[RKinner]

OK.  Go back into msconfig.  Under Startup uncheck everything unless it has to do with your mouse.  Under Service, Hide Microsoft Services uncheck everything unless it has to do with your mouse.  OK and reboot into one of your problem users.

 

Do you get the usual problem?  IF not go back into msconfig and check about 1/2 of the items you unchecked, OK and reboot.  Try to isolate it to a particular item.

 

If that has no effect then recheck everything.

[Advertisements]

Tried it. Any ideas?

[hmp3]

Tried it. Any ideas?

[RKinner]

Maybe an older version of the software?

[hmp3]

Hi I'm still working on the symptoms.

I think I may be close to finding the culprit.

 

I have these 4 errors:

 

1000 -

 

Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
Faulting module name: gshell-x64.dll, version: 2.7.8.0, time stamp: 0x4dbc8ea1
Exception code: 0xc0000005
Fault offset: 0x00000000000149da
Faulting process id: 0xba4
Faulting application start time: 0x01d162bfa7aa830b
Faulting application path: C:\Windows\Explorer.EXE
Faulting module path: C:\Program Files (x86)\Gizmo\gshell-x64.dll
Report Id: 852db491-ceb3-11e5-8e8f-00248c02da27

 

7023 -

 

The Server service terminated with the following error:
The service has not been started.

 

3 -

 

Session "ReadyBoot" stopped due to the following error: 0xC0000188

 

4 -

 

The maximum file size for session "ReadyBoot" has been reached. As a result, events might be lost (not logged) to file "C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl". The maximum files size is currently set to 20971520 bytes.

Edited by harvestthesouls, 09 February 2016 - 08:47 AM.

[RKinner]

If you don't absolutely need Gizmo you should uninstall it since it's the cause of the first error.  The other two are caused by ReadyBoot's log filling up which is actually to be expected.  The solution is to change it to a circular log which overwrites old log data rather than keeping it forever.

 

a.     Click start, click control panel

b.     Click administrative tools, performance monitor

c.     Expand left side tree entry for Data Collection Sets

d.     Highlight Startup Event Trace Sessions

e.     Open the ReadyBoot line (click it)

f.      Select the File tab

g.     Select the circular option

h.     Click apply and ok and restart the computer.

[hmp3]

If you don't absolutely need Gizmo you should uninstall it since it's the cause of the first error.  The other two are caused by ReadyBoot's log filling up which is actually to be expected.  The solution is to change it to a circular log which overwrites old log data rather than keeping it forever.

 

a.     Click start, click control panel

b.     Click administrative tools, performance monitor

c.     Expand left side tree entry for Data Collection Sets

d.     Highlight Startup Event Trace Sessions

e.     Open the ReadyBoot line (click it)

f.      Select the File tab

g.     Select the circular option

h.     Click apply and ok and restart the computer.

 

I can't see anything under the File menu other than "options"

[RKinner]

This is what I see:

 

[hmp3]

Okay found it thanks that screenshot really helped RKinner!

Also got this:

36887 - Source: Schannel. "The following fatal alert was received: 112."

[RKinner]

That error just indicates that an SSL connection failed (used when you connect to an HTTPS site).  Unless it happens on a regular basis it's not something to worry about.  Error 112 apparently indicates an unrecognized name.

 

See a list of messages here:

 

http://botan.randomb...S_1_1Alert.html

[hmp3]

Okay it happened every minute for almost an hour. But that's to do with web browsing not pc right?

 

Event Id 3 still shows up from Microsoft-Windows-Kernel-EventTracing/Admin:

 

3 - Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D

[RKinner]

I found this suggestion for your error:

 

. DISABLE the Microsoft Antimalware Service

2. REBOOT the machine

3. DELELETE the EppOobe.etl File
(Reference Path) C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl

4. REBOOT the machine

5. ENABLE the Microsoft Antimalware Service

6. REBOOT the machine

7. Frequently CHECK the Administrative Events Log under Custom Views to ensure the error does not reappear.

NOTE: Just Deleting the EppOobe.etl file and Rebooting will NOT work.

 

But since it is MSE you might just want to replace it with the free Avast.

[hmp3]

I couldn't disable the service.

Also found this error when logging off took forever:

Error event id: 6005 - The winlogon notification subscriber <Profiles> is taking long time to handle the notification event (Logoff).

Edited by harvestthesouls, 14 February 2016 - 02:52 PM.

[RKinner]

Are you running any logon scripts?  Found this:

 

After 2 days of disabling everything in my single GPO of Comp Config, and re-enbaling everything one bit at a time, I discovered just now that disabling "Run logon scripts synchronously†cured my problem! 

No more Event IDs 6005 and 6006! Hurrah! 

This is found under Computer Configuration\Policies\Administrative Templates\System\Scripts

 

 

 

For the service you can't stop try MSCONFIG.  See if you can uncheck it and reboot.

[hmp3]

All the scripts in that folder were 'not configured'. Despite this, should I disable the specified script?

I tried unchecking antimalware in msconfig first. It re-ticked the box as soon as I clicked to apply the disabling.

Edited by harvestthesouls, 14 February 2016 - 05:00 PM.

[RKinner]

OK.  For MSE, download the free Avast.

 

https://www.avast.com/index

 

Uninstall MSE.

 

reboot

 

Install Avast by right clicking and Run As Admin.

 

 

 

The Computer Configuration stuff is part of  Group Policy.  If you have the right version of Windows you will have the Group Policy Editor

 

https://technet.micr...y/cc731745.aspx

 

If you don't have the right version then this link may help:

 

http://superuser.com...-a-logon-script