Keep getting this event 1001, windows error reporting fault bucket.  No idea what driver or app is causing this problem. Thank you for any help you can provide!

Fault bucket -824565334, type 5
Event Name: AEAPPINVW8
Response: Not available
Cab Id: 0

Problem signature:
P1: 101
P2: 2
P3: 6.3.0.0
P4: 1033
P5: 68
P6:
P7:
P8:
P9:
P10:

Attached files:

These files may be available here:


Analysis symbol:
Rechecking for solution: 0
Report Id: b09aeac4-7cdc-11e3-bea8-d850e605b79c
Report Status: 0
Hashed bucket: 6c3ac182050ca55d3e62cebf74de99f8

<Event xmlns="">
- <System>
  <Provider Name="Windows Error Reporting" />
  <EventID Qualifiers="0">1001</EventID>
  <Level>4</Level>
  <Task>0</Task>
  <Keywords>0x80000000000000</Keywords>
  <TimeCreated SystemTime="2014-01-14T05:28:26.000000000Z" />
  <EventRecordID>3823</EventRecordID>
  <Channel>Application</Channel>
  <Computer>ANewPC</Computer>
  <Security />
  </System>
- <EventData>
  <Data>-824565334</Data>
  <Data>5</Data>
  <Data>AEAPPINVW8</Data>
  <Data>Not available</Data>
  <Data>0</Data>
  <Data>101</Data>
  <Data>2</Data>
  <Data>6.3.0.0</Data>
  <Data>1033</Data>
  <Data>68</Data>
  <Data />
  <Data />
  <Data />
  <Data />
  <Data />
  <Data />
  <Data />
  <Data />
  <Data>0</Data>
  <Data>b09aeac4-7cdc-11e3-bea8-d850e605b79c</Data>
  <Data>0</Data>
  <Data>6c3ac182050ca55d3e62cebf74de99f8</Data>
  </EventData>
  </Event>

Please provide us with your Event Viewer administrative logs by following these steps:
*
Click Start Menu
Type eventvwr into Search programs and files (do not hit enter)
Right click eventvwr.exe and click Run as administrator
Expand Custom Views
Click Administrative Events
Right click Administrative Events
Save all Events in Custom View As...
Save them in a folder where you will remember which folder and save as Errors.evtx
Go to where you saved Errors.evtx
Right click Errors.evtx -> send to -> compressed (zipped) folder
Upload the .zip file to skydrive or a file sharing service and put a link to it in your next post * If you have updated to win 8.1 and you get the error message "the system cannot find the file specified" it is a known problem.  The work around is to edit the registry.  If you are not comfortable doing this DONT.  If you are, backup the key before you do Press Win+"R" and input regedit
Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels. Delete "Microsoft-Windows-DxpTaskRingtone/Analytic"

The only administrative event that I keep getting is this one:

The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

This appears related to the Weather app and other metro apps (which I tried to re-install).  I've seen people suggest a bunch of different ways to fix the permissions but I've been hesitant until I see an official response, something to do with Immersive Shell in component services.  Interestingly, when I open component services and go to Dcom config, I get asked:

The CLSID {5775505C-9EF1-11D4-AE46-0080BD080808} item "C:Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe" and title BTSecurityCallback Class has named value AppID, but is not recorded under \\HKEY_CLASSES_ROOT\AppId. Do you wish to record it?

Do you think these events are related and what do you suggest? I appreciate your response!

Venomous21

As JMH3143 suggests we need the event viewer logs to investigate.  Taking one item out of context would be only a guess.  Something JMH & I don't do.

I already applied the above registry change and followed your instructions to extract the event log.  Please, download the file at the below link with password: microsoftevents

http://www.megafileupload.com/en/file/488245/errors-zip.html

I look forward to your response! Thank you!

When this happens, I am usually away from the computer or don't notice the problem when it happens.  I receive no pop-ups or errors except for what is in the event logs.

This may help:

Right after the fault bucket occurs, at exactly the same second, these three events are logged everytime:

1)event 102 ESENT
svchost (4292) Instance: The database engine (6.03.9600.0000) is starting a new instance (0).
2)event 105 ESENT
svchost (4292) Instance: The database engine started a new instance (0). (Time=0 seconds)
 Internal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.000, [4] 0.016, [5] 0.000, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000.
3)event 326 ESENT
svchost (4292) Instance: The database engine attached a database (1, C:\ProgramData\Microsoft\Windows\AppRepository\PackageRepository.edb). (Time=0 seconds) Internal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.000, [4] 0.000, [5] 0.000, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000, [11] 0.000, [12] 0.000.
Saved Cache: 1 0

Then exactly 5 minutes later, these two events are recorded:

1)event 327 ESENT
svchost (4292) Instance: The database engine detached a database (1, C:\ProgramData\Microsoft\Windows\AppRepository\PackageRepository.edb). (Time=0 seconds) Internal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.000, [4] 0.000, [5] 0.000, [6] 0.015, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000, [11] 0.000, [12] 0.000.
Revived Cache: 0 0
2)event 103 ESENT
svchost (4292) Instance: The database engine stopped the instance (0).
 Dirty Shutdown: 0
 Internal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.000, [4] 0.000, [5] 0.000, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000, [11] 0.000, [12] 0.000, [13] 0.000, [14] 0.000, [15] 0.000.

