KB » Computer » Events

Events


Events

This page only contains events that I have encountered myself, on one of my (virtual) computers at home, or on my computer at work.

In the 1st column, after the source, I indicate in which log I saw the event: 's', 'a', 'c', 'as' or 'm' respectively represent the System log, the Application log, the Security log, both of the first 2 logs, or in 1 of the logs in the category Microsoft. Events with Source Kernel-EventTracing for example you won't find in the System and Application log.

In the 4th column I abbreviated the 4 possible severity statuses Information, Warning, Error and Critical, in order to provide the last column with as much space as possible.

The 5th and 6th column contain an 'x' if I saw the event in that Windows-version, and a '-' if I'm (almost) sure that it will not occur in that version.
In the 6th column I will add an extra 'h', 'v' and/or 'd' ('h' is home, 'd' is domain, and 'v' is virtual computer).
This is because I use Windows 7 at work in a domain, and that produces a lot of events that aren't very interesting to home users. I put the letters in the order 'd', 'h', 'v' and 'x', so when you sort on this column all domain events will at the top or the bottom.
If there's just a 'v' and no 'h' I only encountered the problem on a virtual PC.

The last column contains the description, first the message itself, then (after a blank line) the explanation (if I have one).

You can sort on a column by clicking on its heading. By clicking again you sort in reverse order. By the way, this doesn't work if you have blocked JavaScript.

Source Event ID Task Category
Type

XP

W7
Description
amdkmdag 62464 DVD-OV - x UVD Information
If you have the ATi Catalyst Control Center installed then you may have come accross hundreds if not thousands of event viewer records from “amdkmdag” with a single line of data “UVD Information”.
This is supposedly the graphics driver notifying you that a piece of video has not passed HDCP checks (read: DRM for video).
To disable this and suppress the messages, make the following registry change,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AtierecordeRecordEnable = 0 (DWORD) [ nooblet.org]

The only AMD/ATI device I can find on my PC is a AMD High Definition Audio Device. I have no idea why I have tens of these messages. It happened at a moment I wasn't present myself, while I had left the PC running.
MEIx64 (s) 1 None Warn - dx The Intel(R) Management Engine Interface is being reset.

???
MEIx64 (s) 4 None Warn - dx The Intel(R) Management Engine Interface is being disabled.

???
Disk (s) 11 None Err dhx The driver detected a controller error on \Device\Harddisk1\DR3.

Using the Disk Management console (diskmgmt.msc) you can see which disk corresponds to hardisk0, harddisk1, etc. In my case the error is causes by a thumb drive, and apparently I get a number of these errors when I connect the drive to the PC.
I don't know yet what DR3 means. The number usually increases every time I plug the stick into the PC. I think it start from 1 again after a restart of the PC. The highest value I have ever seen is DR22.
Disk (s) 11 None Err x The driver detected a controller error on \Device\Harddisk5\D.

See Disk, 11, only this disk refers to a card reader slot, with nothing in it. Weird.
After I opened the diskmgmt console to see which disk was numbered 5, and I refreshed the contents of Event Viewer, I have another of these errors. And when I try it again, another. So the error is reproducable now.
After a restart the problem is gone. Just one of these unexplainable things in Windows...
Disk 51 None Warn x hx An error was detected on device \Device\Harddisk8\D during a paging operation.

Until now I encountered this event in the following 2 situations:
Kernel-EventTracing (m) 0 Logging Err - dx Session "NT Kernel Logger" failed to write to log file "C:\Windows\system32\Logfiles\WMI\RtBackup\EtwRTNT Kernel Logger.etl" with the following error: 0xC00000A1

???
Kernel-EventTracing (m) 2 Session Err - dx Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035

Meaning of the error code: STATUS_OBJECT_NAME_COLLISION, i.e. a duplicate domain security identifier (SID) being detected.
Something is trying to start a trace, and at least at first it doesn't work (perhaps because of timing, perhaps because it's already running, ???).
You can check if it's a real problem by opening the perfmon console, and then click Data Collector Sets - Event Trace Sessions
Now you can see if the "Circular Kernel Context Logger" (in this case) is 'Running'. If so, nothing is the matter.
Kernel-EventTracing (m) 2 Session Err - dx Session "NT Kernel Logger" failed to start with the following error: 0xC0000035

See the explanation of Kernel-EventTracing, 2.
Kernel-EventTracing (m) 2 Session Err - dx Session "" failed to start with the following error: 0xC0000017

See the explanation of Kernel-EventTracing, 2, although I don't know yet what this error code means.
Kernel-EventTracing (m) 2 Session Err - dx Session "Communicator" failed to start with the following error: 0xC0000022

Meaning of the error code: The application failed to initialize properly
Instead of "Communicator" this error also occurred with "NT Kernel Logger" once.
Further see the explanation of Kernel-EventTracing, 2.
Kernel-EventTracing (m) 3 Session Err - dx Session "NT Kernel Logger" stopped due to the following error: 0xC0000001

???
Schannel (s) 36887 None Err dx The following fatal alert was received: 47.

Other error codes are on my page about networking.
Schannel is the TLS / SSL Security Provider, according to eventid.net. TLS is an acronym for Transport Layer Security and SSL for Secure Socket Layer. This has to do with encrypted connections, certificates, etc.
According to the same site the meaning of error code 47 is TLS1_ALERT_ILLEGAL_PARAMETER
I suspect you will mainly encounter these kinds of errors in a company network.
As a general comment from a Microsoft engineer: This error message indicates the computer received an SSL fatal alert message from the server (it is not a bug in the Schannel or the application that uses Schannel). Sometimes is caused by the installation of third party web browser (other than Internet Explorer).
Schannel (s) 36882 None Err dx The certificate received from the remote server was issued by an untrusted certificate authority. Because of this, none of the data contained in the certificate can be validated. The SSL connection request has failed. The attached data contains the server certificate.

See Schannel, 36887 for more info.
Schannel (s) 36888 None Err vx De volgende melding van een onherstelbare fout is gegenereerd: error_code. De interne foutstatus is error_code2.
(The following fatal alert was generated: error_code. The internal error state is error_code2.)

See Schannel, 36887 for more info.
Schannel (s) 36888 None Err vx De volgende melding van een onherstelbare fout is gegenereerd: 10. De interne foutstatus is 10.
(The following fatal alert was generated: 10. The internal error state is 10.)

See Schannel, 36887 for more info.
Schannel (s) 36888 None Err dx (The following fatal alert was generated: 48. The internal error state is 552.)

