Windows 10: Event ID 2

So I have noticed I have been getting this sometime after Fall Creators Update.

Kernal Event Tracing
Session "" failed to start with the following error: 0xC0000022

Anybody know what this is?

:)

 

EVENT ID 2 Microsoft-Windows-Kernel-EventTracing/Admin

The Muroc errors might be coming from your Intel Wifi drivers on start-up if you have them installed.

There is a DLL in your Intel Wifi Installation directory

(e.g. C:\Program Files\Intel\WiFi\bin\MurocApi.dll) which is a logging system which writes to

C:\Program Files\Intel\WiFi\UnifiedLogging\MurocLog.log.

I have never seen any content in this log file. I don't think it is anything to worry about.

 

EVENT ID 2 Microsoft-Windows-Kernel-EventTracing/Admin

Hi!

I know this is an older thread, but basically it's only one of the very few with some kind of info about the infamous 'Muroc'-error. I saw it once or twice, but I have no idea how to interpret it. Is it a fatal/destructive error? Or should I just ignore
it when it is only once in a couple of weeks? Or is the damage then already done? What does it mean? Today I saw one, and restored my system from an earlier image. Is that actually necessary, because it's a lot of work...

Best regards,

Ron.

 

Hi,

Could be caused by a lot of things. Windows or an application cann't access a file due to security settings or it's corrupt etc.

I suspect that it's caused by an app you're running since I do not see this error on seven FCU installs I run at my place.
Some apps aren't fully FCU ready yet.

Cheers, *Wink

 

Try updating your drivers especially the network adapter drivers

LAN Killer E2500 Driver v9.0.0.46

- Intel WLAN Driver v20.0.2.3 / BT v20.0.0
- Killer WLAN Driver v12.0.0.438/BT v10.0.0.438 / [Killer Suite links removed due to how many problems it creates, stick to installing the drivers manually via device manager]

I've uploaded the files to my Media Fire account with only the INF Files

 

Hi,
@Snappy Phoenix, there is no relation at all between what you suggest and OP's problem.

Sorry, *Wink

 

Well I did search for it on Google and that's one of the suggestions that came up. See: event id 2 Session "" failed to start with the following error: 0xC0000022 - Google Search

It's a bit complicated thought as it seems many things could trigger that error

 

Hi,

Sure. I researched it too. It's a kernel tracing error that could have a number of causes.
From my POV it's either a corrupt log file (probably a .etl) or a file that's hit its maximum size though.

I'd recommend running a health check a la SFC /scannow and take it from there. It wouldn't surprise me either if it was caused by something like Google Chrome etc.

Cheers, *Wink

 

Funny enough every time I launch Chrome I get a DCOM 10016 error since FCU

 

This is the DM log collector that we use in the bsod forum. It will collect the event logs, msinfo32, dxdiag, etc for troubleshooting:
BSOD - Posting Instructions - Windows 10 Forums
Language - Add, Remove, and Change in Windows 10 General Tips Tutorials
Please post a zip into the thread for troublshooting.

 

DESKTOP-7V82FOC-Tue_10_24_2017_210712_32.zip

 

0xC0000022 is STATUS_ACCESS_DENIED
A process has requested access to an object, but has not been granted those access rights.

The event log only has 6 days of data.

For event ID 2 these are the types of entries in the event log:
Code: Event[225]: Log Name: System Source: MEIx64 Date: 2017-10-18T14:24:44.115 Event ID: 2 Task: N/A Level: Information Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: DESKTOP-7V82FOC Description: Intel(R) Management Engine Interface driver has started successfully.[/quote]

0xC0000022 was not displayed in the event log.

So if you see these error messages again please use the snipping tool or print screen > paint to post the message into the thread.

If the problems persist you could uninstall Spybot and evaluate the computer for a few days to see if the errors disappear.

Searching for access denied or permission issues in the event viewer displays events related to servers.

These we ordinarily don't have problems with and don't troubleshoot but this could be something to look at if you don't find other causes of the error.

