40 entries

Windows System

Crashes, restarts, services, and disk errors — what Event Viewer shows when something goes wrong.

7 Event 7: The device has a bad block Act now A drive reported a sector it could not read or write reliably. On a mechanical disk this is often the first warning of a failure; on a solid-state drive it is more unusual and more urgent. Back up before doing anything else.
11 Event 11: The driver detected a controller error Worth a look Windows could not talk to a drive properly — a command to it failed or timed out at the bus level. Unlike a bad-sector warning, this blames the path to the disk: the cable, the port, the enclosure, or the driver. On most home PCs it is a USB device, not the drive Windows is installed on.
41 Event 41: The system rebooted without shutting down cleanly Worth a look Windows noticed on startup that the previous shutdown never happened properly — the machine lost power, froze, or crashed. The event records the aftermath, not the cause, which is why it so rarely explains anything by itself.
42 Event 42: The system is entering sleep Informational Windows recorded that the machine went to sleep, and why. It is informational, and it is the event people find when they are actually looking for Kernel-Power 41. The Sleep Reason field is the whole value here: it separates a lid closing from an idle timeout from an app putting the PC to sleep.
51 Event 51: A paging error on a disk Investigate Windows hit an error while reading or writing the page file area of a drive. It usually means the same thing as a bad block — the storage is not responding reliably — and it is one of the earlier warnings a drive gives before it fails outright.
55 Event 55: NTFS found corruption on a volume Investigate The file system on a drive is damaged. Windows usually schedules a repair automatically, but the corruption itself has a cause — most often failing storage or an unclean shutdown — and repairing without finding that cause means it will come back.
98 Event 98: A volume was checked and is healthy Informational NTFS ran its background integrity check on a volume and found nothing wrong. It is the all-clear message, not a warning — people find it because they are searching after a crash and a message full of GUIDs looks alarming.
104 Event 104: An event log was cleared Investigate Someone cleared a log other than Security — the System log, the Application log, or an operational channel. It is the counterpart to Event 1102 and carries the same meaning: whatever was in that log is gone, and someone chose to remove it.
129 Event 129: A storage controller reset the drive Investigate A drive stopped responding for long enough that the storage driver reset it. The machine usually freezes briefly when this happens. It points at the drive, the cable, or the controller — and on solid-state drives, often at outdated firmware.
140 Event 140: NTFS could not write to its transaction log Investigate NTFS keeps a journal so it can recover if a write is interrupted. Event 140 means it could not write to that journal. The message says corruption may occur, which is alarming and accurate — but the cause is almost always the volume becoming unreachable, not the filesystem itself going wrong.
153 Event 153: A disk read or write had to be retried Investigate Windows asked the disk for something, got no answer in time, and asked again. The retry usually succeeds, so nothing visibly breaks — but the machine froze for the seconds it took, and that is why this event turns up under every complaint about stuttering.
157 Event 157: A disk disappeared without being ejected Investigate A drive stopped being present and Windows had no warning. On a USB stick that was yanked out, this is exactly what it says. On an internal drive that nobody touched, it means the disk dropped off the bus while the machine was running, which is a hardware problem.
219 Event 219: A driver failed to load for a device Worth a look Windows tried to load a driver for a piece of hardware and could not. Often harmless — a leftover entry for a device that is no longer plugged in — but it is also what a genuinely broken device looks like, and occasionally what blocked malware looks like.
1001 Event 1001 BugCheck: Windows recorded a blue screen Investigate The machine blue-screened and Windows wrote down the stop code afterwards. The bugcheck code in this event is the single most useful piece of information about a crash, because it names the class of fault — and it points at a dump file that names the culprit.
1014 Event 1014: A DNS lookup timed out Worth a look Windows asked for the address behind a name and none of the DNS servers answered in time. Usually a brief network wobble. When it repeats, the DNS settings or the connection itself are the problem — not the website you were trying to reach.
1058 Event 1058: Group Policy could not read a policy file Investigate Windows tried to fetch a policy file from a domain controller's SYSVOL share and could not. Group Policy then applies nothing new for that policy, silently. The error code at the end of the message says whether this is a network problem, a permissions problem, or a policy that no longer exists.
1074 Event 1074: Something asked Windows to shut down or restart Informational A deliberate shutdown or restart was requested, and Windows recorded which program asked, which account it ran as, and the reason given. It is the event that answers the question 'who rebooted this machine'.
1076 Event 1076: Someone typed a reason for the last unexpected shutdown Informational After a machine restarts unexpectedly, Windows can ask the first administrator who signs in why it happened. Event 1076 records their answer. It is the only free-text human explanation in the System log — and its timestamp is when they typed it, not when the crash happened.
4101 Event 4101: Display driver stopped responding and recovered Worth a look Your graphics card stopped answering for a couple of seconds, so Windows reset it. That is the black flicker you just saw. One is nothing. Several a day means the driver, the card, or its power supply needs attention.
6005 Event 6005: The event log service started Informational Windows started logging, which happens very early in boot. In practice this is the marker for 'the machine came up', and it is the standard way to work out when a computer was last started and how long it has been running.
6006 Event 6006: The event log service stopped Informational Windows stopped logging as part of shutting down, which means the shutdown was orderly. Its real value is negative: when this event is missing before a boot, the machine did not shut down cleanly.
6008 Event 6008: The previous system shutdown was unexpected Worth a look Windows is reporting that the last time the machine went down, it was not asked to. The useful part is the timestamp, which tells you exactly when the machine stopped — and that is what you compare the rest of the logs against.
6013 Event 6013: The system uptime, logged daily Informational Windows records how long the machine has been running, once a day. Nothing is wrong — it is a heartbeat. Its practical use is working out how long a machine has been up without touching it, and spotting reboots you did not know about.
6062 Event 6062: 'Lso was triggered' from your network adapter Informational Your wireless or wired adapter driver logged that a network offload feature was used. It is a debugging message that Intel left switched on in shipping drivers. Nothing is wrong, nothing needs fixing, and it is one of the most searched-for harmless warnings in Event Viewer.
7000 Event 7000: A service failed to start Worth a look Windows tried to start a service and it would not start. The error text at the end of the message is the actual answer — the event number tells you nothing that the error does not tell you better.
7001 Event 7001: A service could not start because another one did not Worth a look Windows services declare what they need running before them. This event says a service gave up because one of its prerequisites failed. The service it names is not the problem — the one it depends on is, and that one has its own error somewhere just above.
7009 Event 7009: A service timed out while starting Worth a look A service took longer than Windows was prepared to wait — 30 seconds by default — and the start was abandoned. On slow or heavily loaded machines this is usually a symptom of the boot itself being slow rather than of anything being wrong with the service.
7011 Event 7011: A service stopped responding to Windows Worth a look Windows asked a service to do something and got no reply within the timeout. On a machine that is slow to start or shut down, this is usually the reason — and it is far more often a symptom of overloaded storage than of a broken service.
7023 Event 7023: A service stopped with an error Worth a look A service shut down and reported a reason. Unlike a plain crash, this one tells you what went wrong in its own words — and that error text is more useful than the event number.
7026 Event 7026: A driver that loads at boot did not load Informational Windows keeps a list of drivers to load before anything else starts. This event names the ones on that list that were not there. On most home PCs it names a driver Windows itself retired, and the correct response is to do nothing at all.
7031 Event 7031: A service terminated unexpectedly Worth a look A Windows service crashed rather than stopping cleanly, and Windows is recording what it plans to do about it. The service name is the whole event — everything useful comes from working out why that particular service died.
7034 Event 7034: A service terminated unexpectedly and stayed stopped Worth a look A service crashed and Windows did nothing about it, because no recovery action was configured. That makes it more consequential than the near-identical Event 7031 — whatever the service was doing has simply stopped.
7036 Event 7036: A service started or stopped Informational A Windows service told the system it had changed state — usually to running or stopped. It is the single most common line in the System log and it is purely informational. It is also the one event that cannot tell you whether a service stopped on purpose.
7038 Event 7038: A service could not log on with its stored password Investigate A service is configured to run as a specific user account, and Windows refused that sign-in. Unlike most service failures this one names the account, not just the service — which is the fastest route to the cause, because it is nearly always a password that changed somewhere else.
7040 Event 7040: A service's start type was changed Worth a look Something changed whether a Windows service starts automatically, on demand, or not at all. Windows Update and installers do this routinely. So does anyone disabling security software, which is why this quiet informational event is one of the more useful ones in the System log.
7045 Event 7045: A new service was installed Investigate A service was registered with Windows. It is available by default with no audit policy to configure, which makes it one of the most practical persistence signals you can collect — and remote execution tools give themselves away here constantly.
10010 Event 10010: A COM component was too slow to start Informational Windows asked a background component to start, waited its fixed timeout, and gave up. The component usually starts a moment later anyway, which is why this error rarely matches any symptom you can see. The only field worth reading is the CLSID, and it is the one nobody explains.
10016 Event 10016: DCOM permission error you can almost always ignore Informational A program asked to start a Windows component and was refused by the permission settings. Microsoft has stated these entries can be safely ignored in the overwhelming majority of cases, and the registry edits people apply to silence them cause more problems than the error does.
10110 Event 10110: A user-mode driver crashed and took your device with it Worth a look Some drivers run outside the kernel so a fault cannot bring down Windows. When one of those crashes, the process hosting it is killed and the devices it was serving stop working until it restarts. Event Viewer marks this Critical, which overstates it — usually a webcam or a printer blinked.
36871 Event 36871: Windows could not build a TLS credential Worth a look Schannel is the Windows component that does HTTPS and TLS. This event means it failed while preparing the credential for a connection — before any server was contacted. The internal error state number is the entire diagnostic, and 10013 means the two ends had no protocol in common.