Ask a new question

Event 28 Kernel-EventTracing, Event 6147, Event 6155 LSA (LSAsrv)

Event 28 Kernel-EventTracing

Error setting traits on Provider {77811378-e885-4ac2-a580-bc86e4f1bc93}. Error 0x C0000005

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

  <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}" />

  <EventID>28</EventID>

  <Version>0</Version>

  <Level>2</Level>

  <Task>3</Task>

  <Opcode>25</Opcode>

  <Keywords>0x8000000000000a20</Keywords>

  <TimeCreated SystemTime="2022-07-21T19:07:40.0480940Z" />

  <EventRecordID>29</EventRecordID>

  <Correlation />

  <Execution ProcessID="840" ThreadID="972" />

  <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>

  <Computer>DESKTOP-0687UEC</Computer>

  <Security UserID="S-1-5-18" />

  </System>

- <EventData>

  <Data Name="ProviderGuid">{77811378-e885-4ac2-a580-bc86e4f1bc93}</Data>

  <Data Name="ErrorCode">3221225477</Data>

  </EventData>

  </Event>


Event 6147 LSA (LSAsrv)

Credential Guard is configured to run, but is not licensed. Credential Guard was not started.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

  <Provider Name="LsaSrv" Guid="{199fe037-2b82-40a9-82ac-e1d46c792b99}" />

  <EventID>6147</EventID>

  <Version>0</Version>

  <Level>3</Level>

  <Task>0</Task>

  <Opcode>0</Opcode>

  <Keywords>0x8000000000000000</Keywords>

  <TimeCreated SystemTime="2022-07-21T19:07:40.0549256Z" />

  <EventRecordID>16775</EventRecordID>

  <Correlation />

  <Execution ProcessID="1036" ThreadID="1040" />

  <Channel>System</Channel>

  <Computer>DESKTOP-0687UEC</Computer>

  <Security UserID="S-1-5-18" />

  </System>

  <EventData />

  </Event>


Event 6155 LSA (LSAsrv)

Package LSA not signed as expected. This can cause unexpected behavior with Credential Guard service. (this is translated, I think I got it right)

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

  <Provider Name="LsaSrv" Guid="{199fe037-2b82-40a9-82ac-e1d46c792b99}" />

  <EventID>6155</EventID>

  <Version>0</Version>

  <Level>3</Level>

  <Task>0</Task>

  <Opcode>0</Opcode>

  <Keywords>0x8000000000000000</Keywords>

  <TimeCreated SystemTime="2022-07-21T19:07:40.1805070Z" />

  <EventRecordID>16787</EventRecordID>

  <Correlation ActivityID="{1fb28316-9d35-0008-5083-b21f359dd801}" />

  <Execution ProcessID="1036" ThreadID="1040" />

  <Channel>System</Channel>

  <Computer>DESKTOP-0687UEC</Computer>

  <Security UserID="S-1-5-18" />

  </System>

- <EventData>

  <Data Name="PackageName">msv1_0</Data>

  </EventData>

  </Event>

Hello Customer,

Welcome to Microsoft Community.

1. According to your description,We found that the process ID of Event 28 is the desktop application that caused this event, You can try clean boot in Windowst which software is causing the problem.

How to perform a clean boot in Windows

1）Sign in to the computer as an administrator. If you are unsure if your account has administrator rights, see Create a local user or administrator account in Windows to find out how to see if your account has administrator rights, and grant them to your account, if necessary.

2）Select Search , type msconfig , and then select System Configuration from the list of results.

3）On the Services tab of System Configuration, select Hide all Microsoft services, and then select Disable all. Select Apply.

4）On the Startup tab of System Configuration, select Open Task Manager.

5）On the Startup tab in Task Manager, for each Enabled startup item, select the item and then select Disable. (Keep track of which items have been Disabled. You will need to know this later.)

6）Close Task Manager.

7）On the Startup tab of System Configuration, select OK. When you restart the computer, it will be in a clean boot environment. Follow troubleshooting steps to install, uninstall, or run your application. Your computer might temporarily lose some functionality while in a clean boot environment. Reset the computer to start normally after clean boot troubleshooting and resume functionality.