See Schannel, 36887 for more info.
W32Time (s) 17 None Err x - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

The service W32Time (Windows Time) is trying to use the Network Time Protocol to retrieve the correct time from the Internet (as Microsoft puts it: Maintains date and time synchronization on all clients and servers in the network.) For this however, you need a computer on the Internet (a time server), and if not available or wrongly configured in the registry, then you get this error.
Usually the problem disappears after a few attempts. Only if it keeps coming back (every 15 minutes) I would have a look at it. At eventid.net several possible solutions are described.
W32Time (s) 29 None Err x - The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.)

This error often accompanies W32Time, 17. See the description for that event.
W32Time (s) 36 None Warn x - The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized.

I can see that the system clock can't be synchronized, since the real time is 13:54, and the time on the PC is 13:38. I don't know if the cause is the same as that of W32Time, 17.
MRxSMB (s) 8003 None Err x - The master browser has received a server announcement from the computer PENNE that believes that it is the master browser for the domain on transport NetBT_Tcpip_{33F622E2-8129-493D-82E. The master browser is stopping or an election is being forced.

Although the type of this event is Error, the message is not something to worry about. The consequence can be that computers in your local network can't connect to each other for some minutes.
On your local network always 1 computer has the role of "master browser". Apparently this computer was the master browser, but now another computer (with the name PENNE) also thinks it's the master browser. Usually they solve this problem in a friendly discussion :-).
In Windows 7 this is the bowser, 8003 event. I suspect they forgot the 'r' (in browser).
bowser (s) 8003 None Err - x The master browser has received a server announcement from the computer PENNE that believes that it is the master browser for the domain on transport NetBT_Tcpip_{9EB39088-2A5D-47D7-B9F4-78C1A6171E8A}. The master browser is stopping or an election is being forced.

See the description of an identical event in Windows XP (but in that case the component is MRxSMB).
crypt32 (a) 11 None Err x - Failed extract of third-party root list from auto update cab at: with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

In my case the messages always occurred at the same time as these ones. Apparently the system time was not correct, and then the required certficates can't be updated anymore (or something like that).
Application Popup (s) 26 None Info x Application popup: program_name - short_description : long_description

When you get a popup-window from a program, because there is some kind of problem, an event like this will also be logged.
Application Popup (s) 26 None Info x Application popup: Skype.exe - Entry Point Not Found : The procedure entry point NtAlpcSendWaitReceivePort could not be located in the dynamic link library ntdll.dll.

See Application Popup, 26 for the general description.
I got the above message when I started Skype. Here the solution of this problem. There was a conflict with the program that is used to manage Samsung smartphones.
Application Popup (s) 26 None Info x Application popup: Windows - Delayed Write Failed : Windows was unable to save all the data for the file D:\$Mft. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

See Application Popup, 26 for the general description.
Application Popup (s) 26 None Info x Application popup: Low Battery : You should change your battery or switch to outlet power immediately to keep from losing your work.

See Application Popup, 26 for the general description.
This notification is typical for a laptop/netbook.
Application Popup (s) 26 None Info x Application popup: chkdsk.exe - Device Timeout : The specified I/O operation on \Device\Harddisk1\DR6 was not completed before the time-out period expired.

See Application Popup, 26 for the general description.
Application Popup (s) 26 None Err x \??\C:\Windows\SysWow64\Drivers\REGSYS.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

See Application Popup, 26 for the general description.
I think I started 1 of the Sysinternals programs (regmon) on a 64-bit system.
Application Popup (s) 26 None Info x (Application popup: : \??\E:\Tools DVD\Tools\System internals\Filemon\FILEM701.SYS failed to load

See Application Popup, 26 for the general description.
I started 1 of the Sysinternals programs (filemon) on a 64-bit system (just don't get why the type of this one is Info, and the type of this one Error).
Application Popup (s) 26 None Info x Application popup: concentr.exe - System Error : The program can't start because api-ms-win-downlevel-ole32-l1-1-0.dll is missing from your computer. Try reinstalling the program to fix this problem.

See Application Popup, 26 for the general description.
I got a lot of these messages when I installed a pre-release of Internet Explorer 10 on a system which already was quite sick as far as Internet Explorer was concerned. I repaired this additional problem by restoring a restore point.
Application Popup (s) 26 None Info x Application popup: LaunchU3.exe - Application Error : The application was unable to start correctly (0xc000000e). Click OK to close the application.

See Application Popup, 26 for the general description.
I think I put a U3 USB drive (a special kind of USB stick) in a 64-bit Windows 7 Ultimate PC.
Application Popup (s) 26 None Info x Application popup: Application: DBASEWIN : The Win 16 Subsystem has insufficent resources to continue running. Click on OK, close your applications, and restart your machine.

See Application Popup, 26 for the general description.
Very old 16 bit programs, like this DBase 5.5, share a part of memory, and have to decide among themselves who gets which part. As far as I know this is the only 16 bit program I run, but I noticed that this problem can also be the cause.
Application Popup (s) 26 None Info x Application popup: Visual Studio Just-In-Time Debugger : An unhandled win32 exception occurred in procexp.exe [5784]. Just-In-Time debugging this exception failed with the following error: No installed debugger has Just-In-Time debugging enabled. In Visual Studio, Just-In-Time debugging can be enabled from Tools/Options/Debugging/Just-In-Time.

See Application Popup, 26 for the general description.
Process Explorer crashte toen ik wilde bekijken waarom Windows Media Player zoveel CPU-capaciteit gebruikte.
The cause of this specific case is still unknown, but I have been able to solve a similar case for another program.
Application Popup (s) 877 None Err x There was error [DATABASE OPEN FAILED] processing the driver database.

Probably this problem could only occur in Windows XP SP1 (by now everybody should be using SP3). See article 824704.
LMS (a) 1 None Warn - dx LMS lost connection to Intel(R) MEI driver

LMS is a service, the Intel(R) Management and Security Application Local Management Service (Local Manageability Service according to Process Explorer).
The advice I've seen most (but not tried) to solve this problem is to deinstall the Intel Management Engine Interface and then reinstall the newest version.
SideBySide (a) 63 None Error x Activation context generation failed for "d:\Portable\Files\Managers\freecommanderportable\App\freecommander\DelZip179. dll".Error in manifest or policy file "d:\Portable\Files\Managers\ freecommanderportable\App\freecommander\DelZip179.dll" on line 8. The value "*" of attribute "language" in element "assemblyIdentity" is invalid.

