Errors in event viewer from before I bought my laptop
I bought an HP laptop on 11/01/2011 and set it up and joined an sbs 2008 domain on 15/01/2011.
I have been having many problems with the machine including freezing, suddenly crashing and going to diagnostic.
When i check the event viewer I notice that there are lots of errors some dated 26/04/2010 event id 0,2 critical error,3,512 and some dated 06/08/2010 event id 0,2,3,4,1001 on the diffeent dates, the error are under to different computer names. Is this normal, could some of my problems with the machine be due to these windows setup errors at the manufacturer and do those two dates mean that the machine was setup twice.
Since setting up the machinei have been getting errors 2,33,59,1000,7000,7024,703
and after joining the domain I get dhcp errors daily twice or more times.
I have been having many problems with the machine including freezing, suddenly crashing and going to diagnostic.
When i check the event viewer I notice that there are lots of errors some dated 26/04/2010 event id 0,2 critical error,3,512 and some dated 06/08/2010 event id 0,2,3,4,1001 on the diffeent dates, the error are under to different computer names. Is this normal, could some of my problems with the machine be due to these windows setup errors at the manufacturer and do those two dates mean that the machine was setup twice.
Since setting up the machinei have been getting errors 2,33,59,1000,7000,7024,703
and after joining the domain I get dhcp errors daily twice or more times.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Larry Struckmeyer MVP
I would try very hard to return that system and get a replacement. This sounds like it was not new, previously owned as they say in the car biz. No reason for prior event log entries and multiple names in the event logs, unless the names are from machines you recognize, in which case they could be attempts to contact your system, which are being highlighted by some software on the system, but that is not a familiar senerio.
ASKER
Thank you so much for you responses
Krylosz
I will revert back with the event source on monday as I no longer have the machine here with me. You say that its normal for there to be eventlog errors which i agree with that you get errors from time to time, but is it normal to have them dated 9 and 5 months before you bought your computer?
fl_flyfishing
I initially thought that maybe the errors were generated during startup before I had put in the computer name and the time had sychronised and thats why it was showing wrong date and different computer name but then that doesn't explain the time difference between the two dates and also the fact that there is a total of 3 different names including my one. I do not recorgnize any of the names and they are just an entry of letters and numbers whereas all the machines on my domain have proper names.
Krylosz
I will revert back with the event source on monday as I no longer have the machine here with me. You say that its normal for there to be eventlog errors which i agree with that you get errors from time to time, but is it normal to have them dated 9 and 5 months before you bought your computer?
fl_flyfishing
I initially thought that maybe the errors were generated during startup before I had put in the computer name and the time had sychronised and thats why it was showing wrong date and different computer name but then that doesn't explain the time difference between the two dates and also the fact that there is a total of 3 different names including my one. I do not recorgnize any of the names and they are just an entry of letters and numbers whereas all the machines on my domain have proper names.
The different dates could be caused by an incorrect date and time settings. Are there other eventlog entries in between the entries. I mean, does it look like the computer was used in between?
I didn't catch the part about the different computer names. That sounds really strange, and I would definitely contact HP support.
It could be that these entries were generated during the imaging process at HP. But again: contact HP support.
I didn't catch the part about the different computer names. That sounds really strange, and I would definitely contact HP support.
It could be that these entries were generated during the imaging process at HP. But again: contact HP support.
ASKER
Hi krylosz
Below are the events. I have put a number so that you can see the changing computer names I have underlined.