Code: Event[246]: Log Name: System Source: Microsoft-Windows-DNS-Client Date: 2017-10-18T14:25:32.407 Event ID: 1014 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-20 User Name: NT AUTHORITY\NETWORK SERVICE Computer: DESKTOP-7V82FOC Description: Name resolution for the name _ldap._tcp.dc._msdcs.hsd1.md.comcast.net. timed out after none of the configured DNS servers responded.[/quote]

Code: Event[262]: Log Name: System Source: Microsoft-Windows-DNS-Client Date: 2017-10-18T14:32:34.901 Event ID: 1014 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-20 User Name: NT AUTHORITY\NETWORK SERVICE Computer: DESKTOP-7V82FOC Description: Name resolution for the name wpad timed out after none of the configured DNS servers responded.[/quote]

Code: Event[504]: Log Name: System Source: Microsoft-Windows-DNS-Client Date: 2017-10-22T09:10:35.831 Event ID: 1014 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-20 User Name: NT AUTHORITY\NETWORK SERVICE Computer: DESKTOP-7V82FOC Description: Name resolution for the name wpad timed out after none of the configured DNS servers responded.Event[505]: Log Name: System Source: Microsoft-Windows-DNS-Client Date: 2017-10-22T09:10:40.610 Event ID: 1014 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-20 User Name: NT AUTHORITY\NETWORK SERVICE Computer: DESKTOP-7V82FOC Description: Name resolution for the name _ldap._tcp.dc._msdcs.hsd1.md.comcast.net. timed out after none of the configured DNS servers responded.[/quote]

Code: Event[567]: Log Name: System Source: Microsoft-Windows-DNS-Client Date: 2017-10-22T09:18:48.677 Event ID: 1014 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-20 User Name: NT AUTHORITY\NETWORK SERVICE Computer: DESKTOP-7V82FOC Description: Name resolution for the name wpad timed out after none of the configured DNS servers responded.[/quote]

Code: Event[569]: Log Name: System Source: Microsoft-Windows-DNS-Client Date: 2017-10-22T09:19:02.186 Event ID: 1014 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-20 User Name: NT AUTHORITY\NETWORK SERVICE Computer: DESKTOP-7V82FOC Description: Name resolution for the name client.wns.windows.com timed out after none of the configured DNS servers responded.[/quote]

Code: Event[793]: Log Name: System Source: Microsoft-Windows-DistributedCOM Date: 2017-10-24T12:08:53.089 Event ID: 10016 Task: N/A Level: Error Opcode: Info Keyword: Classic User: S-1-5-21-2933038636-3799818134-3144607780-1001 User Name: DESKTOP-7V82FOC\Owner Computer: DESKTOP-7V82FOC Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user DESKTOP-7V82FOC\Owner SID (S-1-5-21-2933038636-3799818134-3144607780-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.[/quote]

Code: Event[797]: Log Name: System Source: Microsoft-Windows-DistributedCOM Date: 2017-10-24T12:21:49.308 Event ID: 10016 Task: N/A Level: Error Opcode: Info Keyword: Classic User: S-1-5-21-2933038636-3799818134-3144607780-1001 User Name: DESKTOP-7V82FOC\Owner Computer: DESKTOP-7V82FOC Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user DESKTOP-7V82FOC\Owner SID (S-1-5-21-2933038636-3799818134-3144607780-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.[/quote]

Code: Event[798]: Log Name: System Source: Microsoft-Windows-Time-Service Date: 2017-10-24T12:26:27.057 Event ID: 158 Task: N/A Level: Information Opcode: Info Keyword: N/A User: S-1-5-19 User Name: NT AUTHORITY\LOCAL SERVICE Computer: DESKTOP-7V82FOC Description: The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well.[/quote]

Code: Event[290]: Log Name: System Source: Microsoft-Windows-DistributedCOM Date: 2017-10-18T14:47:35.905 Event ID: 10016 Task: N/A Level: Error Opcode: Info Keyword: Classic User: S-1-5-21-2933038636-3799818134-3144607780-1001 User Name: DESKTOP-7V82FOC\Owner Computer: DESKTOP-7V82FOC Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user DESKTOP-7V82FOC\Owner SID (S-1-5-21-2933038636-3799818134-3144607780-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.[/quote]

 

Well I didn't get this error till FCU.