Apparently SideBySide is just the messenger of a problem with another program, i.e. the one that is mentioned under Description. In this case it is FreeCommander, a file manager.
Side-by-side technology is a standard in Windows XP and higher, that tries to avoid problems with DLL-files (DLL hell :-) ). This technology is also called WinSxS or just Sxs.
See my page about event tracing about solving these kinds of problems.
SideBySide (a) 35 None Err dx Activation context generation failed for "C:\Program Files (x86)\Citrix\ICA Client\MFC80.DLL". Error in manifest or policy file "C:\Program Files (x86)\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST" on line 5. Component identity found in manifest does not match the identity of the component requested. Reference is Microsoft.VC80.MFCLOC,processorArchitecture="x86", publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0". Definition is Microsoft.VC80.MFCLOC,processorArchitecture="x86", publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Please use sxstrace.exe for detailed diagnosis.

See event SideBySide, 63.
In Windows XP the event is in the category Application.
SideBySide (a) 33 None Err dx Activation context generation failed for "C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\bin\ia64\pgocvt.exe". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="ia64", publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found. Please use sxstrace.exe for detailed diagnosis.

See event SideBySide, 63.
Disk (s) 57 Disk Warn x The system failed to flush data to the transaction log. Corruption may occur.

I got this message when I removed a USB thumb drive while officially I wasn't allowed to yet. Since I could find no program that was using the stick, I didn't get what had to be flushed.

The message also appeared in a much more bizar situation. A USB stick that was connected to the computer via an external Sweex hub, was re-recognized spontaneously. And at the same time I got this warning.
Tcpip (s) 4226 None Warn x TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Apparently the number of "internet connections" is reduced to about 10 in Windows XP SP2 (and so probably in SP3 and in Vista Home Premium too). Some programs could be negatively influenced by that. This is a good place to find out how to fix this problem, if it occurs regularly.
Tcpip (s) 4119 None Err hx The system detected an address conflict for IP address 192.168.1.2 with the system having network hardware address 00-03-FF-CD-4B-F1. Network operations on this system may be disrupted as a result.

As the message says: 2 computers with the same IP address. That will definitely cause problems. And it's the risk you take if you assign IP addresses yourself, instead of having it done automatically.
iaStor (s) 9 None Err - dx The device, \Device\Ide\iaStor0, did not respond within the timeout period.

???
ntfs (s) 50 None Warn x {Delayed Write Failed} Windows was unable to save all the data for the file. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

Probably similar to Disk, 57. I pulled a USB stick from the PC while it wasn't ready yet.
ntfs (s) 55 Disk Error x The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume J:.

This is a partition on 1 of my 2 physical disks. The PC had just returned from a repair in the shop, and I don't know if the disk was slightly "shaken" because of it. I had to start the PC several times, and at least 3 times chkdsk was run automatically. Later I found these errors in the event log, but when I ran chkdsk again there were no problems anymore. The output of the first 2 runs showed some minor problems.
atapi (s) 9 None Err x The device, \Device\Ide\IdePort1, did not respond within the timeout period.

An attempt to read or write resulted in a time-out. Within an hour I had about 10 of these messages on an XP PC. No doubt there is a relation with 1 atapi, 11 error I had in between. That one indicates a problem with the disk controller. In the end it appeared to be a quite important message (disk was running in PIO mode).
atapi (s) 11 None Err x The driver detected a controller error on \Device\Ide\IdePort1.

See the description of event atapi, 9.
Service Control Manager (s) 7026 None Err x The following boot-start or system-start driver(s) failed to load: i8042prt

This problem has something to do with USB keyboards or mice, but strangely enough it just occurs very seldom. At first I thought it had to do with my KVM-switch, and that I switched to another PC during the starting phase. But now I booted again, as normal as possible, and the problem re-appeared.
Service Control Manager (s) 7036 None Info x dhx The service-name service entered the stopped state.

If a service "spontaneously" stops in a running system, then it may be useful to investigate a little (although this is just a message of type Information), See this example.
Service Control Manager (s) 7036 None Info x dx The Multimedia Class Scheduler service entered the stopped state.

See here for a description of this situation.
Service Control Manager (s) 7026 None Err x x The following boot-start or system-start driver(s) failed to load: driver_name

It means that in a quite early stage of the boot process a driver could not be loaded. If the driver is i8042prt, you usually don't have to worry. But generally it is wise to investige these cases.
Here is an example.
Service Control Manager (s) 7040 None Info dx The start type of the service_name service was changed from auto start to demand start.

The start type of the service was changed from automatic to manual. If you didn't do this yourself, it seems worth the trouble to try to find the cause.
Service Control Manager (s) 7040 None Info dx The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start.

The BITS service is important for Windows Update.
Service Control Manager (s) 7000 None Err hx The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not start due to a logon failure.

Occurs together with event 7038.
Service Control Manager (s) 7000 None Err dx The HP Software Framework Service service failed to start due to the following error:
The system cannot find the file specified.

Unfortunately the name of the 'specified' isn't mentioned anywhere.
Service Control Manager (s) 7000 None Err dx The AtiDCM service failed to start due to the following error:
The system cannot find the path specified.

Unfortunately the name of the 'specified' isn't mentioned anywhere.
Service Control Manager (s) 7023 None Err x The service-name service terminated with the following error:
error-description

1 of the Windows services has stopped because of error-description.
Service Control Manager (s) 7023 None Err x The Application Management Service terminated with the following error: The specified module could not be found.

See the general description of this event.
This is a known problem in Windows XP. This service does not exist in Windows XP, but because of a wrong value in the registry it will still be called in some circumstances. There is a fix available for this problem.
Service Control Manager (s) 7023 None Err dx The Windows Time service terminated with the following error:
An attempt was made to logon, but the network logon service was not started.

See the general description of this event.
On eventid.net somebody suggests
- Service: Windows Time - I had to reset the security descriptors on the Netlogon and Windows Time services using sc: 1. sc sdset w32time D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCLCSWRPLO;;;BU) S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) 2. sc sdset Netlogon D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY) S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD).
But I have no idea what that means.
Service Control Manager (s) 7023 None Err dx The Windows Update service terminated with the following error:
%%-2145124287

See the general description of this event.
???
Service Control Manager (s) 7022 None Err dx The hpHotkeyMonitor service hung on starting.

No idea why it hung, or how you could find out.
Service Control Manager (s) 7009 None Err hx A timeout was reached (30000 milliseconds) while waiting for the service_name service to connect.

Probably a netwerk problem.
Service Control Manager (s) 7009 None Err hx A timeout was reached (30000 milliseconds) while waiting for the Cisco AnyConnect Secure Mobility Agent service to connect.