Log Name: Microsoft-Windows-Kernel-E
Source: Microsoft-Windows-Kernel-E
Date: 2010/04/26 10:46:50 PM
Event ID: 3
Task Category: Session
Level: Error
Keywords: Session
User: SYSTEM
Computer: WIN-9QSV9Q6T0NSDescription:
Session "Microsoft-Windows-Setup" stopped due to the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Ke
<EventID>3</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>14</Opcode>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2010-04-26T20:
<EventRecordID>1</EventRec
<Correlation />
<Execution ProcessID="4" ThreadID="200" />
<Channel>Microsoft-Windows
<Computer>WIN-9QSV9Q6T0NS<
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SessionName">Microso
<Data Name="FileName">C:\Windows
<Data Name="ErrorCode">322122548
<Data Name="LoggingMode">5</Data
</EventData>
</Event>
Log Name: Microsoft-Windows-PrintSer
Source: Microsoft-Windows-PrintSer
Date: 2010/04/26 10:49:02 PM
Event ID: 512
Task Category: Initializing a print provider
Level: Error
Keywords: Router,Classic Spooler Event
User: SYSTEM
Computer: WIN-9QSV9Q6T0NS
Description:
InitializePrintProvider failed for provider inetpp.dll. This can occur because of system instability or a lack of system resources.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Pr
<EventID>512</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>1</Task>
<Opcode>12</Opcode>
<Keywords>0x80000000000028
<TimeCreated SystemTime="2010-04-26T20:
<EventRecordID>2</EventRec
<Correlation />
<Execution ProcessID="1320" ThreadID="1344" />
<Channel>Microsoft-Windows
<Computer>WIN-9QSV9Q6T0NS<
<Security UserID="S-1-5-18" />
</System>
<UserData>
<RouterError xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events">
<Name>inetpp.dll</Name>
<Error>0x0</Error>
</RouterError>
</UserData>
</Event>
Log Name: Microsoft-Windows-Kernel-E
Source: Microsoft-Windows-Kernel-E
Date: 2010/04/26 10:51:59 PM
Event ID: 3
Task Category: Session
Level: Error
Keywords: Session
User: SYSTEM
Computer: WIN-RVF893O1TOO
Description:
Session "Microsoft-Windows-Setup" stopped due to the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Ke
<EventID>3</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>14</Opcode>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2010-04-26T20:
<EventRecordID>2</EventRec
<Correlation />
<Execution ProcessID="4" ThreadID="200" />
<Channel>Microsoft-Windows
<Computer>WIN-RVF893O1TOO<
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SessionName">Microso
<Data Name="FileName">C:\Windows
<Data Name="ErrorCode">322122548
<Data Name="LoggingMode">5</Data
</EventData>
</Event>
Log Name: Microsoft-Windows-Kernel-E
Source: Microsoft-Windows-Kernel-E
Date: 2010/04/26 11:32:06 PM
Event ID: 2
Task Category: Session
Level: Error
Keywords: Session
User: S-1-5-21-2848689877-362302
Computer: 4PPNPADIQOHB3
Description:
Session "" failed to start with the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Ke
<EventID>2</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>12</Opcode>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2010-04-26T21:
<EventRecordID>4</EventRec
<Correlation />
<Execution ProcessID="3216" ThreadID="3392" />
<Channel>Microsoft-Windows
<Computer>4PPNPADIQOHB3</C
<Security UserID="S-1-5-21-284868987
</System>
<EventData>
<Data Name="SessionName">
</Data>
<Data Name="FileName">
</Data>
<Data Name="ErrorCode">322122548
<Data Name="LoggingMode">5</Data
</EventData>
</Event>
Log Name: HP Power Assistant
Source: HP PA Service
Date: 2010/04/26 11:20:34 PM
Event ID: 0
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: 4PPNPADIQOHB3
Description:
System.Management.Manageme
Not supported
at System.Management.Manageme
at System.Management.Manageme
at HPPA_Service.CurrentConfig
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="HP PA Service" />
<EventID Qualifiers="0">0</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2010-04-26T21:
<EventRecordID>1</EventRec
<Channel>HP Power Assistant</Channel>
<Computer>4PPNPADIQOHB3</C
<Security />
</System>
<EventData>
<Data>System.Management.Ma
Not supported
at System.Management.Manageme
at System.Management.Manageme
at HPPA_Service.CurrentConfig
</EventData>
</Event>
Log Name: HP Wireless Assistant
Source: HP WA Service
Date: 2010/08/06 09:13:44 PM
Event ID: 0
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: 4PPNPADIQOHB3
Description:
System.Management.Manageme
ServiceWorkerMethod ABORTED! - Not supported
at System.Management.Manageme
at System.Management.Manageme
at MessageHandlers.MessageHan
at MessageHandlers.MessageHan
at HPPA_Service.HPPA_Service.
at HPPA_Service.HPPA_Service.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="HP WA Service" />
<EventID Qualifiers="0">0</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2010-08-06T19:
<EventRecordID>5</EventRec
<Channel>HP Wireless Assistant</Channel>
<Computer>4PPNPADIQOHB3</C
<Security />
</System>
<EventData>
<Data>System.Management.Ma
ServiceWorkerMethod ABORTED! - Not supported
at System.Management.Manageme
at System.Management.Manageme
at MessageHandlers.MessageHan
at MessageHandlers.MessageHan
at HPPA_Service.HPPA_Service.
at HPPA_Service.HPPA_Service.
