Windows 10: Windows 10 Fall Creators (1709) Update Issues

Please update the system specs in the "My Computer" section:
How To Fill Out Your System Specs
System Specs - Fill in at Ten Forums:
System Specs - Fill in at Ten Forums Site Use Tutorials
In the left corner below in your post you find 'My System Specs'.
After clicking it you can find a link a little below that says 'Update your System Spec', click on this link to get to the page where you can fill in your system specs.
System Info - See Your System Specs - Windows 7 Help Forums

Include PSU. cooler, case, peripherals and anything attached to the computer by wired or wireless (mouse, keyboard, headset, printer, xbox, etc.)



There were approximately 30 of these critical events in approximately 30 days:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
1) Were these spontaneous crashes or hard power offs?
a) Were there hangs, freezes, black, red, or blue screens, etc?
b) What is the age of the computer?
c) Which hardware has been replaced?
d) Were there any problems upgrading from 1511 > 1607 or 1607 > 1703?


For all steps please post images into the thread.
If there are any problems posting images please use one drive or drop box share links.


2) Open administrative command prompt and type or copy and paste:
3) sfc /scannow
4) dism /online /cleanup-image /restorehealth
5) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread
6) chkdsk /x /f /r C: (Use the syntax chkdsk /x /f /r D: or chkdsk /x /f /r E: change the drive letter to the applicable drive) (test all drives/partitions)
This may take many hours so plan to run overnight.
7) Use the information in this link to find the chkdsk reports in the event viewer then copy and paste the report and post into the thread with a one drive or drop box share link:
Read Chkdsk Log in Event Viewer in Windows 10 Performance Maintenance Tutorials
8) Open Ccleaner > click windows tab > scroll down to system and advanced > post an image into the thread
9) In the left lower corner search type clean > open disk cleanup > scroll up and down > post images into the thread
10) In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings
> on the advanced tab under startup and recovery click settings > post an image of the startup and recovery into the thread.
> on the advanced tab under performance > click on settings > click on advanced tab > under virtual memory click on change > post an image of the virtual memory tab into the thread
11) In the left lower corner search type services > open windows error reporting service > scroll to the startup type column > right click > left click on properties > post an image into the thread
12) Download and install Whocrashed > in the left upper corner above analyze click on tools > crash dump test > type: ACCEPT
Resplendence Software - WhoCrashed, automatic crash dump analyzer
13) Click analyze > look for dead or deaddead in the results > post the results into the thread
14) Run the log collector after all of the above steps and post a zip into the thread:
log collector v2-beta06.zip
15) Turn off windows fast startup:
Turn On or Off Fast Startup in Windows 10 Performance Maintenance Tutorials
16) Open device manager > click view > show hidden devices > expand all rows > look for triangular yellow icons with black exclamation marks > post images into the thread
17) Open disk management > widen each volume and status columns > view the contents of each row and make sure that nothing is cutoff > post an image into the thread
18) Perform windows updates > post an image into the thread using a one drive or drop box share link
19) Click update history > post an image > post an image into the thread using a one drive or drop box share link
20) Run HDTune: (all drives)
HD Tune website
to check the health, run a benchmark, and scan for errors
When above is done please make screenshots of the following
a) the health (SMART)
b) the Full error scan (surface scan)
c) the benchmark including transfer rate, access time, burst rate, cpu usage
Take Screenshot in Windows 10 General Tips Tutorials
21) Indicate whether there is any encryption software on the computer other than Microsoft software
22) Indicate whether there is/was any AV in use other than windows defender




Code: Standard PS/2 Keyboard ACPI\PNP0303\0 This device is not present, is not working properly, or does not have all its drivers installed.[/quote] Code: Microsoft PS/2 Mouse ACPI\PNP0F03\0 This device is not present, is not working properly, or does not have all its drivers installed.[/quote]