Is related to the Virtual Private Network connection to my work.
Service Control Manager (s) 7038 None Err hx The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error: Logon failure: the specified account password has expired.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Occurs together with event 7000.
Service Control Manager (s) 7011 None Err hx A timeout (30000 milliseconds) was reached while waiting for a transaction response from the service_name service.

???
Service Control Manager (s) 7011 None Err hx A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanServer service.

???
Service Control Manager (s) 7031 None Err hx The service-name service terminated unexpectedly. It has done this number time(s). The following corrective action will be taken in number milliseconds: action.

action can be 'Restart the service', 'Reboot the machine', etc.
Service Control Manager (s) 7031 None Err hx The Power service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

???
Service Control Manager (s) 7031 None Err dx The SMS Agent Host service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.

???
Service Control Manager (s) 7034 None Err x dhx (The service-name service terminated unexpectedly. It has done this x time(s).)

The general form of an SCM event with id 7034. Below are a few examples.
I don't know of a strategy to find out the reason for the stop. When you stop a service yourself, you get this event too.
Service Control Manager (s) 7034 None Err hx The F-Secure Management Agent service terminated unexpectedly. It has done this 2 time(s).

The virusscanner couldn't take it anymore. Reason???
Service Control Manager (s) 7039 None War dx A service process other than the one launched by the Service Control Manager connected when starting the HP Software Framework Service service. The Service Control Manager launched process 4200 and process 3784 connected instead.

Note that if this service is configured to start under a debugger, this behavior is expected.

???
Browser (s) 8033 None Info x hx The browser has forced an election on network \Device\NetBT_Tcpip_{33F622E2-8129-493D-82E2-E7CA2B4FED7A} because a master browser was stopped.

In every workgroup one computer is the master browser. In certain situations (e.g. when you turn off the computer that is the master browser) a new one has to be elected.
In this case there was just 1 computer in the subnet, and I changed it's IP address.
Tcpip (s) 2042 None Info x The system detected that network adapter \DEVICE\TCPIP_{33F622E2-8129-493D-82E2-E7CA2B4FED7A} was disconnected from the network, and the adapter's network configuration has been released. If the network adapter was not disconnected, this may indicate that it has malfunctioned. Please contact your vendor for updated drivers.)

The network adapter in your PC has lost its connection to the network (as if the cable between the PC and the router/switch was cut). But a too long telephone line can also cause this problem.
nm (s) 9005 None Err x The description for Event ID ( 9005 ) in Source ( nm ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the / AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: ; Netm\DEVICE\{FF8134C3-0BD2-4CC2-BD3E-6B3E897E7897}; .

Het enige dat ik op Internet kon vinden was dit: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
Dat zou kunnen kloppen. Er is een maximum aan het aantal openstaande netwerkverbindingen, en ik was rond de tijd wel eens bezig met scanners.
Browser (s) 8021 None Warn x The browser was unable to retrieve a list of servers from the browser master \\SPEAR on the network \Device\NetBT_Tcpip_{33F622E2-8129-493D-82E2-E7CA2B4FED7A}. The data is the error code.

The master browser keeps track of the computers in your local network. SPEAR was 1 of the 2 computers on the network that I restarted (possibly with a different version of Windows), and the event occurred on the other one. In this case you would expect an "election" for a new browser master, (see event 8003), but I can't find it anywhere.
Browser (s) 8021 None Warn hx The browser service was unable to retrieve a list of servers from the browser master \\LONDON on the network \Device\NetBT_Tcpip_{9EB39088-2A5D-47D7-B9F4-78C1A6171E8A}.

Browser master: \\LONDON Network: \Device\NetBT_Tcpip_{9EB39088-2A5D-47D7-B9F4-78C1A6171E8A}

This event may be caused by a temporary loss of network connectivity. If this message appears again, verify that the server is still connected to the network. The return code is in the Data text box.

???
BROWSER (s) 8032 None Err hx The browser service has failed to retrieve the backup list too many times on transport NetBT_Tcpip_{9EB39088-2A5D-47D7-B9F4-78C1A6171E8A}. The backup browser is stopping.

???
Userenv (a) 1517 None Warn x - Windows saved user PIZZA\Henk registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.
This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

???
Userenv (a) 1524 None Warn x - Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.

When the PC or a logged in user wants to shut down, all changes to the registry of that user have to saved. So it's important that no program of that user is still using the registry. Windows signals all programs that they have to stop, but not all of them obey. So the registry cannot be saved, and shutting down cannot continue.
PlugPlayManager (s) 263 None Warn x The service "Apple Mobile Device" may not have unregistered for device event notifications before it was stopped.

I installed iTunes and then restarted the system. I needed the program just to test something, and I don't use anything other from Apple. So I disabled this service.

Microsoft's explanation:
A service that was registered with Plug and Play Manager to be informed of device events was stopped without unregistering. The service was stopped incorrectly or it is functioning improperly.
Symbolic name of the error: WRN_STOPPED_SERVICE_REGISTERED
Print (s) 54 None Err x - Document Settings for WLAN Security was corrupted and has been deleted. The associated driver is: HP DeskJet 510.

There was a document (named Settings for WLAN Security) in the print queue when I restarted the PC.
This event occurred after another restart, but it can be explained. According to this Microsoft article:
The print job caused the print spooler to stop more than once, so the print spooler deleted the job and will not try to print it again.
Take note of the 'more than once'.
The symbolic name for the message is MSG_BAD_JOB
Winlogon 6004 None Warn x The winlogon notification subscriber failed a critical notification event.

???
Winlogon (a) 1001 None Info x Checking file system on drive
The type of the file system is filesystem-type
Volume label is volume-label

One of your disks needs to be checked for consistency.
You may cancel the disk check, but it is strongly recommended that you continue.
Windows will now check the disk.
...
Corrections-Data

Windows has made corrections to the file system.

You can see here the results of the program chkdsk.
Winlogon (a) 1001 None Info x

See the general description of this kind of events.
DCOM (s) 10010 None Err - dx The server {D085A4AB-CAB1-4729-9DF8-FCEEDDBD19E4} did not register with DCOM within the required timeout.