About how to perform a clean boot in Windows you can click on this link How to perform a clean boot in Windows (microsoft.com)

Disclaimer: A “clean boot” starts Windows with a minimal set of drivers and startup programs. It helps to determine whether a background program is interfering with your game or program and to isolate the cause of a problem. 

These steps of "clean boot" might look complicated at first glance. However, to avoid any trouble for you, please follow them in order and step-by step so that it will help you get you back on track.

2. Event 6147 This event is triggered by the local security password verification.

What is the impact of the above two events on your usage? Please describe them specifically, it will help us to solve the problem.

Looking forward to your reply.

Best Regards,

Lenka | Microsoft Community Support Specialist

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Today i got EventID 28 error with different PID which should be LsaIso.exe = Credential Guard & Key Guard. The one I posted yesterday didnt appear today, there were more of same event ids with different PIDs, but they didnt showed up today, so Im posting only the last one.

EventID 28

Error setting traits on Provider {77811378-e885-4ac2-a580-bc86e4f1bc93}. Error 0x C0000005


- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

  <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}" />

  <EventID>28</EventID>

  <Version>0</Version>

  <Level>2</Level>

  <Task>3</Task>

  <Opcode>25</Opcode>

  <Keywords>0x8000000000000a20</Keywords>

  <TimeCreated SystemTime="2022-07-22T15:47:01.1083184Z" />

  <EventRecordID>36</EventRecordID>

  <Correlation />

  <Execution ProcessID="1032" ThreadID="1036" />

  <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>

  <Computer>DESKTOP-0687UEC</Computer>

  <Security UserID="S-1-5-18" />

  </System>

- <EventData>

  <Data Name="ProviderGuid">{77811378-e885-4ac2-a580-bc86e4f1bc93}</Data>

  <Data Name="ErrorCode">3221225477</Data>

  </EventData>

  </Event>

I get this too Event ID: 86

SCEP Certificate enrollment initialization for WORKGROUP\DESKTOP-0687UEC$ via https://AMD-KeyId-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep failed:

GetCACaps

GetCACaps: Not Found

{"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."}

HTTP/1.1 404 Not Found

Date: Fri, 22 Jul 2022 15:47:10 GMT

Content-Length: 121

Content-Type: application/json; charset=utf-8

X-Content-Type-Options: nosniff

Strict-Transport-Security: max-age=31536000;includeSubDomains

x-ms-request-id: 82adac11-066d-4d56-a1c5-12738a2ac3e1

Method: GET(250ms)

Stage: GetCACaps Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

  <Provider Name="Microsoft-Windows-CertificateServicesClient-CertEnroll" Guid="{54164045-7C50-4905-963F-E5BC1EEF0CCA}" EventSourceName="CertEnroll" />

  <EventID Qualifiers="49754">86</EventID>

  <Version>0</Version>

  <Level>2</Level>

  <Task>0</Task>

  <Opcode>0</Opcode>

  <Keywords>0x80000000000000</Keywords>

  <TimeCreated SystemTime="2022-07-22T15:47:10.2203895Z" />

  <EventRecordID>6556</EventRecordID>

  <Correlation />

  <Execution ProcessID="4960" ThreadID="0" />

  <Channel>Application</Channel>

  <Computer>DESKTOP-0687UEC</Computer>

  <Security UserID="S-1-5-18" />

  </System>

- <EventData>

  <Data Name="Context">WORKGROUP\DESKTOP-0687UEC$</Data>

  <Data Name="Url">https://AMD-KeyId-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep</Data>

  <Data Name="MessageText">GetCACaps GetCACaps: Not Found {"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."} HTTP/1.1 404 Not Found Date: Fri, 22 Jul 2022 15:47:10 GMT Content-Length: 121 Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000;includeSubDomains x-ms-request-id: 82adac11-066d-4d56-a1c5-12738a2ac3e1</Data>

  <Data Name="Method">GET(250ms)</Data>

  <Data Name="Stage">GetCACaps</Data>

  <Data Name="ErrorCode">Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)</Data>