Code: Event[10566]: Log Name: System Source: Microsoft-Windows-StartupRepair Date: 2018-01-09T16:47:56.501 Event ID: 1109 Task: N/A Level: Information Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: JohnMcAllister Description: The boot manager was corrupt.[/quote] Code: Event[9936]: Log Name: System Source: Microsoft-Windows-Kernel-Boot Date: 2018-01-08T17:13:45.702 Event ID: 29 Task: N/A Level: Error Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: JohnMcAllister Description: Windows failed fast startup with error status 0xC00000D4.[/quote] Code: Event[10570]: Log Name: System Source: Microsoft-Windows-ResetEng Date: 2018-01-09T16:48:07.679 Event ID: 4502 Task: N/A Level: Critical Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: JohnMcAllister Description: Attempt to reset the system has failed. Changes to the system have been undone.[/quote] Code: Event[465]: Log Name: System Source: iaStorA Date: 2017-12-15T14:12:22.909 Event ID: 129 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: JohnMcAllister Description: Reset to device, \Device\RaidPort0, was issued.[/quote] Code: Event[492]: Log Name: System Source: Volsnap Date: 2017-12-15T14:13:38.406 Event ID: 30 Task: N/A Level: Warning Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: JohnMcAllister Description: An unfinished create of a shadow copy of volume D: was deleted.[/quote] Code: Event[9955]: Log Name: System Source: Microsoft-Windows-Kernel-Power Date: 2018-01-08T17:13:48.383 Event ID: 41 Task: N/A Level: Critical Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: JohnMcAllister Description: The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.[/quote]

 

Windows PowerShellCopyright (C) 2016 Microsoft Corporation. All rights reserved.PS C:\WINDOWS\system32> sfc/scannowsfc/scannow : The term 'sfc/scannow' is not recognized as the name of a cmdlet, function, script file, or operableprogram. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.At line:1 char:1+ sfc/scannow+ ~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (sfc/scannow:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundExceptionPS C:\WINDOWS\system32> cd..PS C:\WINDOWS> cd..PS C:\> sfc /scannowBeginning system scan. This process will take some time.Beginning verification phase of system scan.Verification 100% complete.Windows Resource Protection did not find any integrity violations.PS C:\> dism /online/cleanup-image/restorehealthDeployment Image Servicing and Management toolVersion: 10.0.15063.0Error: 87The online/cleanup-image/restorehealth option is unknown.For more information, refer to the help by running DISM.exe /?.The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.logPS C:\> dism.exe /?Deployment Image Servicing and Management toolVersion: 10.0.15063.0DISM.exe [dism_options] {Imaging_command} [<Imaging_arguments>]DISM.exe {/Image:<path_to_offline_image> | /Online} [dism_options] {servicing_command} [<servicing_arguments>]DESCRIPTION: DISM enumerates, installs, uninstalls, configures, and updates features and packages in Windows images. The commands that are available depend on the image being serviced and whether the image is offline or running.GENERIC IMAGING COMMANDS: /Split-Image - Splits an existing .wim or .ffu file into multiple read-only split WIM/FFU files. /Apply-Image - Applies an image. /Get-MountedImageInfo - Displays information about mounted WIM and VHD images. /Get-ImageInfo - Displays information about images in a WIM or VHD file. /Commit-Image - Saves changes to a mounted WIM or VHD image. /Unmount-Image - Unmounts a mounted WIM or VHD image. /Mount-Image - Mounts an image from a WIM or VHD file. /Remount-Image - Recovers an orphaned image mount directory. /Cleanup-Mountpoints - Deletes resources associated with corrupted mounted images.WIM COMMANDS: /Apply-CustomDataImage - Dehydrates files contained in the custom data image. /Capture-CustomImage - Captures customizations into a delta WIM file on a WIMBoot system. Captured directories include all subfolders and data. /Get-WIMBootEntry - Displays WIMBoot configuration entries for the specified disk volume. /Update-WIMBootEntry - Updates WIMBoot configuration entry for the specified disk volume. /List-Image - Displays a list of the files and folders in a specified image. /Delete-Image - Deletes the specified volume image from a WIM file that has multiple volume images. /Export-Image - Exports a copy of the specified image to another file. /Append-Image - Adds another image to a WIM file. /Capture-Image - Captures an image of a drive into a new WIM file. Captured directories include all subfolders and data. /Get-MountedWimInfo - Displays information about mounted WIM images. /Get-WimInfo - Displays information about images in a WIM file. /Commit-Wim - Saves changes to a mounted WIM image. /Unmount-Wim - Unmounts a mounted WIM image. /Mount-Wim - Mounts an image from a WIM file. /Remount-Wim - Recovers an orphaned WIM mount directory. /Cleanup-Wim - Deletes resources associated with mounted WIM images that are corrupted.IMAGE SPECIFICATIONS: /Online - Targets the running operating system. /Image - Specifies the path to the root directory of an offline Windows image.DISM OPTIONS: /English - Displays command line output in English. /Format - Specifies the report output format. /WinDir - Specifies the path to the Windows directory. /SysDriveDir - Specifies the path to the system-loader file named BootMgr. /LogPath - Specifies the logfile path. /LogLevel - Specifies the output level shown in the log (1-4). /NoRestart - Suppresses automatic reboots and reboot prompts. /Quiet - Suppresses all output except for error messages. /ScratchDir - Specifies the path to a scratch directory.For more information about these DISM options and their arguments, specify anoption immediately before /?. Examples: DISM.exe /Mount-Wim /? DISM.exe /ScratchDir /? DISM.exe /Image:C:\test\offline /? DISM.exe /Online /?PS C:\> dism.exe /online /cleanup-image /restorehealthDeployment Image Servicing and Management toolVersion: 10.0.15063.0Image Version: 10.0.15063.0[==========================100.0%==========================] The restore operation completed successfully.The operation completed successfully.PS C:\>

