Event 3024 from CodeIntegrity - Windows was unable to update the boot catalog cache file. Status 0xc0000034. This event seems new to SP1. When this event has occurred, the boot catalog cache file (C:\Windows\System32\CodeIntegrity\bootcat.cache) looks like it _has_ been updated - its last write time has been changed to the same time as Event 3024. Has anyone else seen this event, or have any details about it. For example, under what circumstances is this file updated, and why would Windows be unable to update it? The status code 0xc0000034 resolves to "Object Name not found". Thanks. Update 2011-04-09 - I have only seen Event 3024 new installations of Windows 7 Enterprise with SP1. This event is not coincident with a driver being installed or updated. Rather, it seems to occur at some interval after Windows setup completes, or is generated by a scheduled task running that tries to update the boot catalog cache file. I have not been able to pin down either of these scenarios. This event is a warning, as opposed to an error, event. It does not prevent the computer from booting successfully after it has occurred.

Hi sejong, Thanks for posting in TechNet Forum. The Code Integrity checks each kernel-mode driver for a digital signature when an attempt is made to load the driver into memory. If the kernel-moder driver is not signed, the operating system might not load it. If a kernel debugger is attached to the computer, Code Integrity still checks for a digital signature on every kernel-mode driver, but the operating system will load the drivers. The bootcat.cache file is a cache file when you boot the computer. Based on your description, I recommend you open the Device Manager, and update your hardware device driver to the latest one. Since the system is stable, don't worry about this event. Regards, Miya TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com This posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Miya Yao- Thanks for your reply and suggstions. Since my original post, I have discovered some additional information. 1. sigverif returns "Your files have been scanned and verified as digitially signed", 2. sfc /scannow returns "Windows Resource Protection did not find any integrity violations". 3. Event 3024 is not documented in the list of Code Integrity events at http://msdn.microsoft.com/en-us/library/ff539915(v=vs.85).aspx, which is dated 2010-11-16. All the published Code Integrity events text begin with "Code Integrity..." and are either Error or Verbose events. Event 3024's text begins with "Windows...: and it is a Warning event. All of this suggests that Event 3024 is newer than that documentation. 4. The trigger for Event 3024 seems to be SearchIndexer.exe (the Windows Search service), which acceses C:\Windows\system32\CodeIntegrity about 10 minutes after the operating system starts. Update: this is incorrect - Event 3024 occurs even when the Windows Search service is stoppped and disabled. I agree that Event 3024 is not something to worry about. However, it would be good to update the published documentation on Code Integrity events to include it.

Hi sejong, Thanks for the update and suggestion. You can delete this bootcat.cache file and then restart the computer. It will avoid that Event 3024, and you will get a updated file later. Regards, Miya TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com This posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thanks, Miya Yao. Your suggestion about deleting bootcat.cache and then restarting did eliminate Event 3024.

Hi sejong, You're welcome. Glad it works. Regards, Miya TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.comThis posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.