  </EventData>

  </Event>

Event ID: 86

SCEP Certificate enrollment initialization for Local system via https://AMD-KeyId 578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep failed:

GetCACaps

GetCACaps: Not Found

{"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."}

HTTP/1.1 404 Not Found

Date: Fri, 22 Jul 2022 15:47:10 GMT

Content-Length: 121

Content-Type: application/json; charset=utf-8

X-Content-Type-Options: nosniff

Strict-Transport-Security: max-age=31536000;includeSubDomains

x-ms-request-id: b8534749-4611-4bb5-86b5-040daaa5d760

Method: GET(391ms)

Stage: GetCACaps

Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

  <Provider Name="Microsoft-Windows-CertificateServicesClient-CertEnroll" Guid="{54164045-7C50-4905-963F-E5BC1EEF0CCA}" EventSourceName="CertEnroll" />

  <EventID Qualifiers="49754">86</EventID>

  <Version>0</Version>

  <Level>2</Level>

  <Task>0</Task>

  <Opcode>0</Opcode>

  <Keywords>0x80000000000000</Keywords>

  <TimeCreated SystemTime="2022-07-22T15:47:09.8134029Z" />

  <EventRecordID>6555</EventRecordID>

  <Correlation />

  <Execution ProcessID="4960" ThreadID="0" />

  <Channel>Application</Channel>

  <Computer>DESKTOP-0687UEC</Computer>

  <Security UserID="S-1-5-18" />

  </System>

- <EventData>

  <Data Name="Context">Local system</Data>

  <Data Name="Url">https://AMD-KeyId-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep</Data>

  <Data Name="MessageText">GetCACaps GetCACaps: Not Found {"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."} HTTP/1.1 404 Not Found Date: Fri, 22 Jul 2022 15:47:10 GMT Content-Length: 121 Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000;includeSubDomains x-ms-request-id: b8534749-4611-4bb5-86b5-040daaa5d760</Data>

  <Data Name="Method">GET(391ms)</Data>

  <Data Name="Stage">GetCACaps</Data>

  <Data Name="ErrorCode">Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)</Data>

  </EventData>

  </Event>

Event ID: 64

Local system certificate with fingerprint 73 05 c5 29 71 57 48 b7 f3 63 80 58 7e 9e 75 f0 bb 4e 86 b1 will expire or has already expired.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

  <Provider Name="Microsoft-Windows-CertificateServicesClient-AutoEnrollment" Guid="{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}" EventSourceName="AutoEnrollment" />

  <EventID Qualifiers="32768">64</EventID>

  <Version>0</Version>

  <Level>3</Level>

  <Task>0</Task>

  <Opcode>0</Opcode>

  <Keywords>0x80000000000000</Keywords>

  <TimeCreated SystemTime="2022-07-22T15:47:12.1829299Z" />

  <EventRecordID>6557</EventRecordID>

  <Correlation />

  <Execution ProcessID="6176" ThreadID="0" />

  <Channel>Application</Channel>

  <Computer>DESKTOP-0687UEC</Computer>

  <Security />

  </System>

- <EventData>

  <Data Name="Context">local system</Data>

  <Data Name="ObjId">73 05 c5 29 71 57 48 b7 f3 63 80 58 7e 9e 75 f0 bb 4e 86 b1</Data>

  </EventData>

  </Event>

Yesterday I got stutter while watching video and then when I played Facebook game computer crashed. I think the cause is Event 17. Other Event ids dont cause any problems, as far as I know. As far as I remember computer worked fine even with those errors and warnings.

I think this is connected to Mass Storage, because when I uninstalled Mass storage device I got Event 225 and as you can see DeviceInstance in it is the same as PrimaryDeviceName in Event ID: 17.

Event ID 225

DeviceInstance">PCI\VEN_1022&DEV_1453&SUBSYS_14531022&REV_00\3&11583659&0&0B</Data>

Event ID: 17

PrimaryDeviceName">PCI\VEN_1022&DEV_1453&SUBSYS_14531022&REV_00

I disabled Mass Storage in BIOS and will see what happens.