</EventData>
</Event>
Log Name: Microsoft-Windows-Dhcp-Cli
Source: Microsoft-Windows-Dhcp-Cli
Date: 2010/08/06 09:24:17 PM
Event ID: 1001
Task Category: Address Configuration State Event
Level: Error
Keywords:
User: LOCAL SERVICE
Computer: WIN-ODI6HQJFF0HDescription:
Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0x70F39587615E. The following error occurred: 0x79. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Dh
<EventID>1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>3</Task>
<Opcode>75</Opcode>
<Keywords>0x40000000000000
<TimeCreated SystemTime="2010-08-06T19:
<EventRecordID>2</EventRec
<Correlation />
<Execution ProcessID="1060" ThreadID="3996" />
<Channel>Microsoft-Windows
<Computer>WIN-ODI6HQJFF0H<
<Security UserID="S-1-5-19" />
</System>
<EventData>
<Data Name="HWLength">6</Data>
<Data Name="HWAddress">70F395876
<Data Name="StatusCode">121</Dat
</EventData>
</Event>
Below are the events. I have put a number so that you can see the changing computer names I have underlined.
Log Name: Microsoft-Windows-Kernel-E
Source: Microsoft-Windows-Kernel-E
Date: 2010/04/26 10:46:50 PM
Event ID: 3
Task Category: Session
Level: Error
Keywords: Session
User: SYSTEM
Computer: WIN-9QSV9Q6T0NSDescription:
Session "Microsoft-Windows-Setup" stopped due to the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Ke
<EventID>3</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>14</Opcode>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2010-04-26T20:
<EventRecordID>1</EventRec
<Correlation />
<Execution ProcessID="4" ThreadID="200" />
<Channel>Microsoft-Windows
<Computer>WIN-9QSV9Q6T0NS<
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SessionName">Microso
<Data Name="FileName">C:\Windows
<Data Name="ErrorCode">322122548
<Data Name="LoggingMode">5</Data
</EventData>
</Event>
Log Name: Microsoft-Windows-PrintSer
Source: Microsoft-Windows-PrintSer
Date: 2010/04/26 10:49:02 PM
Event ID: 512
Task Category: Initializing a print provider
Level: Error
Keywords: Router,Classic Spooler Event
User: SYSTEM
Computer: WIN-9QSV9Q6T0NS
Description:
InitializePrintProvider failed for provider inetpp.dll. This can occur because of system instability or a lack of system resources.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Pr
<EventID>512</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>1</Task>
<Opcode>12</Opcode>
<Keywords>0x80000000000028
<TimeCreated SystemTime="2010-04-26T20:
<EventRecordID>2</EventRec
<Correlation />
<Execution ProcessID="1320" ThreadID="1344" />
<Channel>Microsoft-Windows
<Computer>WIN-9QSV9Q6T0NS<
<Security UserID="S-1-5-18" />
</System>
<UserData>
<RouterError xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events">
<Name>inetpp.dll</Name>
<Error>0x0</Error>
</RouterError>
</UserData>
</Event>
Log Name: Microsoft-Windows-Kernel-E
Source: Microsoft-Windows-Kernel-E
Date: 2010/04/26 10:51:59 PM
Event ID: 3
Task Category: Session
Level: Error
Keywords: Session
User: SYSTEM
Computer: WIN-RVF893O1TOO
Description:
Session "Microsoft-Windows-Setup" stopped due to the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Ke
<EventID>3</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>14</Opcode>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2010-04-26T20:
<EventRecordID>2</EventRec
<Correlation />
<Execution ProcessID="4" ThreadID="200" />
<Channel>Microsoft-Windows
<Computer>WIN-RVF893O1TOO<
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SessionName">Microso
<Data Name="FileName">C:\Windows
<Data Name="ErrorCode">322122548
<Data Name="LoggingMode">5</Data
</EventData>
</Event>
Log Name: Microsoft-Windows-Kernel-E
Source: Microsoft-Windows-Kernel-E
Date: 2010/04/26 11:32:06 PM
Event ID: 2
Task Category: Session
Level: Error
Keywords: Session
User: S-1-5-21-2848689877-362302
Computer: 4PPNPADIQOHB3
Description:
Session "" failed to start with the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Ke
<EventID>2</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>12</Opcode>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2010-04-26T21:
<EventRecordID>4</EventRec
<Correlation />
<Execution ProcessID="3216" ThreadID="3392" />
<Channel>Microsoft-Windows
<Computer>4PPNPADIQOHB3</C
<Security UserID="S-1-5-21-284868987
</System>
<EventData>
<Data Name="SessionName">
</Data>
<Data Name="FileName">
</Data>
<Data Name="ErrorCode">322122548
<Data Name="LoggingMode">5</Data
</EventData>
</Event>
Log Name: HP Power Assistant
Source: HP PA Service
Date: 2010/04/26 11:20:34 PM
Event ID: 0
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: 4PPNPADIQOHB3
Description:
System.Management.Manageme
Not supported
at System.Management.Manageme
at System.Management.Manageme
at HPPA_Service.CurrentConfig
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="HP PA Service" />
<EventID Qualifiers="0">0</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2010-04-26T21:
<EventRecordID>1</EventRec
<Channel>HP Power Assistant</Channel>
<Computer>4PPNPADIQOHB3</C
<Security />
</System>
<EventData>
<Data>System.Management.Ma
Not supported
at System.Management.Manageme
at System.Management.Manageme
at HPPA_Service.CurrentConfig
</EventData>
</Event>
Log Name: HP Wireless Assistant
Source: HP WA Service
Date: 2010/08/06 09:13:44 PM
Event ID: 0
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: 4PPNPADIQOHB3
Description:
System.Management.Manageme
ServiceWorkerMethod ABORTED! - Not supported
at System.Management.Manageme
at System.Management.Manageme
at MessageHandlers.MessageHan
at MessageHandlers.MessageHan
at HPPA_Service.HPPA_Service.
