Windows 10: System Event Notification errors with domain logins

Hey guys,

This error started happening only on computers with 1511 installed. The original RTM of Windows 10 doesn't do this, nor do Windows 7, 8 and 8.1. I tried some Google searches but all I see are relevant to 7 or 8, not Windows 10. It must have been something changed between RTM and 1511 that did it, too.

Anyway,

This only happens once, but let me explain.

When I refurbish computers for our employees, I wipe the hard drive completely (either diskpart "clean" via the recovery shell, or using DBAN to wipe the partition table if I can't get into WinRE.

I then boot it up using network boot. We have a Windows Deployment Services server set up so we can install Windows using PXE. I put the Windows 10 Enterprise Version 1511 .wim in there and it installs fine.

After install I make a local account, make sure the drivers get installed automatically (so far, it's been auto-magic for all our hardware, even NVIDIA and AMD graphics cards), install antivirus + MS Office and whatever special software that employee would need, and then I name the machine and put it on the domain.

To prevent extra crap from being created in C:/Users (and in the registry) I don't log in with a domain account. I let the employees do that themselves.

The first time any domain account* tries to log in, it errors after about 20 seconds with
Code: Windows couldn't connect to the System Event Notification Service service. Please consult your system administrator.[/quote] If they put their password in again, it goes through and all the initial settings are applied from our Group Policy Objects.

*I noticed that if I log in as an account which is a Domain Administrator (and via our GPOs, is also added to the Administrators group on the machine), I don't get that error. It only shows up for "normal" users which are not part of admins.

Nothing critical by any means as it will always work on the second try, but I'm really curious why it happens at all. What service is it even trying to connect to? The fact it happens on literally every computer (it even happens in VMWare images which I've done to test GPO settings) would imply it's not a problem with a particular machine, rather something in our domain. Or it's possible there's a GPO that was set years ago for Windows 7 that didn't cause any detrimental effects until now.

I'd be happy to provide diagnostic/debug stuff, just tell me what you need and I'll try it in one of my VMs!

:)

 

Remote Login and New admin account created on my machine - hacked?

OK so a user named Lorenco was logged into my machine today when I went to login.

This user account should not exist and was connected remotely I believe

I captured all the event logs, what do I need to verify this was a hack or a legit login?

Received user logon notification on session 4.

shell\roaming\settingsync\settingprofilehandler.cpp(24)\SettingSync errors

event log cleared the user

The audit log was cleared.

Subject:

Security ID: GROD\Lorenco

Account Name: Lorenco

Domain Name: GROD

Logon ID: 0x46D9E82

A user's local group membership was enumerated.

Subject:

Security ID: GROD\Lorenco

Account Name: Lorenco

Account Domain: GROD

Logon ID: 0x46D9EA0

User:

Security ID: GROD\Lorenco

Account Name: Lorenco

Account Domain: GROD

Process Information:

Process ID: 0x2618

Process Name: C:\Users\Lorenco\Desktop\GoogleChromePortable\App\Chrome-bin\chrome.exe

Much more in the logs..

 

QuickBooks stopped working with Windows 10 Version 1607 (OS Build 14393.187)

Since the feature updates to Windows 10 Pro, Domain resident system, QuickBooks 2010 will not complete the login process and posts a Program has stopped working error or crashes.

Attempted to open as administrator with same results.

Windows Event log errors:

Event ID 4 Error - Returning NULL QBWinInstance Handle

Event ID 1000 Application Error - Exception code: 0xc000041d

Obviously if I rollback to an earlier build, problem solved, that doesn't resolve why it's happening.

Any thoughts or feedback would be appreciated.

Thanks in advance,

LMB - Lario

***Post moved by the moderator to the appropriate forum category.*** 

 

Hi,

we are experiencing the same issue. Did you ever get to the bottom of this?

Thanks!

 

just a thought... are you disabling UAC in your environment?

 

Hmm, having the same issue on our domain joined computers. Trouble is we are a school with limited class time and the user isn't necessarily logging into the same computer everytime. Multiply this by a class of 30 and it's alot of wasted time.

We have tried a few different things, nothing resulting in a fix.

 

We are using monitoring software called ABTutor.... we are wondering if that has something to do with it... but cant definitively point the finger at that yet...

 

We don't have any software like that - literally it's a "vanilla" installation from the install disc, I just name the machine and join it to the domain. Nothing else.

 

wonder if there is any fixes in the updates?

 

It's possible. I haven't seen the message recently, so I wonder what it was (if it's really fixed for good)