Source: kernel-boot
event id: 29
Level: Error
User: System
Source: Kernel-Boot
Windows failed fast startup with error status 0xC00000D4.
event id: 6008
Level: Error
User: System
Source: EventLog
The previous system shutdown at 2:16:42 AM on 11/14/2013 was unexpected.
- System
- Provider
[ Name] EventLog
- EventID 6008
[ Qualifiers] 32768
Level 2
Task 0
Keywords 0x80000000000000
- TimeCreated
[ SystemTime] 2013-11-15T21:19:26.000000000Z
EventRecordID 2378
Channel System
Computer R
Security
- EventData
1:42:56 AM
11/15/2013
4847
DD070B0005000F0001002A003800AD03DD070B0005000F0006002A003800AD03600900003C000000010000006009000001000000B00400000100000000000000
________________________________________
Binary data:
In Words
0000: 000B07DD 000F0005 002A0001 03AD0038
0010: 000B07DD 000F0005 002A0006 03AD0038
0020: 00000960 0000003C 00000001 00000960
0030: 00000001 000004B0 00000001 00000000
In Bytes
0000: DD 07 0B 00 05 00 0F 00 Ý.......
0008: 01 00 2A 00 38 00 AD 03 ..*.8.¬.
0010: DD 07 0B 00 05 00 0F 00 Ý.......
0018: 06 00 2A 00 38 00 AD 03 ..*.8.¬.
0020: 60 09 00 00 3C 00 00 00 `...<...
0028: 01 00 00 00 60 09 00 00 ....`...
0030: 01 00 00 00 B0 04 00 00 ....°...
0038: 01 00 00 00 00 00 00 00 ........
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="EventLog" />
<EventID Qualifiers="32768">6008</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-11-15T05:09:25.000000000Z" />
<EventRecordID>2295</EventRecordID>
<Channel>System</Channel>
<Computer>R</Computer>
<Security />
</System>
- <EventData>
<Data>12:02:41 AM</Data>
<Data>11/15/2013</Data>
<Data />
<Data />
<Data>15</Data>
<Data />
<Data />
<Binary>DD070B0005000F000000020029007301DD070B0005000F0005000200290073013C0000003C000000010000003C00000000000000B00400000100000000000000</Binary>
</EventData>
</Event>
event id: 41
Level: Critical
User: System
Source: Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
- System
- Provider
[ Name] Microsoft-Windows-Kernel-Power
[ Guid] {331C3B3A-2005-44C2-AC5E-77220C37D6B4}
EventID 41
Version 3
Level 1
Task 63
Opcode 0
Keywords 0x8000000000000002
- TimeCreated
[ SystemTime] 2013-11-15T21:19:09.822339400Z
EventRecordID 2386
Correlation
- Execution
[ ProcessID] 4
[ ThreadID] 8
Channel System
Computer R
- Security
[ UserID] S-1-5-18
- EventData
BugcheckCode 0
BugcheckParameter1 0x0
BugcheckParameter2 0x0
BugcheckParameter3 0x0
BugcheckParameter4 0x0
SleepInProgress 6
PowerButtonTimestamp 0
BootAppStatus 3221225684
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>41</EventID>
<Version>3</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000002</Keywords>
<TimeCreated SystemTime="2013-11-15T21:19:09.822339400Z" />
<EventRecordID>2386</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>R</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="BugcheckCode">0</Data>
<Data Name="BugcheckParameter1">0x0</Data>
<Data Name="BugcheckParameter2">0x0</Data>
<Data Name="BugcheckParameter3">0x0</Data>
<Data Name="BugcheckParameter4">0x0</Data>
<Data Name="SleepInProgress">6</Data>
<Data Name="PowerButtonTimestamp">0</Data>
<Data Name="BootAppStatus">3221225684</Data>
</EventData>
</Event>
Audit events have been dropped by the transport. 0
Source: eventlog
Event ID: 1101
Leve Error
- System
- Provider
[ Name] Microsoft-Windows-Eventlog
[ Guid] {fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}
EventID 1101
Version 0
Level 2
Task 101
Opcode 0
Keywords 0x4020000000000000
- TimeCreated
[ SystemTime] 2013-11-15T21:19:29.704258500Z
EventRecordID 9485
Correlation
- Execution
[ ProcessID] 872
[ ThreadID] 424
Channel Security
Computer R
Security
- UserData
- AuditEventsDropped
Reason 0
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Eventlog" Guid="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" />
<EventID>1101</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>101</Task>
<Opcode>0</Opcode>
<Keywords>0x4020000000000000</Keywords>
<TimeCreated SystemTime="2013-11-15T05:09:27.104689000Z" />
<EventRecordID>9013</EventRecordID>
<Correlation />
<Execution ProcessID="880" ThreadID="988" />
<Channel>Security</Channel>
<Computer>R</Computer>
<Security />
</System>
- <UserData>
- <AuditEventsDropped xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog">
<Reason>0</Reason>
</AuditEventsDropped>
</UserData>
</Event>
Windows failed fast startup with error status 0xC00000D4.
Source: Kernel Boot
Even\t ID: 29
User: System
Level: Error
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" />
<EventID>29</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2013-11-15T21:19:04.603167300Z" />
<EventRecordID>2370</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>R</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="FailureStatus">3221225684</Data>
<Data Name="FailureMsgId">1155856</Data>
</EventData>
</Event>