 

sorry for all the verbage but I first typed the dism command without the .exe and without spacing the parameters. It did complete successfully. Now on to chkdsk

 

Chkdsk found nothing wrong on the c: drive which is a SSD. I had a problem with the event logger & managed to delete the log but here is a summary.
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> cd..
PS C:\WINDOWS> chkdsk
The type of the file system is NTFS.

WARNING! /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
403456 file records processed.
File verification completed.
5437 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
491252 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
43899 data files processed.
CHKDSK is verifying Usn Journal...
39916936 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

243633335 KB total disk space.
136337128 KB in 201617 files.
128704 KB in 43900 indexes.
0 KB in bad sectors.
519991 KB in use by the system.
65536 KB occupied by the log file.
106647512 KB available on disk.

4096 bytes in each allocation unit.
60908333 total allocation units on disk.
26661878 allocation units available on disk.
PS C:\WINDOWS>

 

Please test all drives using this format:

C:\Windows\system32>chkdsk /x /f /r
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: y
reboot

 

4 logical processors, active mask: 15
RAM: 17051152384 bytes total



Crash Dump Analysis
Crash dumps are enabled on your computer. This system is not configured for complete or automatic crash dumps. For best results, configure your system to write out complete or automatic crash dumps. Select Tools->Crash Dump Configuration from the main menu to configure your system to write out complete memory dumps.

Crash dump directories:
C:\WINDOWS
C:\WINDOWS\Minidump



On Wed 1/10/2018 11:51:19 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\011018-4546-01.dmp
This was probably caused by the following module: rspcrash64.sys (rspCrash64+0x108B)
Bugcheck code: 0xDEADDEAD (0x0, 0x0, 0x19B223AB, 0x3C2A58ED)
Error: MANUALLY_INITIATED_CRASH1
file path: C:\WINDOWS\system32\drivers\rspcrash64.sys
product: WhoCrashed
company: Resplendence Software Projects Sp.
description: Resplendence WhoCrashed Crash Dump Test
Bug check description: This indicates that the user deliberately initiated a crash dump from either the kernel debugger or the keyboard.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.



On Wed 1/10/2018 11:51:19 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: rspcrash64.sys (rspCrash64+0x108B)
Bugcheck code: 0xDEADDEAD (0x0, 0x0, 0x19B223AB, 0x3C2A58ED)
Error: MANUALLY_INITIATED_CRASH1
file path: C:\WINDOWS\system32\drivers\rspcrash64.sys
product: WhoCrashed
company: Resplendence Software Projects Sp.
description: Resplendence WhoCrashed Crash Dump Test
Bug check description: This indicates that the user deliberately initiated a crash dump from either the kernel debugger or the keyboard.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.