I checked scheduled tasks and found these tasks occur at -exactly- the same time:

Windows > Memory Diagnostics > ProcessMemoryDiagnosticEvents > The operator or administrator has refused the request (0x800710E0)
Windows  > Memory Diagnostics > RunFullMemoryDiagnostics > The process terminated unexpectedly (0x8007042B)

Windows > Servicing > StartComponentCleanup The last run was terminated by the user (0x41306)

Windows > TaskScheduler > Regular Maintenance The process terminated unexpectedly (0x8007042B)

Windows > Time Synchronization > Synchronize (0x420)

Windows > WS > License Validation The operation completed successfully (0x0)

Any assistance is appreciated! Thank you!!

Venomous21

The title of this thread includes event ID 1001.  The only event ID 1001 in this event viewer log is a DHCP (see snip)

The only ESNTS are warnings not errors.

What is the specific issue you are chasing?

I only sent over the administrative events log, I thought that's all you needed.  I should have sent the App and System logs too, is there anyway to export those into one file?  The app log contains the fault buckets.

I may have a temporary resolution to this issue but I am going to continue to monitor it.  I don't use bluetooth and as such, have the bluetooth service 'off' in PC Settings on this computer (the slider bar). 

In Task Manager > Startup (basically the new msconfig) - there was an entry for the bluetooth tray and as a subset rundll32.exe that was still running even though I disabled bluetooth in Pc Settings.  I disabled this start-up item and rebooted and for at least the last 12+ hours, have not got a fault bucket crash after the Esent stuff runs in the App logs.  No clue why that triggered it before.  It's possible I've been lucky and I could get a crash later.  If I do or don't, I'll let you know.

Assuming it is fixed, I do plan to get a bluetooth keyboard at some point.  I'm going to uninstall the bluetooth drivers and install the latest ones and hopefully, that will fix the error. I upgraded from windows 8.0 to 8.1 and it appears that causes a lot of issues for people.  I may clean install 8.1 some point soon since that would probably fix these issues.

Please, keep this thread open while I investigate further.  If I get another fault bucket error, I'll go ahead and post the app logs in a zip file.

Thank you!

• Marked as answer by Venomous21 5 hours 23 minutes ago

I only sent over the administrative events log, I thought that's all you needed.  I should have sent the App and System logs too, is there anyway to export those into one file?  The app log contains the fault buckets.

I may have a temporary resolution to this issue but I am going to continue to monitor it.  I don't use bluetooth and as such, have the bluetooth service 'off' in PC Settings on this computer (the slider bar). 

In Task Manager > Startup (basically the new msconfig) - there was an entry for the bluetooth tray and as a subset rundll32.exe that was still running even though I disabled bluetooth in Pc Settings.  I disabled this start-up item and rebooted and for at least the last 12+ hours, have not got a fault bucket crash after the Esent stuff runs in the App logs.  No clue why that triggered it before.  It's possible I've been lucky and I could get a crash later.  If I do or don't, I'll let you know.

Assuming it is fixed, I do plan to get a bluetooth keyboard at some point.  I'm going to uninstall the bluetooth drivers and install the latest ones and hopefully, that will fix the error. I upgraded from windows 8.0 to 8.1 and it appears that causes a lot of issues for people.  I may clean install 8.1 some point soon since that would probably fix these issues.

Please, keep this thread open while I investigate further.  If I get another fault bucket error, I'll go ahead and post the app logs in a zip file.

Thank you!

• Marked as answer by Venomous21 Wednesday, January 15, 2014 6:25 AM
• Unmarked as answer by Venomous21 14 hours 19 minutes ago

Still getting the error listed in my first post at the top of this thread.  I checked task scheduler again and everything completed successfully except one thing, could this be the culprit??

Task Scheduler > Microsoft > Windows > MemoryDiagnostic contains two scheduled events:

1) ProcessMemoryDiagnosticEvents Ready Multiple Triggers defined Last run time (when the error occurred) Last Run Result: The operator or administrator has refused the request (0x800710E0) **seems odd that it was refused.  It says it is set to "run only when user is logged on" -- should I perhaps change this to "run whether user is logged on or not"? "run with highest privileges is checked" It says it will only be triggered by event ID 1000, 1801, and 6.  EventID 1001 windows error reporting is logged as the error with no-pop up and the information in the first post of this thread above.

2) RunFullMemoryDiagnostic Ready LastRun(when the error occurred) The Operation completed successfully (0x0)

Why would operation 1 fail but operation 2 succeed? I'm beginning to think this may be the cause of this error since the information logged by event viewer is so cryptic e.g. P1 101 P2 2 P3 6.3.0.0 etc.

Please, let me know your thoughts. Thank you!

This error occurs about 1x per day when a ton of scheduled tasks start, like 20+ start at the exact same time.  The only scheduled task that fails is the one I listed above.  AFAIK, I don't see any noticeable performance or stability problems when this error occurs but it just bothers me that I have this fault bucket occur every day.  I really think it is tied into one of the scheduled tasks.