Help with some errors

Drakon · Jan 22, 2005, 08:09 PM

Ok, i seem to be getting these 2 errors when windows boots up for some reason, but i have no clue what's causes them and how to fix them. can anyone help?

This error is in the Application log in Event Viewer:

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 1/22/2005
Time: 7:51:32 PM
User: NT AUTHORITY\SYSTEM
Computer: DIGITAL_FORTRES
Description:
Windows saved user DIGITAL_FORTRES\DrAk0n registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.
This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Details
Product: Windows Operating System
ID: 1517
Source: Userenv
Version: 5.2
Symbolic Name: EVENT_HIVE_SAVED
Message: Windows saved user %1 registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.
This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

Explanation
Windows unloads each user's profile and user's section of the registry when the user logs off. This message indicates that Windows could not unload the user's profile because a program was referencing the user's section of the registry. This locked the profile. The registry cannot unload profiles that are locked and in use. When the program that is locking the profile is no longer referencing the registry, the profile will be unloaded.

User Action
No user action is required.
_________________________________
I had tried to change my computer name last nite, don't know if that was the cause of this error.

This next error is in System log in Event Viewer:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 1/22/2005
Time: 7:52:50 PM
User: N/A
Computer: DIGITAL_FORTRES
Description:
The PfModNT service failed to start due to the following error:
The system cannot find the file specified.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Details
Product: Windows Operating System
ID: 7000
Source: Service Control Manager
Version: 5.0
Symbolic Name: EVENT_SERVICE_START_FAILED
Message: The %1 service failed to start due to the following error:
%2.

Explanation
Service Control Manager (SCM) could not start the specified service, probably because the service is not configured correctly.

User Action
Do one or all of the following:
Review the error information displayed in the message.
Verify that the service password has not expired.
Verify that the service is in the correct location.
Verify that the service is not infected with a virus.
To display the WIN32_EXIT_CODE error that SCM encountered when trying to start the program, at the command prompt, type
sc query service name
The information displayed can help you troubleshoot possible causes for the error.
If the WIN32_EXIT_CODE is zero, then SCM did not attempt to start the service because the error was detected first.

Version: 5.2
Symbolic Name: EVENT_SERVICE_START_FAILED
Message: The %1 service failed to start due to the following error:
%2

Explanation
Service Control Manager (SCM) could not start the specified service, probably because the service is not configured correctly.

User Action
Do one or all of the following:
Review the error information displayed in the message.
Verify that the service password has not expired.
Verify that the service is in the correct location.
Verify that the service is not infected with a virus.
To display the WIN32_EXIT_CODE error that SCM encountered when trying to start the program, at the command prompt, type
sc query service name
The information displayed can help you troubleshoot possible causes for the error.
If the WIN32_EXIT_CODE is zero, then SCM did not attempt to start the service because the error was detected first.
______________________________________

PangingJr · Jan 22, 2005, 08:26 PM

for Event ID: 1517 Source: Userenv
Troubleshooting profile unload issues
http://support.microsoft.com/kb/837115

-Or-

PRB: Warning Error 1517 in Event Viewer after First Restart
http://support.microsoft.com/default...s;810616&sd=ee

--

for Event ID: 7000 Event Source: Service Control Manager
"Event ID: 7000" or "Event ID: 7013" Error Message When You Attempt to Start a Service
http://support.microsoft.com/default...&Product=winxp

Drakon · Jan 22, 2005, 08:54 PM

thanks net...

PangingJr · Jan 22, 2005, 08:58 PM

No problem

Drakon · Jan 29, 2005, 03:24 PM

Quote:

On a Local Computer

If the user is on a stand-alone Windows XP-based computer, follow these steps: 1.Log on to the computer as administrator or as a member of the Administrators group.2.Start the Local Computer Policy snap-in.3.Expand Local Computer Policy, expand Computer Configuration, expand Windows Settings, and then expand Security Settings. 4.Expand Local Policies, and then click User Rights Assignment.5.In the right pane, right-click Log on as a service, and then click Properties.6.Click Add User or Group, add the user that you want to the policy, and then click OK twice.7.Close the Local Computer Policy snap-in.

Hey Net, I'm a little confused by this. could u help?

It's a solution for this error:

Quote:

for Event ID: 7000 Event Source: Service Control Manager
"Event ID: 7000" or "Event ID: 7013" Error Message When You Attempt to Start a Service

I don't even know what service is causing the error

PangingJr · Jan 29, 2005, 04:08 PM

Quote:

Originally Posted by Drakon

The "PfModNT" service failed to start

check in your WINDOWS\system32\drivers folder for a driver named "pfmodnt.sys" and pls reply me whether or not you have this file ?

----

Open up the Local Security Settings snap-in,
Start ->Run and type secpol.msc

then skip the steps 1-3, continue with the steps 4-7.

PangingJr · Jan 29, 2005, 04:41 PM

if you can't find the "pfmodnt.sys" in the drivers folder, search your C drive for this file.
can you locate it ?

if you can't find it forget about adding the user name in the Security Settings part, for now.

go to Start ->Run ->regedit

then locate this registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es

then R-click on the "Services" folder and select "Export",
enter "Services_backup.reg" in the File name: box, then save the file as your backup for the Services registry key.

i might have to try to remove the service from your registry and see. after i've some more info from you. later.

Drakon · Jan 29, 2005, 06:03 PM

i found the file, net. it also appears to be part of my sound blaster audigy2 zs drivers...

so what do I do now?

PangingJr · Jan 30, 2005, 01:16 AM

is this file located in \system32\drivers folder ?

Open Device Manager (type devmgmt.msc in open Run box and ENTER.)
click View and select Show hidden devices...
then expand the node Non-PnP Drivers...
see if the service "PfModNT" listed under that ??.

----

and then try... Open up the Local Security Settings snap-in,
Start ->Run and type secpol.msc
then press ENTER.

follow the above steps, but to skip the steps 1-3, continue with the steps 4-7.

4.Expand Local Policies ->User Rights Assignment.......... 6. Click Add User or Group -> Advanced.. ->Find Now, then highlight your windows log in name then click OK 2 times.

then reboot your PC and see.