Windows 10: "Package Does Not Have OobeApplicability" in CBS Log, What Does it Mean?

I checked my CBS logs and saw something that has never happened before; it's normal behaviour for CBS to log a series of "detect package" messages, that's nothing newhowever, it would appear that since 10:57am on the 13th of December, a new message appears under every "detecting package" log, which is "Package Does Not Have OobeApplicability"I know oobe means Out Of Box Experience or something similar to that, but I'm unsure what this log message means or why it has started appearingI did start installing the latest Cumulative Update on the 13th, at 10:57am; however, there were 'Detecting Pack

:)

 

"Public CBS Session Leak Detected" in CBS Logs- What Does it Mean?

Hello, JamesBacon620

Welcome to Microsoft Community.

In the context of CBS (Component-Based Servicing) logs in Windows, the message "Public CBS Session Leak Detected" typically indicates a problem related to the management of system resources, specifically with sessions and objects. Here's what the information in your log entry means:

1. Public CBS Session Leak Detected: This message suggests that the Component-Based Servicing system has identified a situation where a session has not been closed or released properly. CBS manages various components and updates in Windows, and sessions are used to keep track of these operations.
   
2. Session ID: The "Session ID" mentioned in the log entry is a unique identifier associated with a specific operation or task in CBS. It helps CBS track and manage the components and updates being installed or modified.
   
3. Clients (FodHelper and SystemSettings): These are the components or applications that were involved in the session that experienced the leak. In your log entry, FodHelper (LanguageFeaturesOnDemand) and SystemSettings are identified as the clients responsible for this issue.
   
4. Reference Count: The reference count indicates how many references or instances of a particular object or session are active. In your log entry, it mentions a reference count of 6 for both clients, which suggests that there were six references to these sessions when there should have been none or fewer.
   
5. HRESULT Codes: The HRESULT (Handle to Result) codes are error codes that provide more information about the nature of the problem. In your log entry, the HRESULT codes (0x880f0909 and 0x888f0909) indicate that a public object leak occurred.
   

Generally, "Session Leaks" like the one mentioned in your logs can be indicative of a problem with system resource management, but they don't necessarily mean that there's a security threat or malware present. These leaks can potentially lead to system instability or performance issues over time if they accumulate.

Overall, this is a normal report and CBS.log will only record updates to these system components and resources. These Objects are just resources from the application or system performance. It does not involve personal privacy information on your PC. Do not worry

Hope it helps! If any update, welcome to share with us.

Best regards,



Chandy |Microsoft Community Support Specialist

 

"Public CBS Session Leak Detected" in CBS Logs- What Does it Mean?

combing through CBS logs to find another instance of some other event, there's 2 errors back to back (at the same time), that say "Public CBS Session Leak Detected", then it lists the Session ID and lists clients FodHelper and SystemSettings (attached below)

a bit later, Trusted Installer started doing its usual shutdown process, and it said "Session Leaks appear to be benign, continuing shutdown process"; right below that however, the 2 errors appeared again, displaying the exact same things described, and also shown below. a few logs below that, it also said "Mark Session as Corrupt"

this was on the 4th of September; since then, even though I wasn't aware of these events happening, I've done countless MalwareBytes and Windows Defender Scans (Full scans, Offline scans, and Rootkit scans as well), and I've done sfc /scannow, chkdsk, and DISM commands in CMD quite a bit too, with no detections on anything

can anyone quickly tell me what these 'Session Leaks' mean, the clients that apparently caused them, and if they're something to worry about?

 

Anyone know what "Forcing GE" means in the CBS Log?

I checked my CBS log today and it seems every day I am getting hundreds of the below type of entries. It seems to be for all versions of 17763.1 and for packages on that version. For all I know, this may have been going on since the 17763 public build
release... and seems to cover my Win 10 Pro version and, as you can see, others. This is a very small sample of what I see in the logs.

Thanks for reading.

Info CBS Appl:Forcing GE on revision on parent:Microsoft-Windows-ServerSolutionEdition~31bf3856ad364e35~amd64~~10.0.17763.1

Info CBS Appl:Forcing GE on revision on parent:Microsoft-Windows-ServerStandardACorEdition~31bf3856ad364e35~amd64~~10.0.17763.1

Info CBS Appl:Forcing GE on revision on parent:Microsoft-Windows-ServerStandardCorEdition~31bf3856ad364e35~amd64~~10.0.17763.1

Info CBS Appl:Forcing GE on revision on parent:Microsoft-Windows-ServerStandardEdition~31bf3856ad364e35~amd64~~10.0.17763.1

Info CBS Appl:Forcing GE on revision on parent:Microsoft-Windows-ServerStandardEvalCorEdition~31bf3856ad364e35~amd64~~10.0.17763.1

Info CBS Appl:Forcing GE on revision on parent:Microsoft-Windows-ServerStandardEvalEdition~31bf3856ad364e35~amd64~~10.0.17763.1

Info CBS Appl:Forcing GE on revision on parent:Microsoft-Windows-ServerStandardNanoEdition~31bf3856ad364e35~amd64~~10.0.17763.1