at HPPA_Service.HPPA_Service.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="HP WA Service" />
<EventID Qualifiers="0">0</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2010-08-06T19:
<EventRecordID>5</EventRec
<Channel>HP Wireless Assistant</Channel>
<Computer>4PPNPADIQOHB3</C
<Security />
</System>
<EventData>
<Data>System.Management.Ma
ServiceWorkerMethod ABORTED! - Not supported
at System.Management.Manageme
at System.Management.Manageme
at MessageHandlers.MessageHan
at MessageHandlers.MessageHan
at HPPA_Service.HPPA_Service.
at HPPA_Service.HPPA_Service.
</EventData>
</Event>
Log Name: Microsoft-Windows-Dhcp-Cli
Source: Microsoft-Windows-Dhcp-Cli
Date: 2010/08/06 09:24:17 PM
Event ID: 1001
Task Category: Address Configuration State Event
Level: Error
Keywords:
User: LOCAL SERVICE
Computer: WIN-ODI6HQJFF0HDescription:
Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0x70F39587615E. The following error occurred: 0x79. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Dh
<EventID>1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>3</Task>
<Opcode>75</Opcode>
<Keywords>0x40000000000000
<TimeCreated SystemTime="2010-08-06T19:
<EventRecordID>2</EventRec
<Correlation />
<Execution ProcessID="1060" ThreadID="3996" />
<Channel>Microsoft-Windows
<Computer>WIN-ODI6HQJFF0H<
<Security UserID="S-1-5-19" />
</System>
<EventData>
<Data Name="HWLength">6</Data>
<Data Name="HWAddress">70F395876
<Data Name="StatusCode">121</Dat
</EventData>
</Event>
ASKER
Hi
Ok got in touch with HP they can't explain to me why those error logs appear on the machine. They initially said don't you have a virus until we verified that 06/08/2010 is the start of warranty date shown both on this machine and on thier system so it couldn't have been a viral coincidence.
They say they can't replace the machine 39 days after purchased, they only replace within 30days. We have ran the hardware diagnostics and they passed so thier suggestion is just to reinstall the operating system.
They have also said that they really can't check in what state the machine left their warehouse but in anycase if they were errors during installation i should contact microsoft as they are the ones responsible for the software. Does that make sense at all?
Ok got in touch with HP they can't explain to me why those error logs appear on the machine. They initially said don't you have a virus until we verified that 06/08/2010 is the start of warranty date shown both on this machine and on thier system so it couldn't have been a viral coincidence.
They say they can't replace the machine 39 days after purchased, they only replace within 30days. We have ran the hardware diagnostics and they passed so thier suggestion is just to reinstall the operating system.
They have also said that they really can't check in what state the machine left their warehouse but in anycase if they were errors during installation i should contact microsoft as they are the ones responsible for the software. Does that make sense at all?
This is very strange. I don't think that a virus could be involved.
Contacting MS is also a strange advice, as HP did install their OEM version of Windows and are pretty much responsible for delivering a working system to you. It's a shome that they won't take the laptop back, but you pretty much have no choice now.
The start of warrenty date is questionable. Shouldn't the start of warrenty date be the date you purchased the laptop? It certainly is my country.
But I agree with HP that you should reinstall the OD and see if the errors come back.
Contacting MS is also a strange advice, as HP did install their OEM version of Windows and are pretty much responsible for delivering a working system to you. It's a shome that they won't take the laptop back, but you pretty much have no choice now.
The start of warrenty date is questionable. Shouldn't the start of warrenty date be the date you purchased the laptop? It certainly is my country.
But I agree with HP that you should reinstall the OD and see if the errors come back.
ASKER
We ran hardware diagnostics and it seems the hardware is fine so have reinstalled the operating system and so far so good.