Event ID 225

The application System with process id 4 stopped the removal or ejection for the device PCI\VEN_1022&DEV_1453&SUBSYS_14531022&REV_00\3&11583659&0&0B.

Process command line:

List of affected devices:

STORAGE\Volume\{44b56f4e-71b6-11eb-a7ea-806e6f6e6963}#0000000028600000

STORAGE\Volume\{44b56f4e-71b6-11eb-a7ea-806e6f6e6963}#0000000021200000

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

  <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="{9c205a39-1250-487d-abd7-e831c6290539}" />

  <EventID>225</EventID>

  <Version>2</Version>

  <Level>3</Level>

  <Task>223</Task>

  <Opcode>0</Opcode>

  <Keywords>0x8000000000000000</Keywords>

  <TimeCreated SystemTime="2022-07-22T21:52:51.3878248Z" />

  <EventRecordID>19214</EventRecordID>

  <Correlation />

  <Execution ProcessID="4" ThreadID="3688" />

  <Channel>System</Channel>

  <Computer>DESKTOP-0687UEC</Computer>

  <Security UserID="S-1-5-18" />

  </System>

- <EventData>

  <Data Name="ProcessId">4</Data>

  <Data Name="ProcessNameLength">6</Data>

  <Data Name="ProcessName">System</Data>

  <Data Name="DeviceInstanceLength">60</Data>

  <Data Name="DeviceInstance">PCI\VEN_1022&DEV_1453&SUBSYS_14531022&REV_00\3&11583659&0&0B</Data>

  <Data Name="CommandLineLength">0</Data>

  <Data Name="CommandLine" />

  <Data Name="VetoingDevicesLength">144</Data>

  <Data Name="VetoingDevices">STORAGE\Volume\{44b56f4e-71b6-11eb-a7ea-806e6f6e6963}#0000000028600000 STORAGE\Volume\{44b56f4e-71b6-11eb-a7ea-806e6f6e6963}#0000000021200000</Data>

  </EventData>

  </Event>


Event ID: 17

A corrected hardware error has occurred.

Component: PCI Express Root Port

Error Source: Advanced Error Reporting (PCI Express)

Primary Bus:Device:Function: 0x0:0x3:0x1

Secondary Bus:Device:Function: 0x0:0x0:0x0

Primary Device Name:PCI\VEN_1022&DEV_1453&SUBSYS_14531022&REV_00

Secondary Device Name:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

  <Provider Name="Microsoft-Windows-WHEA-Logger" Guid="{c26c4f3c-3f66-4e99-8f8a-39405cfed220}" />

  <EventID>17</EventID>

  <Version>1</Version>

  <Level>3</Level>

  <Task>0</Task>

  <Opcode>0</Opcode>

  <Keywords>0x8000000000000000</Keywords>

  <TimeCreated SystemTime="2022-07-21T21:55:41.7113830Z" />

  <EventRecordID>17525</EventRecordID>

  <Correlation ActivityID="{7d18bf50-418d-4963-96f9-da56216f0d12}" />

  <Execution ProcessID="7412" ThreadID="7524" />

  <Channel>System</Channel>

  <Computer>DESKTOP-0687UEC</Computer>

  <Security UserID="S-1-5-19" />

  </System>

- <EventData>

  <Data Name="ErrorSource">4</Data>

  <Data Name="FRUId">{00000000-0000-0000-0000-000000000000}</Data>

  <Data Name="FRUText" />

  <Data Name="ValidBits">0xdf</Data>

  <Data Name="PortType">4</Data>

  <Data Name="Version">0x101</Data>

  <Data Name="Command">0x407</Data>

  <Data Name="Status">0x10</Data>

  <Data Name="Bus">0x0</Data>

  <Data Name="Device">0x3</Data>

  <Data Name="Function">0x1</Data>

  <Data Name="Segment">0x0</Data>

  <Data Name="SecondaryBus">0x0</Data>

  <Data Name="SecondaryDevice">0x0</Data>

  <Data Name="SecondaryFunction">0x0</Data>

  <Data Name="VendorID">0x1022</Data>

  <Data Name="DeviceID">0x1453</Data>

  <Data Name="ClassCode">0x30400</Data>

  <Data Name="DeviceSerialNumber">0x0</Data>

  <Data Name="BridgeControl">0x0</Data>

  <Data Name="BridgeStatus">0x0</Data>

  <Data Name="UncorrectableErrorStatus">0x0</Data>

  <Data Name="CorrectableErrorStatus">0x40</Data>

  <Data Name="HeaderLog">00000000000000000000000000000000</Data>

  <Data Name="PrimaryDeviceName">PCI\VEN_1022&DEV_1453&SUBSYS_14531022&REV_00</Data>