Conclusion
2 crash dumps have been found and analyzed. No offending third party drivers have been found. Connsider using WhoCrashed Professional which offers more detailed analysis using symbol resolution. Also configuring your system to produce a full memory dump may help you.


Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

 

i did that with my c: drive and it came back with nothing wrong so I am not going to do that again. I will however run chkdsk on my D drive. I am looking next to send the screen shots via dropbox. Bear with me as I am unfamiliar with that product.

 

Dropbox - Screenshots

This is the link to the dropbox screenshots

 

Here is the drive D: report

Windows PowerShellCopyright (C) 2016 Microsoft Corporation. All rights reserved.PS C:\WINDOWS\system32> chkdsk d: /x /f /rThe type of the file system is NTFS.Stage 1: Examining basic file system structure ... 34304 file records processed.File verification completed. 0 large file records processed. 0 bad file records processed.Stage 2: Examining file name linkage ... 41936 index entries processed.Index verification completed.CHKDSK is scanning unindexed files for reconnect to their original directory.Recovering orphaned file {D2E30~1 (6DA) into directory file C7.Recovering orphaned file {d2e30181-6499-4d6e-8f0a-96bf71e909e2}_OnDiskSnapshotProp (6DA) into directory file C7. 2 unindexed files scanned.Recovering orphaned file METADA~1 (6DC) into directory file C6.Recovering orphaned file metadata-2 (6DC) into directory file C6. 2 unindexed files recovered to original directory. 0 unindexed files recovered to lost and found.Stage 3: Examining security descriptors ...Security descriptor verification completed. 3817 data files processed.CHKDSK is verifying Usn Journal...Usn Journal verification completed.Stage 4: Looking for bad clusters in user file data ... 34288 files processed.File data verification completed.Stage 5: Looking for bad, free clusters ... 38624392 free clusters processed.Free space verification is complete.CHKDSK discovered free space marked as allocated in themaster file table (MFT) bitmap.Windows has made corrections to the file system.No further action is required. 312560608 KB total disk space. 157933688 KB in 30306 files. 19548 KB in 3818 indexes. 0 KB in bad sectors. 109800 KB in use by the system. 65536 KB occupied by the log file. 154497572 KB available on disk. 4096 bytes in each allocation unit. 78140152 total allocation units on disk. 38624393 allocation units available on disk.PS C:\WINDOWS\system32>

 

Hi Zac,
Thiscompletes the set of tasks you set me.

 

1) For Ccleaner:
a) un-check memory dumps
b) un-check Windows log files
2) For system properties > performance > settings > performance options > advanced > virtual memory
a) click on change > post an image into the thread
3) For disk cleanup
a) un-check system created windows error reporting
4) For startup and recovery > system failure
a) un-check automatically restart
b) change write debugging information to automatic memory dump
5) For drive C: please repeat the chkdsk test using the switches /x /f /r
6) Uninstall Malwarebytes
7) View post #29 > please report the answers/progress with each question/step


Chkdsk /x /f /r D: report: Windows has made corrections to the file system.


Code: ffffe382`04abe898 fffff808`7e1e1eb0Unable to load image \SystemRoot\system32\DRIVERS\farflt.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for farflt.sys *** ERROR: Module load completed but symbols could not be loaded for farflt.sys farflt+0x11eb0 ffffe382`04abe8a0 ffff928e`34c19e40 ffffe382`04abe8a8 fffff808`7df0adef NTFS!NtfsInitializeTopLevelIrp+0x3f ffffe382`04abe8b0 ffffbc0c`546a0400 ffffe382`04abe8b8 fffff808`004c004a ffffe382`04abe8c0 fffff808`813848c0Unable to load image \SystemRoot\System32\Drivers\MbamChameleon.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for MbamChameleon.sys *** ERROR: Module load completed but symbols could not be loaded for MbamChameleon.sys MbamChameleon+0x248c0[/quote]

 

Hi Zac,
The update process now reaches 90% before it conks out using the ISO file – previously it aborted at 57%.
I have now rerun the CHKDSK of drive C: and amended the Ccleaner and disk clean as requested.
I have uninstalled Malware Bytes.
I have removed the screen shots from my dropbox and will repopulate with fresh ones.
I am going to run the update once more so I have a fresh set of logfiles
In answer to your original series of questions here is the information.
The 30 crashes were not crashes but restarts.
I had a problem where my Av 500 powerline adaptors were loosing contact with the router and dropping the connection. I discovered that I needed to instigate a script to constantly send a ping to keep them active.
It was when I did this that I found that the scheduler was broken and that I had a serious problem with updates.

