Windows 10: Event Viewer queries on my Windows 10 laptop

I have been looking through my Windows 10 (14393) Event Log lately and see a lot of errors that I would like to get cleaned up if possible, and was hoping I could have some advice on why they might be occurring and how to fix them?

The main ones occurring consistently are ESENT (ID varies), Kernel-PNP (219) and DistributedCOM (10010 and 10016).

The most common are ESENT and DistributedCOM errors and I would like to fix them if possible:

DistributedCOM error:

ID 10010 - "The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout."

ID 10016 - "The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool."


These above happen multiple times a day.

Kernel-PNP

ID 219 - "The driver \Driver\WudfRd failed to load for the device ROOT\WPD\0000."

ESENT Errors

ID 508 - "SettingSyncHost (568) {464A087D-ED25-4EFB-8D27-26C8A01E5F89}: A request to write to the file "C:\Users\Alex\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb" at offset 16384 (0x0000000000004000) for 16384 (0x00004000) bytes succeeded, but took an abnormally long time (15 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem."

ID 489 - "SettingSyncHost (568) An attempt to open the file "C:\Users\Alex\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\meta.edb" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8)."

ID 507 - "RemindersServer (5336) CortanaCoreInstance: A request to read from the file "C:\Users\Alex\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ESEDatabase _CortanaCoreInstance\CortanaCoreDb.dat" at offset 278528 (0x0000000000044000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (17 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem."

ID 507 - "svchost (4444) Unistore: A request to read from the file "C:\Users\Alex\AppData\Local\Comms\UnistoreDB\store.vol" at offset 7667712 (0x0000000000750000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (18 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem."

ID 636 - "wuaueng.dll (1144) SUS20ClientDataStore: Flush map file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.jfm" will be deleted. Reason: ReadHdrFailed."

ID 640 - "wuaueng.dll (1144) SUS20ClientDataStore: Error -1919 validating header page on flush map file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.jfm". The flush map file will be invalidated. Additional information: [SignDbHdrFromDb:Create time:08/10/2016 23:27:45.874 Rand:339180914 Computer:] [SignFmHdrFromDb:Create time:08/10/2016 23:27:45.868 Rand:82576924 Computer:] [SignDbHdrFromFm:Create time:08/10/2016 23:28:02.533 Rand:2986111576 Computer:] [SignFmHdrFromFm:Create time:08/10/2016 23:28:05.669 Rand:1313424785 Computer:]"

These are just a few examples of the errors that are constantly appearing in the event log viewer multiple times daily. I don't know if they are impacting performance but I would certainly like to rule them out. Anyone have any ideas how?

Any help much appreciated.

Alex





:)

 

Event viewer Query error

There's no way to say for sure if Anniversary Update will resolve your specific issues because they may be related to corruption of the OS from Upgrade.

Did you complete all the steps in
Windows 10 Install Integrity Checklist.

If you have any problems performing any of those steps, just ask back. I can also connect to go over your install now if you want to install

TeamViewer Download

at all defaults, leave it open on desktop and email back to me the ID and password it generates to gregrocker at hotmail.

 

Event viewer Query error

I tried using Disk cleanup to delete system files but even after that when I open Event Viewer then it shows the same error!

Thanks for your reply though and please suggest any idea if you have

 

Hi, just a couple of thoughts..
1. Start with basics:
From an elevated command prompt run
chkdsk c: /F
Post back the result, which you can get after a restart as follows:
How do I see the results of a CHKDSK that ran on boot? - Ask Leo!

Considering those related to Windows update, you could try this:
Windows Update - Reset in Windows 10 - Windows 10 Forums
http://www.thewindowsclub.com/softwa...der-in-windows

 

Thanks for the speedy response, Dalchina.

I have run all sorts of disk checks recently and they all come back OK, but I did run another one as you requested, and here is the report:


Checking file system on C:
The type of the file system is NTFS.
Volume label is ACER.




A disk check has been scheduled.
Windows will now check the disk.


Stage 1: Examining basic file system structure ...
676352 file records processed. File verification completed.
17332 large file records processed. 0 bad file records processed.
Stage 2: Examining file name linkage ...
873822 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered to lost and found.
Stage 3: Examining security descriptors ...
Cleaning up 77 unused index entries from index $SII of file 0x9.
Cleaning up 77 unused index entries from index $SDH of file 0x9.
Cleaning up 77 unused security descriptors.
Security descriptor verification completed.
98736 data files processed. CHKDSK is verifying Usn Journal...
36626904 USN bytes processed. Usn Journal verification completed.


Windows has scanned the file system and found no problems.
No further action is required.


717603985 KB total disk space.
260677932 KB in 521192 files.
342764 KB in 98737 indexes.
0 KB in bad sectors.
811585 KB in use by the system.
65536 KB occupied by the log file.
455771704 KB available on disk.


4096 bytes in each allocation unit.
179400996 total allocation units on disk.
113942926 allocation units available on disk.


Internal Info:
00 52 0a 00 36 73 09 00 7b 46 11 00 00 00 00 00 .R..6s..{F......
5b 52 00 00 1b 00 00 00 00 00 00 00 00 00 00 00 [R..............


Windows has finished checking your disk.
Please wait while your computer restarts.

Is there anything else I can look at? All of these errors are filling my Event Viewer and they are bugging me somewhat. Especially the DistributedCOM and ESENT ones.

