Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 10 Event id 4401


  • Please log in to reply
6 replies to this topic

#1 sibo1

sibo1

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:22 AM

Posted 09 March 2017 - 11:11 AM

I was playing Solitaire on Microsoft when all of a sudden BSOD so I opened event viewer and it gave me the id error. 

Attached File  SysnativeFileCollectionApp.zip   679.37KB   4 downloads

 

 

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          10/03/2017 12:57:07
Event ID:      10016
Task Category: None
Level:         Error
Keywords:      Classic
User:          LOCAL SERVICE
Computer:      Philip-PC
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2017-03-10T12:57:07.535989900Z" />
    <EventRecordID>4224</EventRecordID>
    <Correlation />
    <Execution ProcessID="1168" ThreadID="11440" />
    <Channel>System</Channel>
    <Computer>Philip-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Activation</Data>
    <Data Name="param4">{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}</Data>
    <Data Name="param5">{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}</Data>
    <Data Name="param6">NT AUTHORITY</Data>
    <Data Name="param7">LOCAL SERVICE</Data>
    <Data Name="param8">S-1-5-19</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
    <Data Name="param10">Unavailable</Data>
    <Data Name="param11">Unavailable</Data>
  </EventData>
</Event>

Edited by sibo1, 10 March 2017 - 09:20 AM.


BC AdBot (Login to Remove)

 


#2 Allan

Allan

  • BC Advisor
  • 8,633 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:09:22 PM

Posted 09 March 2017 - 11:18 AM

Are you experiencing a specific problem with your system? If so, please describe it.


Edited by Allan, 09 March 2017 - 11:18 AM.


#3 bwv848

bwv848

    Bleepin' Owl


  • BSOD Kernel Dump Expert
  • 3,028 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:92.96 million miles away from the sun
  • Local time:09:22 PM

Posted 09 March 2017 - 01:05 PM

Event[30]:
  Log Name: Application
  Source: Microsoft-Windows-EFS
  Date: 2017-03-09T14:27:19.063
  Event ID: 4401
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-21-3705874668-827502548-1967366922-1000
  User Name: PHILIP-PC\Philip
  Computer: Philip-PC
  Description:
7.488: EFS service failed to provision a user for EDP. Error code: 0x80070005.
Event[63]:
  Log Name: Application
  Source: Microsoft-Windows-EFS
  Date: 2017-03-09T14:13:48.214
  Event ID: 4401
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-21-3705874668-827502548-1967366922-1000
  User Name: PHILIP-PC\Philip
  Computer: Philip-PC
  Description:
7.488: EFS service failed to provision a user for EDP. Error code: 0x80070005.

I can see what you're talking about in the event log. More information about the error here. Try performing an SFC scan:

:step1: System File Checker
 
• Open Start, and in the Search programs and files box, type cmd.
• Right-click on cmd.exe, select Run as administrator, and accept any User Account Control prompts.
• In the Elevated Command Prompt type:

sfc /SCANNOW

• You will see one of three things:

Windows Resource Protection did not find any integrity violations.

Windows Resource Protection found corrupt files and successfully repaired them. Details are included in the CBS.Log %WinDir%\Logs\CBS\CBS.log.

Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log %WinDir%\Logs\CBS\CBS.log.

If you see the two latter messages, please immediately type the following command:

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

• Attach sfcdetails.txt, which is found on your Desktop, in your next reply.


If I do not reply in three days, please message me.
 
BC BSOD Posting Instructions | Carrona BSOD Index | Driver Reference Table (DRT)


#4 Allan

Allan

  • BC Advisor
  • 8,633 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:09:22 PM

Posted 09 March 2017 - 01:29 PM

I'm not a fan of addressing event log errors unless there is a corresponding problem with the system. So back to my question above :)



#5 sibo1

sibo1
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:22 AM

Posted 10 March 2017 - 09:14 AM

 

Event[30]:
  Log Name: Application
  Source: Microsoft-Windows-EFS
  Date: 2017-03-09T14:27:19.063
  Event ID: 4401
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-21-3705874668-827502548-1967366922-1000
  User Name: PHILIP-PC\Philip
  Computer: Philip-PC
  Description:
7.488: EFS service failed to provision a user for EDP. Error code: 0x80070005.
Event[63]:
  Log Name: Application
  Source: Microsoft-Windows-EFS
  Date: 2017-03-09T14:13:48.214
  Event ID: 4401
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-21-3705874668-827502548-1967366922-1000
  User Name: PHILIP-PC\Philip
  Computer: Philip-PC
  Description:
7.488: EFS service failed to provision a user for EDP. Error code: 0x80070005.

