Windows 10: BSOD and repair component store

Lately in Win 10 x64 ver1703 RS2 I have got a BSOD,

1. Bad Pool Header
2. Unexpected Store Exception
3. Reference by Pointer

Bad Pool Header -- happened when I was just transfering a file to a USB and lately doing nothing.
Unexpected Store Exception -- happened after boot and I was about to open explorer.
Reference by Pointer -- happend doing nothing.

Never happened before when I was with Win10 x64 ver1511.

So I checked via sfc /scannow and there was no integrity error using sfc /scannow but in "Dism /Online /Cleanup-Image /ScanHealth " Component store is repairable.

But when I ran (copied the install.wim to the desktop)"Dism /Online /Cleanup-Image /RestoreHealth /Source:wim:C:\Users\My_PC\Desktop\install.wim:1 /limitaccess"It did not finish and said that the source file cannot be found.

The same was when I copied the whole "sources" with the "install.wim" in it. "It did not finish and said that the source file cannot be found."





How can I repair my component store?My Win 10 version is 1703 RS2 (updated from Win 10 ver 1511 via ISO of ver1703 -setup.exe).

I used MemTest the other day (looooong test!) but there was no issues found. THe BSOD is intermittent and not continous. Please help.

:)

 

Component Store Repair

Before I get into the results of those PowerShell commands, are you talking about the 17 MB free in my SYSTEM RESERVED partition? Is that a problem of too much space or too little, because I think it's been like that since I did my re-install a month ago.

Here are the results of those PowerShell commands:

PS C:\windows\PLA\reports> Get-ACL . | fl * | Out-String -Stream -Width 90

>>

PSPath : Microsoft.PowerShell.Core\FileSystem::C:\windows\PLA\reports

PSParentPath : Microsoft.PowerShell.Core\FileSystem::C:\windows\PLA

PSChildName : reports

PSDrive : C

PSProvider : Microsoft.PowerShell.Core\FileSystem

CentralAccessPolicyId :

CentralAccessPolicyName :

Path : Microsoft.PowerShell.Core\FileSystem::C:\windows\PLA\reports

Owner : NT SERVICE\TrustedInstaller

Group : NT SERVICE\TrustedInstaller

Access : {System.Security.AccessControl.FileSystemAccessRule,

System.Security.AccessControl.FileSystemAccessRule,

System.Security.AccessControl.FileSystemAccessRule,

System.Security.AccessControl.FileSystemAccessRule...}

Sddl : O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464

G:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464

DAI(A;OICIIO;GA;;;CO)(A;OICIIO;GA;;;SY)(A;;0x1301bf;;;SY)(A;OI

CIIO;GA;;;BA)(A;;0x1301bf;;;BA)(A;OICI;0x1200ab;;;LU)(A;CIIO;GA;

;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464

)(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-22

71478464)

AccessToString : CREATOR OWNER Allow 268435456

NT AUTHORITY\SYSTEM Allow 268435456

NT AUTHORITY\SYSTEM Allow Modify, Synchronize

BUILTIN\Administrators Allow 268435456

BUILTIN\Administrators Allow Modify, Synchronize

BUILTIN\Performance Log Users Allow CreateFiles,

ReadAndExecute, Synchronize

NT SERVICE\TrustedInstaller Allow 268435456

NT SERVICE\TrustedInstaller Allow FullControl

AuditToString :

AccessRightType : System.Security.AccessControl.FileSystemRights

AccessRuleType : System.Security.AccessControl.FileSystemAccessRule

AuditRuleType : System.Security.AccessControl.FileSystemAuditRule

AreAccessRulesProtected : True

AreAuditRulesProtected : False

AreAccessRulesCanonical : True

AreAuditRulesCanonical : True

PS C:\windows\PLA\reports> Get-ACL . | Select -Expand Access | Out-String -Stream -W

>>

FileSystemRights : 268435456

AccessControlType : Allow

IdentityReference : CREATOR OWNER

IsInherited : False

InheritanceFlags : ContainerInherit, ObjectInherit

PropagationFlags : InheritOnly

FileSystemRights : 268435456

AccessControlType : Allow

IdentityReference : NT AUTHORITY\SYSTEM

IsInherited : False

InheritanceFlags : ContainerInherit, ObjectInherit

PropagationFlags : InheritOnly

FileSystemRights : Modify, Synchronize

AccessControlType : Allow

IdentityReference : NT AUTHORITY\SYSTEM

IsInherited : False

InheritanceFlags : None

PropagationFlags : None

FileSystemRights : 268435456

AccessControlType : Allow

IdentityReference : BUILTIN\Administrators

IsInherited : False

InheritanceFlags : ContainerInherit, ObjectInherit

PropagationFlags : InheritOnly

FileSystemRights : Modify, Synchronize

AccessControlType : Allow

IdentityReference : BUILTIN\Administrators

IsInherited : False

InheritanceFlags : None

PropagationFlags : None

FileSystemRights : CreateFiles, ReadAndExecute, Synchronize

AccessControlType : Allow

IdentityReference : BUILTIN\Performance Log Users

IsInherited : False

InheritanceFlags : ContainerInherit, ObjectInherit

PropagationFlags : None

FileSystemRights : 268435456

AccessControlType : Allow

IdentityReference : NT SERVICE\TrustedInstaller

IsInherited : False

InheritanceFlags : ContainerInherit

PropagationFlags : InheritOnly

FileSystemRights : FullControl

AccessControlType : Allow

IdentityReference : NT SERVICE\TrustedInstaller

IsInherited : False

InheritanceFlags : None

PropagationFlags : None

Thanks,

Logan

 

Component Store Repair

I should have considered the possibility that there could be a link to something outside that directory. So that strange one won't be listed in your other pipeline, assuming it even exists.

Also, I don't know when I got it but my applied version is 15063.296. Perhaps that is just a difference from you not having the update you are trying to install yet.

I should have posted that much for you, since it has been sitting here unsubmitted while I tried looking at your other details. E.g. I suspect the 17 MB free space may still be a problem for you but I suppose you aren't really seeing a problem symptom yet
which points at it specifically. So I'll let that one go for now.

Although it looks like you don't have the problem with the registry that others had, something related is obviously causing those SFC and DISM messages. Let's take the first one as an example and look at it in more detail

So, in PowerShell, navigate to that directory and then do

Get-ACL . | fl * | Out-String -Stream -Width 90

Get-ACL . | Select -Expand Access | Out-String -Stream -Width 90

FWIW mine says it is owned by NT Service\TrustedInstaller

So, again, it looks as if something has been interfering or overzealously doing some ill-advised "cleaning".



HTH

Robert

---

 

Please read BSOD Posting Instructions

 

Hi sorry for the late reply. I sorted it out. It seem to have been caused by the AMD Radeon driver. Thanks for checking me out though *Wink