Windows 10: Administrative Events

Hello, I would like to find out more information about what is causing this 2 errors on my computer also how can i fix them?! are they related ?! , if anyone can help me I would really appreciate!!


Thank you


Error1

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin

Source: Microsoft-Windows-Kernel-EventTracing

Date: 23-Jun-20 12:52:11

Event ID: 2

Task Category: Session

Level: Error

Keywords: Session

User: MATEIASPC2\chedy

Computer: MateiasPC2

Description:

Session "dfa2c640-651d-488d-a479-2fd7a7ca6e29" failed to start with the following error: 0xC0000022

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}" />

<EventID>2</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>2</Task>

<Opcode>12</Opcode>

<Keywords>0x8000000000000010</Keywords>

<TimeCreated SystemTime="2020-06-23T11:52:11.1404983Z" />

<EventRecordID>20</EventRecordID>

<Correlation />

<Execution ProcessID="7604" ThreadID="3744" />

<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>

<Computer>MateiasPC2</Computer>

<Security UserID="S-1-5-21-3344509223-1582788071-810318366-1001" />

</System>

<EventData>

<Data Name="SessionName">dfa2c640-651d-488d-a479-2fd7a7ca6e29</Data>

<Data Name="FileName">

</Data>

<Data Name="ErrorCode">3221225506</Data>

<Data Name="LoggingMode">4194560</Data>

</EventData>

</Event>


Error2

Log Name: Microsoft-Windows-AppModel-Runtime/Admin

Source: Microsoft-Windows-AppModel-Runtime

Date: 23-Jun-20 12:42:19

Event ID: 65

Task Category: None

Level: Error

Keywords: Process

User: MATEIASPC2\chedy

Computer: MateiasPC2

Description:

Failed with 0x57 retrieving AppModel Runtime status for package Windows.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-AppModel-Runtime" Guid="{f1ef270a-0d32-4352-ba52-dbab41e1d859}" />

<EventID>65</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x2000000000000001</Keywords>

<TimeCreated SystemTime="2020-06-23T11:42:19.9453953Z" />

<EventRecordID>662</EventRecordID>

<Correlation />

<Execution ProcessID="5384" ThreadID="5496" />

<Channel>Microsoft-Windows-AppModel-Runtime/Admin</Channel>

<Computer>MateiasPC2</Computer>

<Security UserID="S-1-5-21-3344509223-1582788071-810318366-1001" />

</System>

<EventData>

<Data Name="ErrorCode">87</Data>

<Data Name="PackageFullName">Windows</Data>

</EventData>

</Event>

:)

 

Export All Administrative Events to Excel

To analyze events, from the Windows Event Viewer, there is a simple way to export all Administrative Events to Excel, with PowerShell.

Exporting all Administrative Events to Excel is a simple two Step process, as described here:

Step 1 - Create the Administrative Events View .xml file

1. Open Eventviewer (%windir%\system32\eventvwr.msc)
2. Navigate to: Event Viewer (Local) > Custom Views > Administrative Events
3. In the “Actions” pane select “Filter Current Custom View”.
4. Select the the XML tab.
5. Press Ctrl+A to select all the XML code of the Custom View.
6. Open a notepad, paste the selected code and save the file to your Desktop as AdmEvtView.xml

Step 2 - Create the csv file with the events

1. Download the ExportEvtCSV.zip file, which contains the script ExportEvtCSV.ps1 and unzip it, on your Desktop.
   It's not a fancy script, just basic PowerShell commands to create a csv file on the Desktop.
2. In Windows Search, type “ISE” (without the quotes) to open “Windows PowerShell ISE” and Run as administrator
   
3. To allow running the script, change the ExecutionPolicy, for this session. To do that, in the Console pane type:
   Code:
4. In the Windows PowerShell ISE, open and run the script: ExportEvtCSV.ps1
   The script will create a csv file with a name YYYYMMDD.HHMM.csv on the Desktop
5. When done, open the newly created .csv file, format the columns as needed and optionally save it as .xlsx, if you wish.

That’s it! You now have all the Administrative Events in Excel for filtering and further analysis.

Now to the more technical hard stuff... *Confused

There is a reason for running the script from within PowerShell ISE!

It would be great if everything was also working perfectly, when running the script from an elevated PowerShell too.

We can run it from an elevated PowerShell, which means that you just follow the Step 1, as above but for the Step 2 instead of the ISE you run the script from an elevated PowerShell.

The problem is that it will work only for anybody who has en-US format for the dates. Everyone else, who has another format (i.e. en-GB, fr-FR, el-GR etc.), the dates are not translated properly by Excel (although the script uses the –UseCulture switch) and remain as text in the en-US format.

I'm not sure if this a bug of the "export-csv" cmdlet, but although it runs the way it supposed to from within the ISE, from PowerShell there is a problem with the dates format.
As I haven’t found a way to overcome this obstacle, any suggestion from the PowerShell gurus of the forum (like my good friend Shawn @Brink, for instance), is welcome.

 

Administrative events, and others

Thousands of administrative events, many critical and error level events. I am looking for some suggestions for where to find assistance to resolve these events.

 

Settings can't be opened using the built-in administrator account


Hello,
Unfortunately I have the same issue as Dabz from upgrading win7 to win10.
I've tried opening settings using all the suggested methods and it will not load using my account with Administrator access nor the built-in Administrator profile. I also tried other methods not listed such as using Run. Control panel is just a stepping stone to add users in Settings.
I'm also having explorer.exe issues, which I believe is preventing Settings from loading.
Using cmd (Admin) I successfully created a new user profile [and granted admin access also using cmd (Admin)], however win10 will not allow this account to log on. win10 does not list this new user within control panel but it does in the start menu. win10 will not allow to log in or switch to the new account via the start menu either.
I can access settings in Safe Mode but this will not allow me to create a new account.
Any help/suggestions will be greatly appreciated.
Cheers