I can see what you're talking about in the event log. More information about the error here. Try performing an SFC scan:

:step1: System File Checker
 
• Open Start, and in the Search programs and files box, type cmd.
• Right-click on cmd.exe, select Run as administrator, and accept any User Account Control prompts.
• In the Elevated Command Prompt type:

sfc /SCANNOW

• You will see one of three things:

Windows Resource Protection did not find any integrity violations.

Windows Resource Protection found corrupt files and successfully repaired them. Details are included in the CBS.Log %WinDir%\Logs\CBS\CBS.log.

Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log %WinDir%\Logs\CBS\CBS.log.

If you see the two latter messages, please immediately type the following command:

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

• Attach sfcdetails.txt, which is found on your Desktop, in your next reply.

 

Windows Resource Protection did not find any integrity violations. is the result. thanks bwv848



#6 sibo1

sibo1
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:22 AM

Posted 10 March 2017 - 01:42 PM

 

 

Event[30]:
  Log Name: Application
  Source: Microsoft-Windows-EFS
  Date: 2017-03-09T14:27:19.063
  Event ID: 4401
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-21-3705874668-827502548-1967366922-1000
  User Name: PHILIP-PC\Philip
  Computer: Philip-PC
  Description:
7.488: EFS service failed to provision a user for EDP. Error code: 0x80070005.
Event[63]:
  Log Name: Application
  Source: Microsoft-Windows-EFS
  Date: 2017-03-09T14:13:48.214
  Event ID: 4401
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-21-3705874668-827502548-1967366922-1000
  User Name: PHILIP-PC\Philip
  Computer: Philip-PC
  Description:
7.488: EFS service failed to provision a user for EDP. Error code: 0x80070005.

I can see what you're talking about in the event log. More information about the error here. Try performing an SFC scan:

:step1: System File Checker
 
• Open Start, and in the Search programs and files box, type cmd.
• Right-click on cmd.exe, select Run as administrator, and accept any User Account Control prompts.
• In the Elevated Command Prompt type:

sfc /SCANNOW

• You will see one of three things:

Windows Resource Protection did not find any integrity violations.

Windows Resource Protection found corrupt files and successfully repaired them. Details are included in the CBS.Log %WinDir%\Logs\CBS\CBS.log.

Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log %WinDir%\Logs\CBS\CBS.log.

If you see the two latter messages, please immediately type the following command:

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

• Attach sfcdetails.txt, which is found on your Desktop, in your next reply.

 

Windows Resource Protection did not find any integrity violations. is the result. thanks bwv848

 

This has just happened in the middle of Microsoft flight Simulator ! help please bwv848

 

Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin

Source:        Microsoft-Windows-Kernel-EventTracing
Date:          10/03/2017 18:37:01
Event ID:      3
Task Category: Session
Level:         Error
Keywords:      Session
User:          SYSTEM
Computer:      Philip-PC
Description:
Session "ReadyBoot" stopped due to the following error: 0xC0000188
Event Xml:
  <System>
    <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
    <EventID>3</EventID>
    <Version>1</Version>
    <Level>2</Level>
    <Task>2</Task>
    <Opcode>14</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2017-03-10T18:37:01.861080500Z" />
    <EventRecordID>40</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="196" />
    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
    <Computer>Philip-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="SessionName">ReadyBoot</Data>
    <Data Name="FileName">C:\WINDOWS\Prefetch\ReadyBoot\ReadyBoot.etl</Data>
    <Data Name="ErrorCode">3221225864</Data>
    <Data Name="LoggingMode">276824064</Data>
    <Data Name="FailureReason">0</Data>
  </EventData>
</Event>


#7 bwv848

bwv848

    Bleepin' Owl


  • BSOD Kernel Dump Expert
  • 3,028 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:92.96 million miles away from the sun
  • Local time:09:22 PM

Posted 10 March 2017 - 10:37 PM

I'm not a fan of addressing event log errors unless there is a corresponding problem with the system. So back to my question above :)

I agree with Allan. Will you please explain why you are so concerned with these Event Log errors? :) They can usually be ignored.


If I do not reply in three days, please message me.
 
BC BSOD Posting Instructions | Carrona BSOD Index | Driver Reference Table (DRT)





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users