  <Data Name="SecondaryDeviceName" />

  </EventData>

  </Event>

All these events happen at Startup, except Event id 17.

I run sfc /scannow and it found some corrupted files and repair them, Dism /Online /Cleanup-Image /ScanHealth didnt found anything.

AMD RYZEN 2600 | GIGABYTE B450M DS3H | XFX RX 580 8 GB GTS BLACK EDITION | Patriot VIPER 16GB DDR4 3000MHZ | Transcend M.2 PCIe 110S 512GB | WD Blue 2TB WD20EZRZ | Windows 11 Pro x64

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I still get warning Event id 17 I think I could be mistaken when I said it is Mass Storage, It could be something with graphic card because when I reinstall it screen goes black and it blinks, the same as when you install GPU drivers, I installed Recommended driver but error is still present. Then I remembered that I changed BIOS settings, I set Pci and Pci Express to Auto, before it was set to Gen 3, I put it back and will see if that will help. Todays PID was svchost.exe.

Other errors are still there, but this one bothers me the most, because my computer worked normal with other errors, just this one is giving me stutters and black screens, after that I have to reboot. Yesterday I did not get anything even when id 17 errors were there, but I didnt play any games. Will see what happens. Also I want to know why I cant install different driver like Pci to Pci Bridge, when I install it, it stays on Pci Express Root driver.

AMD RYZEN 2600 | GIGABYTE B450M DS3H | XFX RX 580 8 GB GTS BLACK EDITION | Patriot VIPER 16GB DDR4 3000MHZ | Transcend M.2 PCIe 110S 512GB | WD Blue 2TB WD20EZRZ | Windows 11 Pro x64

1 person found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hello customer,

Glad to receive your reply, have you test the steps given above for a clean boot in Windows.

Based on your description, we judge that the hardware is more likely, we suggest you try to go to the official website to download the Display adapters driver to install, if the problem still exists, please try to reset the BOIS settings of your computer.

Note: If you are worried about accidentally resetting BOIS, please back up your personal files to the C drive (e.g., C:\Users\username)***.

In addition, does your computer appear to be overclocked? If so, we recommend that you replace the battery to alleviate this problem.

I hope the above information can help you.

Best Regards,

Lenka-MSFT| Microsoft Community Support Specialist 
 

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hello Customer,

 

How is your problem? Please let me know if there is any progress.
 

Best Regards,

Lenka | Microsoft Community Support Specialist

--------------------------------------------------

* Beware of scammers posting fake support numbers here.

* If your problem is not solved, you could reply to the post again and we would continue to provide technical support for you.

* Please check and vote this answer if it helps as it will be beneficial to more community members reading here.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Error ids are still present, dont know what to do, my computer runs Ok maybe because I disabled Hardware Acceleration in Browser. Cpu is not overclocked.

AMD RYZEN 2600 | GIGABYTE B450M DS3H | XFX RX 580 8 GB GTS BLACK EDITION | Patriot VIPER 16GB DDR4 3000MHZ | Transcend M.2 PCIe 110S 512GB | WD Blue 2TB WD20EZRZ | Windows 11 Pro x64

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi Customer，

Based on your description the computer is running normally, so maybe these errors do not negatively affect the functionality of your computer. Thank you for your support of Microsoft products, and please continue to ask questions if you have any other questions.

Best Regards,

Lenka-MSFT| Microsoft Community Support Specialist 

 

"We value your feedback, click Yes or No to help us improve the support experience."

"Let us know if you got the help you needed by clicking yes or No."

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

 
 

Question Info

Last updated May 8, 2024 Views 15,068 Applies to: