Windows 10: Event 28 Kernel-EventTracing, Event 6147, Event 6155 LSA LSAsrv

Event 28 Kernel-EventTracingError setting traits on Provider {77811378-e885-4ac2-a580-bc86e4f1bc93}. Error 0x C0000005- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">- <System> <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}" /> <EventID>28</EventID> <Version>0</Version> <Level>2</Level> <Task>3</Task> <Opcode>25</Opcode> <Keywords>0x8000000000000a20</Keywords> <TimeCreated SystemT

:)

 

Event id 3 & 4 Microsoft-Windows-Kernel-EventTracing/Admin

my system is running on windows 10 pro(x64) 10586 v 1511 . recently, i have noticed the following errors logged in the event viewer:

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin

Source: Microsoft-Windows-Kernel-EventTracing

Date: 12/4/2015 1:58:51 PM

Event ID: 3

Task Category: Session

Level: Error

Keywords: Session

User: SYSTEM

Computer: ATULRSURI-PC

Description:

Session "HomeGroupLog" stopped due to the following error: 0xC0000188

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />

<EventID>3</EventID>

<Version>1</Version>

<Level>2</Level>

<Task>2</Task>

<Opcode>14</Opcode>

<Keywords>0x8000000000000010</Keywords>

<TimeCreated SystemTime="2015-12-04T08:28:51.342458400Z" />

<EventRecordID>52</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="6388" />

<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>

<Computer>ATULRSURI-PC</Computer>

<Security UserID="S-1-5-18" />

</System>

<EventData>

<Data Name="SessionName">HomeGroupLog</Data>

<Data Name="FileName">C:\WINDOWS\Logs\Homegroup\homegrouplog.etl</Data>

<Data Name="ErrorCode">3221225864</Data>

<Data Name="LoggingMode">293601285</Data>

<Data Name="FailureReason">0</Data>

</EventData>

</Event>

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin

Source: Microsoft-Windows-Kernel-EventTracing

Date: 12/4/2015 1:58:51 PM

Event ID: 4

Task Category: Logging

Level: Warning

Keywords: Session

User: SYSTEM

Computer: ATULRSURI-PC

Description:

The maximum file size for session "HomeGroupLog" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\Logs\Homegroup\homegrouplog.etl". The maximum files size is currently set to 5242880 bytes.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />

<EventID>4</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>1</Task>

<Opcode>10</Opcode>

<Keywords>0x8000000000000010</Keywords>

<TimeCreated SystemTime="2015-12-04T08:28:51.342452800Z" />

<EventRecordID>51</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="6388" />

<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>

<Computer>ATULRSURI-PC</Computer>

<Security UserID="S-1-5-18" />

</System>

<EventData>

<Data Name="SessionName">HomeGroupLog</Data>

<Data Name="FileName">C:\WINDOWS\Logs\Homegroup\homegrouplog.etl</Data>

<Data Name="ErrorCode">3221225864</Data>

<Data Name="LoggingMode">293601285</Data>

<Data Name="MaxFileSize">5242880</Data>

</EventData>

</Event>

in the said context it s pertinent to state that i do not have any homegroup on my system.

assistance in this regard , shall be appreciated.

 

EVENT ID 2 Microsoft-Windows-Kernel-EventTracing/Admin

my system is running on windows 10 pro(x64) 10586 V 1511 . The following error is logged in the event viewer:

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin

Source: Microsoft-Windows-Kernel-EventTracing

Date: 12/4/2015 8:19:21 PM

Event ID: 2

Task Category: Session

Level: Error

Keywords: Session

User: SYSTEM

Computer: ATULRSURI-PC

Description:

Session "Muroc System Trace" failed to start with the following error: 0xC0000035

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />

<EventID>2</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>2</Task>

<Opcode>12</Opcode>

<Keywords>0x8000000000000010</Keywords>

<TimeCreated SystemTime="2015-12-04T14:49:21.007327400Z" />

<EventRecordID>53</EventRecordID>

<Correlation />

<Execution ProcessID="3444" ThreadID="4452" />

<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>

<Computer>ATULRSURI-PC</Computer>

<Security UserID="S-1-5-18" />

</System>

<EventData>

<Data Name="SessionName">Muroc System Trace</Data>

<Data Name="FileName">

</Data>

<Data Name="ErrorCode">3221225525</Data>

<Data Name="LoggingMode">256</Data>

</EventData>

</Event>

the event is logged when i start the system. further, i do not have any homegroup on my system.

kindly, assist me in resolving the error.

regards,

Atul

 

Event ID 6033: LSA (LsaSrv)

Hi.
Today two events 6033 appeared in my events log:

"An anonymous session connected from MY_COMPUTER has attempted to open an LSA policy handle on this machine. The attempt was rejected with STATUS_ACCESS_DENIED to prevent leaking security sensitive information to the anonymous caller.
The application that made this attempt needs to be fixed. Please contact the application vendor. As a temporary workaround, this security measure can be disabled by setting the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contr ol\Lsa\TurnOffAnonymousBlock DWORD value to 1.
This message will be logged at most once a day."

What's going on? I ran both Malwarebyter Anti-Rootkit and Anti-Malware but nothing has been found.

Thank you.

UPDATE: I noticed that, both times, Sandboxie was started (manually). Maybe it's caused by Sandboxie.