Happened surrounding a (failed?) attempt to restart the PC. Was preceded by USER32, 1073 and followed by User Profile Service, 1530.
The GUID in this case belongs to the Citrix client (in a similar case {0006F020-0000-0000-C000-000000000046} belonged to Outlook 2013).
DCOM (s) 10005 None Err x dx DCOM got error "error_message" attempting to start the service service_name with arguments "parameters" in order to run the server: GUID

This is the general form of this error message. If you look up the GUID you may find more information about the software components that are involved in the problem.
DCOM (s) 10005 None Err x - DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

I was starting a search from a file manager, but under water the built-in Windows search mechanism was started. Since I disabled the service Windows search (Wsearch) it's logical the file manager got a little upset. If you look up the GUID, you will see that it belongs to Windows Search Manager.
DCOM (s) 10005 None Err x - DCOM got error "The service database is locked. " attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

This error occurred after restarting an XP PC. netman is the Network Connections service. I have no idea what caused it.
DistributedCOM (s) 10005 None Err - dx DCOM got error "2" attempting to start the service hpqwmiex with arguments "" in order to run the server: {F5539356-2F02-40D4-999E-FA61F45FE12E}

???
USER32 (s) 1073 None Warn x The attempt by user SPEAR\Henk to restart/shutdown computer SPEAR failed

See Microsoft article 2627489). You will get this event if you shut down the PC, and you click Cancel when asked to close certain programs or save certain items.

See event DCOM, 10010 too, because it occurred almost simultaneously.
USER32 (s) 1074 None Info dx The process C:\Windows\system32\winlogon.exe (NL5CB20300B3) has initiated the restart of computer NL5CB20300B3 on behalf of user domain_name\user_name for the following reason: No title for this reason could be found)
Reason Code: 0x500ff
Shutdown Type: restart
Comment:

I have a lot of these kind of events, and they all seem to have something to do with a restart of the PC, normal or abnormal. So after a crash you can possibly find useful error codes here.
USER32 (s) 1074 None Info dx The process Explorer.EXE has initiated the restart of computer NL5CB20300B3 on behalf of user domain_name\user_name for the following reason: Other (Unplanned)
Reason Code: 0x0
Shutdown Type: restart
Comment:

See event USER32, 1074.
USER32 (s) 1074 None Info dx The process C:\windows\System32\sysprep\sysprep.exe (NL5CB2162TQC) has initiated the shutdown of computer NL5CB2162TQC on behalf of user NL5CB2162TQC\Administrator for the following reason: No title for this reason could be found
Reason Code: 0x40002
Shutdown Type: shutdown
Comment:

See event USER32, 1074.
USER32 (s) 1074 None Info dx The process C:\Windows\system32\svchost.exe (NL5CB20300B3) has initiated the restart of computer NL5CB20300B3 on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Recovery (Planned)
Reason Code: 0x80020002
Shutdown Type: restart
Comment:

See event USER32, 1074.
USER32 (s) 1074 None Info dx The process Explorer.EXE has initiated the power off of computer NL5CB20300B3 on behalf of user domain_name\user_name for the following reason: Other (Unplanned)
Reason Code: 0x0
Shutdown Type: power off
Comment:

See event USER32, 1074.
USER32 (s) 1074 None Info dx The process C:\Windows\System32\shutdown.exe (NL5CB20300B3) has initiated the restart of computer NL5CB20300B3 on behalf of user NL5CB20300B3\Administrator for the following reason: No title for this reason could be found
Reason Code: 0x20003
Shutdown Type: restart
Comment:

See event USER32, 1074.
USER32 (s) 1074 None Info dx The process C:\Windows\system32\wbem\wmiprvse.exe (NL5CB20300B3) has initiated the restart of computer NL5CB20300B3 on behalf of user NL5CB20300B3\Administrator for the following reason: No title for this reason could be found
Reason Code: 0x80070015
Shutdown Type: restart
Comment:

See event USER32, 1074.
User Profile Service (a) 1530 None Warn - dx Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

Windows wants to close a user profile, but apparently some program is still using a so-called registry handle to that profile. In the details should be information about the guilty program.
See also event DCOM, 10010 which occurred at the same time.
DistributedCOM (s) 10016 None Err - dx The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {1CCB96F4-B8AD-4B43-9688-B273F58E0910} and APPID {AD65A69D-3831-40D7-9629-9B0B50A93843} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

After searching in the registry the second GUID (the code between '{' and '}') represents SMS Quarantine Configuration Compliance Agent (SMS = Server Management System, and is typically used in a company).
Winlogon (a) 6005 None Warn dx The winlogon notification subscriber is taking long time to handle the notification event (Logoff).

The PC hung in the 'Logging off'-screen. What happened next, you can see in event Kernel-Power, 41.
Winlogon (a) 6000 None Info dx The winlogon notification subscriber was unavailable to handle a notification event.

???
Kernel-Power (s) 41 (63) Crit - dhvx The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

That seems to be quite correct. The PC got stuck in the 'Logging off'-screen, and after about 5 minutes my patience had reached the limit, and I pressed the on-off button for 5 seconds, forcing the PC to shut down.
Eventlog (c) 1101 Event processing Err dvx Audit events have been dropped by the transport. 0

This was caused by me forcing the PC to shut down by pressing the on-off button.
Eventlog (s) 104 Log clear Info dx The System log file was cleared.

???
eventlog (s) 6011 None Info dx The NetBIOS name and DNS host name of this machine have been changed from WIN-MA54SKTU457 to NL5CB20300B3.

Apparently the name of the computer was changed by the company.
EventSystem (a) 4356 Firing Agent Warn dx The COM+ Event System failed to create an instance of the subscriber {1CCB96F4-B8AD-4B43-9688-B273F58E0910}. StandardCreateInstance returned HRESULT 80070005.

???
NetBT (s) 4319 Geen Err x A duplicate name has been detected on the TCP network. The IP address of the machine that sent the message is in the data.
Use nbtstat -n in a command window to check which name is in the conflict state.

???
NetBT (s) 4307 Geen Err x Initialization failed because the transport refused to open initial Addresses.

???
NetBT (s) 4321 Geen Err vx (The name "DOMAIN NAME :1d" could not be registered on the Interface with IP address 192.168.178.80.
The machine with the IP address 192.168.178.80 did not allow the name to be claimed by this machine.)

The .80 IP address was the address of the Windows 7 Ultimate computer on which I ran a virtual Windows 7 Home Premium. Apparently names that end in 1D (like that of the virtual PC) belong to Master Browsers, and possibly the virtual PC tried to become Master Browser (which isn't allowed for virtual PC's).
Dhcp (s) 1001 Geen Err x Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address MAC-address. The following error occured:
error-description. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

???
Dhcp (s) 1000 Geen Err x Your computer has lost the lease to its IP address IP-address on the Network Card with network address MAC-address.

???
Windows Update Agent (s) 20 Installatie Err x Installation Failure: Windows failed to install the following update with error error-code: update.

Windows Update could not apply a certain update, and indicates which update causes the problem, and an error code. Error codes you can find using my page about troubleshooting.
Windows Update Agent (s) 20 Installatie Err x Installation Failure: Windows failed to install the following update with error 0x80070643: KB928416.

See here for a general description of these kinds of errors.
If you use the troubleshooting page which is mentioned there, you get the following result for this particular error code: ERROR_INSTALL_FAILURE. In this case not very helpful.
Windows Update Agent (s) 20 Installatie Err x Installation Failure: Windows failed to install the following update with error 0x80070002: nVidia - Other hardware - NVIDIA GeForce 7300 GS.

See here for a general description of these kinds of errors.
The error code produces the following result:
"ERROR_FILE_NOT_FOUND", "The system cannot find the file specified."
It's unclear whether a file is missing at my system or at the Windows Update system.
Application Hang (a) 1002 (101) Err x Hanging application application.exe, version version, hang module hungapp, version 0.0.0.0, hang address hex-address.

De algemene melding voor een programma waarvan Windows de indruk heeft dat het niet meer reageert.
Het schijnt dat je in Vista en hoger in het Configuratiescherm kan kijken, in Problems and Solutions, of in (W7) Action Center (32-bit), om te zien of er meer informatie gelogged is.
Application Hang (a) 1002 (101) Err x Hanging application sm2004.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

See here for the general form of this event.
sm2004.exe is a training program. But the remaining information isn't very valuable.
.NET Runtime Optimization Service (a) 1103 None Err x .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown

???
.NET Runtime Optimization Service (a) 1101 None Err x .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80070005

???
Microsoft Management Console (a) 1000 None Err x The description for Event ID ( 1000 ) in Source ( Microsoft Management Console ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: mmc.exe 5.2.3790.3959 kernel32.dll 5.2.3790.4062 000000000000dd10.

There can be all kinds of causes, but I just got this event once. The file els.dll seems to belong to 1 of the tools on www.nirsoft.net
Time-Service (s) 34 None Err vx The time service has detected that the system time needs to be changed by 968846 seconds. The time service will not change the system time by more than 54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->65.55.21.20:123) is working properly.

The problem likely was caused by setting a wrong type of network adapter in a virtual machine, so communication with the network was impossible. The virtual PC therefore also couldn't find a time server on the Internet.
Time-Service (s) 36 None Warn vx The time service has not synchronized the system time for 86400 seconds because none of the time service providers provided a usable time stamp. The time service will not update the local system time until it is able to synchronize with a time source. If the local system is configured to act as a time server for clients, it will stop advertising as a time source to clients. The time service will continue to retry and sync time with its time sources. Check system event log for other W32time events for more details. Run 'w32tm /resync' to force an instant time synchronization.

See the solution for event Time-Service, 34.
Time-Service (s) 129 None Warn dx NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 3145779 minutes and double the reattempt interval thereafter. The error was: The entry is not found. (0x800706E1)

This event was sandwiched between 2 Time-Service, 131 events. The meaning of the error code is: RPC_S_ENTRY_NOT_FOUND (RPC is an acronym for Remote Procedure Call).
Time-Service (s) 131 None Warn dx NtpClient was unable to set a domain peer to use as a time source because of DNS resolution error on ''. NtpClient will try again in 3473457 minutes and double the reattempt interval thereafter. The error was: The requested name is valid, but no data of the requested type was found. (0x80072AFC).

This event occurred when I temporarily killed my connection to the network.
I also got it twice shortly after I pulled the network cable from the PC, and 5 hours later (still disconnected) I got 2 other ones (in a domain situtation, but I'm not sure that has anything to do with it).
Time-Service (s) 134 None Warn vx NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on ''. NtpClient will try again in 3473457 minutes and double the reattempt interval thereafter. The error was: De aangevraagde naam is geldig, maar er zijn geen gegevens van het aangevraagde type gevonden. (0x80072AFC)

See the solution for event Time-Service, 34.
Tcpip (s) 4199 None Err vx The system detected an address conflict for IP address 192.168.1.89 with the system having network hardware address 00-03-FF-FF-FF-FF. Network operations on this system may be disrupted as a result.

See the solution for event Time-Service, 34.
Tcpip (s) 4228 None Warn vx TCP/IP has chosen to restrict the scale factor due to a network condition. This could be related to a problem in a network device and will cause degraded throughput.

See the solution for event Time-Service, 34.
DNS Client Events (s) 1014 None Warn vx Name resolution for the name time.windows.com timed out after none of the configured DNS servers responded.

See the solution for event Time-Service, 34. In addition, no communication with the DNS server) was possible.
DNS Client Events (s) 1006 None Warn vx The client was unable to validate the following as active DNS server(s) that can service this client. The server(s) may be temporarily unavailable, or may be incorrectly configured. 192.168.1.1

See the solution for event Time-Service, 34. In addition, no communication with the DNS server) was possible. (I indeed set the IP address of the DNS server to 192.168.1.1, but that didn't fit the IP address of the virtual PC.)
.NET Runtime Optimization Service (a) 1111 None Err x .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x80029c4a.

The meaning of the error code is: TYPE_E_CANTLOADLIBRARY
.NET Runtime Optimization Service (a) 1130 None Warn dx .NET Runtime Optimization Service (2.0.50727.5466) - Version or flavor did not match with repository: Microsoft.GroupPolicy.Reporting

It can help to look in the Windows logs.
.NET Runtime (a) 1021 None Warn x .NET Runtime version 2.0.50727.3643 - Executable "D:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe" AppDomain "DefaultDomain" deleted obsolete native image "D:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\3add69b075f3da012fb97ce00cd795c0\mscorlib.ni.dll"

???
ESENT (a) 455 None Err x Catalog Database (1992) Error -1811 (0xfffff8ed) occurred while opening logfile D:\WINDOWS\system32\CatRoot2\edb.log.

I haven't been able to find an explanation of the error code(s) somewhere.
MsiInstaller (a) 11500 None Err x Product: Python 2.7.3 -- Error 1500. Another installation is in progress. You must complete that installation before continuing this one.

I suspect you can reproduce this problem by installing a .MSI program, and starting an install of another .MSI program before the first one has finished. In this case I tried to install the programming language Python, but I can't remember what other install was running.
MsiInstaller (a) 10005 None Err dx Product: Java(TM) 6 Update 39 -- Error 25099. Unzipping core files failed.

???
MsiInstaller (a) 10005 None Err dx Product: Java(TM) 6 Update 39 -- Internal Error 2753. regutils.dll

???
MsiInstaller (a) 1015 None Warn x Failed to connect to server. Error: 0x800401F0

I don't remember exactly which program was involved here, but sometimes I don't want a program to connect to the Internet during the installation process. So possibly I let firewall ZoneAlarm block this program.
The meaning of the error code: "CO_E_NOTINITIALIZED", "CoInitialize has not been called."
Server (s) 2510 None Warn x The server service was unable to map error code 998.

This event occurred when starting the PC. The code could mean Invalid access to memory location. (you can see this via the command line command
net helpmsg 998),
but it's not certain that it's the same error code. And even if it is, it doesn't give you much of a clue.
cdrom (s) 51 None Warn x An error was detected on device \Device\CdRom0 during a paging operation.

This event is comparable to event Disk, 51 (for hard disks). But the explanations mentioned over there can't be valid here.
I was burning a CD, and have 8 of these events. According to eventid.net this event probably means that the CD was not OK, e.g. dirty or scratched. It was a completely new CD, but alas I gave it to someone, so I can't test it anymore.
SysmonLog (a) 2042 None Warn x The service was unable to send a message for alert Processor60 to machine Henk. The alert will continue as scheduled. The error returned is: The message alias could not be found on the network.

Via the perfmon.msc console I had set an alert. My intention was to get a warning if my processor would exceed 60%. But as the event shows, I have not succeeded yet.
ASP.NET 4.0.30319.0 (a) 1020 Setup Warn dx Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.

???
WMI (a) 10 None Err dx Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

The error code means WBEM_E_ACCESS_DENIED
WBEM is an acronym for Web-Based Enterprise Management, and WMI (Windows Management Instrumentation) is the Microsoft implementation thereof.
According to Microsoft article 2545227 this error occurs after every restart on Windows 7 Service Pack 1. You can have it automatically fixed by a tool on this page, but the error message is not really a problem.
BugCheck (s) 1001 None Err dx (The computer has rebooted from a bugcheck. The bugcheck was: 0x00000109 (0xa3a039d8afad7852, 0xb3b7465f022bb324, 0xfffff80000b95080, 0x0000000000000002). A dump was saved in: C:\Windows\memory.dmp. Report Id: 021913-20264-01.)

This event occurred after a blue screen (of death), i.e. a BSOD. I think I was about to start the possibly not up-to-date program LADS (which is related to Alternate Data Streams), but I thought I hadn't already started it yet. The error code is very unusual.
DriverFrameworks-UserMode (s) 10114 Startup of the UMDF reflector Info dx The UMDF reflector was unable to complete startup because the WUDFPf service was not found. This service may be started later during boot, at which point Windows will attempt to start the device again.
Kernel-PnP (s) 219 (212) Warn dx The driver \Driver\WUDFRd failed to load for the device WpdBusEnumRoot\UMB\2&37c186b&0& STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_& PROD_USB_DISK_2.0& REV_PMAP#07AA12011D510E41&0#.

This event occurred immediately after event DriverFrameworks-UserMode, 10114. They will probably be related to each other, but this event can also occur in different situations.
According to eventid.net this event happens at random moments after a boot, and with random drivers. It could be that the screen resolution isn't OK (problems with video driver), the mouse isn't working (mouse driver), or whatever. Although this event is about the USB stick, it *did* function OK.
If the thing mentioned doesn't work, the problem will almost certainly be over after a restart.
RestartManager (s) 10010 None Err vx Application "C:\Windows\iexplore.exe" (pid 1960) cannot be restarted - Application SID does not match Conductor SID..

According to this article on Microsoft's site you have to manually start the program, and Restart Manager will try to solve the problem next time.
Outlook (a) 36 None Warn vx Search cannot complete the indexing of your Outlook data. Indexing cannot continue for C:\Users\Henk\Documents\Outlook-bestanden\mail-address.pst (error=0x809706ba). If this error continues, contact Microsoft Support.

This recently happened when I had just installed Outlook 2010. Later the program scanpst also discovered some minor problems in the Outlook file.
I can't find the error code anywhere.
CAPI2 (a) 4107 None Err vx Failed extract of third-party root list from auto update cab at: with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

One very simple cause might be that the date on your PC is incorrect.
This error occurs because the Microsoft Certificate Trust List (CTL) Publisher certificate expired. This article describes what to do.
CAPI2 (a) 4102 None Warn dvx Reached crypt32 threshold of 50 events and will suspend logging for 60 minutes.

Apparently a maximum number of crypt32 events will be logged over a certain period of time. No idea how long that period is, but I don't think this warning is very important.
MsiInstaller (a) 1001 None Warn vx Detection of product '{91140000-0012-0000-0000-0000000FF1CE}', feature 'VSCommonPIAHidden' failed during request for component '{D825F1F0-87AB-11D5-A54F-0090278A1BB8}')

There can be quite a number of causes.
MsiInstaller (a) 1004 None Warn vx Detection of product '{91140000-0012-0000-0000-0000000FF1CE}', feature 'VSCommonPIAHidden', component '{D825F1ED-87AB-11D5-A54F-0090278A1BB8}' failed. The resource does not exist.

???
NETLOGON (s) 5719 None Error dx This computer was not able to set up a secure session with a domain controller in domain domain-name due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.

You can get this error in a domain (usually at work) if you aren't connected to the network. I got the errors shortly after the network cable was pulled out of my PC my PC. Anyhow, for whatever reason, you have lost connection to the domain controller.
e1cexpress (s) 27 None Warn dx Intel(R) 82579LM Gigabit Network Connection
Network link is disconnected.

I got this message when the network cable was pulled out of the PC.
But there are also harder to explain scenario's: I lost my network connection at work, after I changed the value for Link Speed & Duplex to 1.0 Gbps Full Duplex (before it was Auto Negotiation)
Weird, because I do have a 1 Gb connection.
Security-SPP (a) 8200 None Error dx License acquisition failure details.
hr=0x80072EE2

This event is related to the Software Protection service. That service takes care of downloading, installing and enforcing digital licenses for Windows and Windows applications (like Office).
Security-SPP (a) 8208 None Error dx Acquisition of genuine ticket failed (hr=0x80072EE2) for template Id 66c92734-d682-4d71-983e-d6ec3f16059f

This event is related to the Software Protection service. That service takes care of downloading, installing and enforcing digital licenses for Windows and Windows applications (like Office).
Resource-Exhaustion-Detector (s) 2004 Resource-Exhaustion-Detector Warn dx Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: FireSvc.exe (1884) consumed 4090920960 bytes, firefox.exe (4088) consumed 642633728 bytes, and PerfView.exe (6652) consumed 295223296 bytes.

When this event occurred all kinds of programs were crashing, and a Windows dialog window appeared that said Windows had insufficient memory at its disposal. I was advised to close Firefox, although in the event you can see that FireSvc is using even more memory. But that is a program that belongs to the McAfee virusscanner and firewall.
Group-Policy (s) 1129 None Err dx The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.