Hope someone can help me resolve these *Smile

Thanks

 

Ok, have you looked at the other two links I posted?

Note that each fault type requires separate thought analysis and action as you may appreciate.

The hardware issues do seem disconcerting. Don't know what exactly to suggest there.
A web search suggests some ideas:
How can I test for hardware failures in my computer?
Pc-Check® Diagnostic Software
Use This Powerful System Tool to Check Windows Hardware | Gizmo's Freeware
How To Test Your PC For Failing Hardware
How to Identify Which Hardware Component is Failing in Your Computer

 

I somehow didn't see the other two links that you posted. I will have a look at them and see if I can find any solutions.

Do you think I can rule the hard disk out as the problem? I have done disk checks and RAM checks and there doesn't appear to be anything wrong with the hardware.

 

I would suggest the obvious- focus on the most frequently occurring hardware-related report, and try to get further information on that. Work with the report detail.

Run stress tests on your PC as per suggestions above.

If you wanted some sort of reference, you could, say, swap out your disk and install Windows alone, see what event viewer says then.

You might prefer this view of the event log using freeware: note no hardware related reports there.

 

Thanks for the reply again Dalchina.

I have noticed something about this specific DCOM error during my investigations:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

It occurs every single time I lock the system (windows logo + L), without fail. This may be linked in with the lock screen problems I have been having.

Having looked around, I find the guides on fixing this error look quite complex. Does anyone have any basic guides for doing so? This error is clearly related to either the lock screen or locking the PC, has anyone else experienced this?

Alex

UPDATE:

I gave one of the guides online a go for this and managed to sort it I think as the error no longer appears. But two issues:

1) My system seems sluggish since doing this - I followed the guides properly, was there anything else I was supposed to do at the end? I set the permissions for the CLSID and the APPID in regedit back to TrustedInstaller

2) A new 10016 error!

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

These are different APPIDs and CLSIDs and I can't find a guide for this one regarding the DCOMCNFG part of the process. The error in my initial thread related to Runtime Broker. What does this latest one refer to?

Thanks for any advice *Smile

 

I have been having the exact same problems as you show for the last few... months now with the /unistore/DB error event id 532 and the DCOM with the exact same keys you show above.

I have tried to modify the permissions as per several articles on the web trying both my admin name and TrustedInstaller, both with no effect, the errors still keep coming. Apart from the mass of events recorded (> 1000) there doesn't seem to be any effect on my PC. However, like you I would like to get to the bottom of this. Any constantly recurring error CAN'T be good.... can it?

 

Hi, you might try- nothing to lose- Tweaking.com's free cautious repair tool.
Observing the cautious steps, apply registry permissions repairs only, then, if you feel appropriate, other permissions repairs.

 

Good call dalchina. Downloaded Tweaking.com's prog and gave it a whirl. It actually fixed a number of minor issues which were bugging me such as 'Tile' issues and fixed them.

I 'think' it also speeded up the PC just a tad however, I got carried away and decided to set up chkdisk at next startup and Bamm....... Had a few issues, the main being the PC would not boot into windows. Got stuck on 10% for 3hrs. Eventually I powered off then went back in and cancelled the chkdisk feature.

For a while the "The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool." Error disappeared but after next boot is back,

It doesn't seem to affect much, but, it is still an 'error'.

Wish I could find the answer.

Thanks for your help anyway.

 

https://support.microsoft.com/en-us/...al-x64-edition

https://answers.microsoft.com/en-us/...4-780519363f59

 

I have had similar probs ie error like this

ie ESSENT error 508 510 & 533

They are in folders metastore and remotemeta store, I've seen others with similar probs, although there is no problem in the computer working other than the event log entries.

ONE THING worth noteing is that I do not have a "SettingSync" fold in that windows folder.

I don't think there is any problem with the drive. I mean why would it be manifest on just that one file(s) when billion of other files have no problems?

I have seen various talk about this but they seem to be from people who have no idea what they are talking about, clearly the drive is perfectly fine in my opinion.

So basically the file mentioned does not exist.

Anyhow there is something on it here

https://social.technet.microsoft.com...10itprogeneral

I have to reboot now I think - fingers crossed!!

 

Something I have been wondering about I wonder if this is linked to one drive???



I took a look at the file being written too and saw some lines like this



h t t p s : / / s 8 h 8 d q - d m 2 3 0 6 . f i l e s . 1 d r v . c o m / y 3 p K Z Q U n n N h n 9 J 5 X M 7 3 J l N B 7 n F 7 l i 1 Y t F V _ 5 H U 4 I B n f A b j E k _ b S B S i 4 P Y 0 M i a p i q 4 I I C Z v b X y U z d Z 4 0 d B v W P 9 c V V c v 6 H c 3 I T K I U D - 4 l Y v B z p h r j Y - d i m I M y v e D z 9 0 w _ G 6 F k c P f M x r 3 L d s V Y A T u W b w 4 3 Q g
D 8 A E 3 4 F 5 5 0 5 2 C A E F ! 7 7 3

Note the 1 d r v . c o m bit.

I don't really know what I am talking about it but I wonder if it relates to write to a remote drive, ie onedrive or whatever, which could take a while due to the network?


I just though I would mention that as someone might know more about it than me.