouter.exe -p "service -r"
    But when trying to start the service I am facing this error:
    "SAP router service failed to start due to the following error: This application has failed to start because the application configuration is incorrect. Reinstalling the application may fix this problem".
    I removed and reinstalled it, but again when trying to start the service facing the same error.
    Plz help me in resolving this issue and also let me know using which user I need to start the SAPRouter Service(Local System Account or any other account) . Do the needful as the matter is urgent
    Thanks in advance
    Ali

    Hi Anil,
    The version that I am using to install is SAP Router 710 on windows 2003 x64, I have to installed the SAP router on non SAP System.
    now when I am trying to start the service, it is giving an error as mentioned above.
    Plz help
    Regards
    Ali
    Edited by: Mirza Munnawar Ali Baig on Jun 2, 2008 3:48 PM

  • Retrieving the COM class factory for component with CLSID {479A1AAC-C148-40BB-9868-A9773DA66AF9} failed due to the following error: 80040154 Class not registered (Exception from HRESULT: 0x80040154 (REGDB_E_CLASSNOTREG)).

    Hi,
    I tried to use the
    SWFToImageObject Objswfobj = new SWFToImageObject(); for Capturing the Chart as Image using SWFToImage.dll
    But whenever creating the object as above firsrt line of the code i am getting the below error. 
    Retrieving the COM class factory for component with CLSID {479A1AAC-C148-40BB-9868-A9773DA66AF9} failed due to the following error: 80040154 Class not registered (Exception from HRESULT: 0x80040154 (REGDB_E_CLASSNOTREG)).
    if required any components or any solutions.
    Thaks in advance.
    Regards
    Ravikumar

    Hi,
    I am not able to find sharepoint word in your post so can you please confirm that your question is related to sharepoint?
    > Class not registered
    For you issue, this error usually comes if you don't have DLL in proper place so add SWFToImage.dll in GAC and then add this assembly reference in your project from GAC. 
    Hemendra: "Yesterday is just a memory,Tomorrow we may never see"
    Whenever you see a reply and if you think is helpful, click "Vote As Helpful"! And whenever
    you see a reply being an answer to the question of the thread, click "Mark As Answer

Maybe you are looking for