You can get this error in a domain (usually at work) if you aren't connected to the network for a number of hours. I got the errors about 2 hours after the network cable wasn't connected to my PC anymore. Anyhow, for whatever reason, you have lost connection to the domain controller.
Kernel-Processor-Power (s) 37 (7) War dx The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 14 seconds since the last report.

???
1003 (s) 1003 (102) Error x (Error code 100000ea, parameter1 89346548, parameter2 8950f7d0, parameter3 b84e3cbc, parameter4 00000001.)

Indicates that there has been a system stop (probably blue screen), and the value of the stop code (the first number) and the parameters.
NVIDIA OpenGL Driver (a) 1 None Error x Too many errors occurred, which indicates a serious problem from which we cannot recover. The application must close.

Error code: 1 Visit http://nvidia.custhelp.com/cgi-bin/nvidia.cfg/php/enduser/std_adp.php?p_faqid=3006 for more information.

All kinds of graphical phenomena on the screen, and sometimes it starts to flicker. I suspect the graphics adapter is dying. An extensive description will follow here (sometime in the future).
Windows Error Reporting (a) 1001 None Info dx Fault bucket , type 0 Event Name: AEAPPINV2 Response: Not available Cab Id: 0 Problem signature: P1: 4 P2: 2 P3: 6.1.1.0 P4: 1043 P5: 88 P6: P7: P8: P9: P10: Attached files: These files may be available here: Analysis symbol: Rechecking for solution: 0 Report Id: 41598a6c-e29e-11e2-99b5-402cf4877167 Report Status: 0

This event is the last one in a series of 5, 1 x VSS, 8224, 3 x SideBySide, 33 and finally this one.
According to the few things that can be found on the Internet about AEAPPINV2, this event could mean that you have to flash BIOS, but I'm not convinced.
VSS (a) 8224 None Info dx The VSS service is shutting down due to idle timeout.

This event is the first in a series of 5. Next are 3 x SideBySide, 33 and finally Windows Error Reporting, 1001.
According to this Technet article (although it's about Server 2008) this event is harmless, and that sounds logical to me. If the service has nothing to do, it can better stop until work is available.
Apparently the default number of seconds after which the service quits is at 180, in the registry key
HKLM\SYSTEM\CurrentControlSet\services\VSS\Settings\IdleTimeout (that didn't exist on my system yet). I increased the value to 80000. See what happens next (I get the error every night at work).
VERIFIER (s) 108 None Err x The description for Event ID ( 108 ) in Source ( VERIFIER ) cannot be found.
...
The following information is part of the event: ; display; nv4_disp.

Because I have graphical problems, I had added the 2 nVidia drivers to the list of Verifier.
Even if a crash occurs, this doesn't imply with certainty that the drivers are the cause of the problem, because they can also do strange things because of the behavior of the graphics adapter (one of the dumps seems to imply the driver is in an infinite loop).
Search (a) 3036 Gatherer Warn dx The content source cannot be accessed.

Context: Application, SystemIndex Catalog

Details:
The object was not found. (HRESULT : 0x80041201) (0x80041201)

csc almost certainly refers to the Client Side Cache, which is related to offline files. At that moment I hadn't disabled Windows Search yet, and it apparently wanted to index this folder (in \Windows\CSC). It is unclear to me why this service wouldn't be able to access this folder.
Search (a) 3036 Gatherer Warn dx The content source cannot be accessed.

Context: Application, SystemIndex Catalog

Details:
No protocol handler is available. Install a protocol handler that can process this URL type. (HRESULT : 0x80040d37) (0x80040d37))

Similar to event Search, 3036, only now it's about Outlook files. At that moment I hadn't disabled Windows Search yet, and it apparently wanted to index mail files.
VSS (a) 22 None Error dx Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from CoCreateInstance on class with CLSID {0b5a2c52-3eb9-470a-96e2-6c6d4570e40f} and Name VssSnapshotMgmt is [0x80040154, Class not registered].

The class VssSnapshotMgmt is related to the Volume Shadow Copy Service.
The meaning of the error code: (Class not registered), Operation: Instantiating VSS server
Perhaps you can solve this problem by reregistering a class with regsvr32. In this Microsoft article (at least valid for XP and Windows 7) you can find how to do that.
This article can help too, because apparently the problem sometimes occurs if you run a 32-bit version of VSS on a 64-bit Windows system.
Service Control Manager (s) 7030 None Err dx The AgentService service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Services only rarely interact with users. The message seems to indicate that there is a policy in my domain prohibiting interactive services. At the "Log On" tab of the service you can indicate that it isn't allowed to interact with the desktop.
WMI (a) 63 None Warn dx A provider, PolicyAgentInstanceProvider, has been registered in the Windows Management Instrumentation namespace ROOT\ccm\policy\S_1_5_21_1014176260_98930707_4043447730_210650 to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

???
Outlook (a) 27 None Warn dx OAB Download Failed. (Result code in event data).

Messages with code 27 are related to the Offline Address Book of Outlook. Microsoft artikel 843483 contains a lot of info about these kinds of events, but the cause of the problem isn't clear to me yet.
Outlook (a) 34 None Err dx (Erreur liée gestionnaire d'étendue d'analyse =0x80070422.)

A French message for a change.
Kernel-PnP (s) 225 (223) Warn dx The application System with process id 4 stopped the removal or ejection for the device USB\VID_13FE&PID_3600\07AA12011D510E41.

???
Dhcp-Client (x) 1001 Address Configuration State Event Err dx Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0x402CF4877167. The following error occurred: 0x79. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

Apparently I had lost my connection to the network for a short period of time, because other events pointed in the same direction.
BitLocker-Driver (s) 24624 None Warn dx BIOS/TCG Memory Overwrite Control: Error changing value.

At my PC at work BitLocker (encryptie) is running. The first time BitLocker tried to encrypt the hard drive, I got an error in phase 4, and after restarting the PC I got in a very weird situation. This error occurred around that time.
This Microsoft article offers some explanation.
BitLocker-API (s) 519 None Err dx The servicing of the data recovery agents on the volume failed.
Errorcode: 0x800700aa
Volume GUID: {488fd531-1c45-4afd-b936-ef143de2d367}

At my PC at work BitLocker (encryptie) is running.
Group-Policy (s) 1055 None Err dx The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following:
a) Name Resolution failure on the current domain controller.
b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

The error occurred soon after starting the PC, but after that there were no problems (as far as I could tell).

© Henk Dalmolen
Respond via E-mail (dalmolen@xs4all.nl)

This page was last modified at: 10-8-2013 18:16:51