1) No crashes just restarts
a) No hang-ups or coloured screens
b) The computer is two years old
c) No hardware replaced
d) Yes there were problems upgrading to 1703 and I got a technician to do this for me
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> cd..
PS C:\WINDOWS> cd..
PS C:\> sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.
PS C:\> dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.15063.0

Image Version: 10.0.15063.0

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.
PS C:\>

Chkdsk was executed in read-only mode on a volume snapshot.

Checking file system on C:
The type of the file system is NTFS.

WARNING! /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...


403456 file records processed. File verification completed.


5437 large file records processed.

0 bad file records processed.
Stage 2: Examining file name linkage ...


491252 index entries processed. Index verification completed.


0 unindexed files scanned.

0 unindexed files recovered to lost and found.
Stage 3: Examining security descriptors ...
Security descriptor verification completed.


43899 data files processed. CHKDSK is verifying Usn Journal...


39916936 USN bytes processed. Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

243633335 KB total disk space.
136337128 KB in 201617 files.
128704 KB in 43900 indexes.
0 KB in bad sectors.
519991 KB in use by the system.
65536 KB occupied by the log file.
106647512 KB available on disk.

4096 bytes in each allocation unit.
60908333 total allocation units on disk.
26661878 allocation units available on disk.



Chkdsk was executed in read/write mode.

Checking file system on D:
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...


34304 file records processed. File verification completed.


0 large file records processed.

0 bad file records processed.
Stage 2: Examining file name linkage ...


41936 index entries processed. Index verification completed.
CHKDSK is scanning unindexed files for reconnect to their original directory.
Recovering orphaned file {D2E30~1 (6DA) into directory file C7.
Recovering orphaned file {d2e30181-6499-4d6e-8f0a-96bf71e909e2}_OnDiskSnapshotProp (6DA) into directory file C7.


2 unindexed files scanned. Recovering orphaned file METADA~1 (6DC) into directory file C6.
Recovering orphaned file metadata-2 (6DC) into directory file C6.
2 unindexed files recovered to original directory.


0 unindexed files recovered to lost and found.
Stage 3: Examining security descriptors ...
Cleaning up 32 unused index entries from index $SII of file 0x9.
Cleaning up 32 unused index entries from index $SDH of file 0x9.
Cleaning up 32 unused security descriptors.
Security descriptor verification completed.


3817 data files processed. CHKDSK is verifying Usn Journal...
Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...


34288 files processed. File data verification completed.

Stage 5: Looking for bad, free clusters ...


38624392 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.

Windows has made corrections to the file system.
No further action is required.

312560608 KB total disk space.
157933688 KB in 30306 files.
19548 KB in 3818 indexes.
0 KB in bad sectors.
109800 KB in use by the system.
65536 KB occupied by the log file.
154497572 KB available on disk.

4096 bytes in each allocation unit.
78140152 total allocation units on disk.
38624393 allocation units available on disk.


The zip file is attached with logs.
The screenshots are in dropbox.
There is no encryption software.
There are no other AV programs other than Windows defender
Here is the link to the screenshots on dropbox
Dropbox - Screenshots

 

Please post another image of Ccleaner > windows tab > system and advanced > one drive or drop box share link

Open disk mangement > widen the columns for volume and status so that the contents of the rows a in full view (nothing cut off) > post an image into the thread

Download minitool partition wizard: MiniTool Partition Wizard Free Edition - Free download and software reviews - CNET Download.com

Open minitool > post an image into the thead

 

Hi Zac,
I have added the screen shots you requested into the same dropbox we have been using.
I am just in from an afternoon gig and have to go out for practise for another gig.
I shall not be back at this PC for several hours.
Take care & keep on rocking - i appreciate your time and effort

 

Not sure what you mean zac?
It's .
Whenever possible please make a new post as it it harder to go back and forth a look for posts than have it fresh in the latest post.