Share via

In Vista, Event Viewer shows "An attempt was made to unregister a security event source."

Anonymous
2011-05-17T17:20:42+00:00

NEED SOME HELP

PC was running high so I checked my event viewer. I do not think this was the problem, but it is odd to me!

Maybe it is normal

Thanks

Log Name:      Security

Source:        Microsoft-Windows-Security-Auditing

Date:          5/17/2011 6:19:13 AMEvent ID:      4905

Task Category: Audit Policy Change

Level:         Information

Keywords:      Audit Success

User:          N/A

Computer:      ********-PC

Description:

An attempt was made to unregister a security event source.

Subject

 Security ID:  SYSTEM

 Account Name:  *******-PC$

 Account Domain:  WORKGROUP

 Logon ID:  0x3e7

Process:

 Process ID: 0x470

 Process Name: C:\Windows\System32\VSSVC.exe

Event Source:

 Source Name: VSSAudit

 Event Source ID: 0x7cec0d

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

    <EventID>4905</EventID>

    <Version>0</Version>

    <Level>0</Level>

    <Task>13568</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8020000000000000</Keywords>

    <TimeCreated SystemTime="2011-05-17T10:19:13.867Z" />

    <EventRecordID>167</EventRecordID>

    <Correlation />

    <Execution ProcessID="692" ThreadID="836" />

    <Channel>Security</Channel>

    <Computer>*******-PC</Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="SubjectUserSid">S-1-5-18</Data>

    <Data Name="SubjectUserName">******-PC$</Data>

    <Data Name="SubjectDomainName">WORKGROUP</Data>

    <Data Name="SubjectLogonId">0x3e7</Data>

    <Data Name="AuditSourceName">VSSAudit</Data>

    <Data Name="EventSourceId">0x7cec0d</Data>

    <Data Name="ProcessId">0x470</Data>

    <Data Name="ProcessName">C:\Windows\System32\VSSVC.exe</Data>

  </EventData>

</Event>

THIS WAS BEFORE

Log Name:      Security

Source:        Microsoft-Windows-Security-Auditing

Date:        5/17/2011 6:18:14 AMEvent ID:      4672

Task Category: Special Logon

Level:         Information

Keywords:      Audit Success

User:          N/A

Computer:      ******-PC

Description:

Special privileges assigned to new logon.

Subject:

 Security ID:  SYSTEM

 Account Name:  SYSTEM

 Account Domain:  NT AUTHORITY

 Logon ID:  0x3e7

Privileges:  SeAssignPrimaryTokenPrivilege

   SeTcbPrivilege

   SeSecurityPrivilege

   SeTakeOwnershipPrivilege

   SeLoadDriverPrivilege

   SeBackupPrivilege

   SeRestorePrivilege

   SeDebugPrivilege

   SeAuditPrivilege

   SeSystemEnvironmentPrivilege

   SeImpersonatePrivilege

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

    <EventID>4672</EventID>

    <Version>0</Version>

    <Level>0</Level>

    <Task>12548</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8020000000000000</Keywords>

    <TimeCreated SystemTime="2011-05-17T10:18:14.041Z" />

    <EventRecordID>165</EventRecordID>

    <Correlation />

    <Execution ProcessID="692" ThreadID="1852" />

    <Channel>Security</Channel>

    <Computer>*******-PC</Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="SubjectUserSid">S-1-5-18</Data>

    <Data Name="SubjectUserName">SYSTEM</Data>

    <Data Name="SubjectDomainName">NT AUTHORITY</Data>

    <Data Name="SubjectLogonId">0x3e7</Data>

    <Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege

   SeTcbPrivilege

   SeSecurityPrivilege

   SeTakeOwnershipPrivilege

   SeLoadDriverPrivilege

   SeBackupPrivilege

   SeRestorePrivilege

   SeDebugPrivilege

   SeAuditPrivilege

   SeSystemEnvironmentPrivilege

   SeImpersonatePrivilege</Data>

  </EventData>

</Event>

Windows for home | Previous Windows versions | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

Answer accepted by question author

Anonymous
2011-05-18T11:53:03+00:00

Hi dwanachitchat,

Let’s follow these methods and check if the issue persists.

Method 1

You may configure the computer in clean boot and check the performance of the computer.  It will start Windows Vista by using a minimal set of drivers and startup programs and helps to eliminate software conflicts.

The following link has steps showing how to perform clean boot: http://support.microsoft.com/kb/929135

Note: Please ensure that the computer is set to start as usual by following the step 7 from the article: How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows7: http://support.microsoft.com/kb/929135

Method 2

You may run system file checker [SFC] scan on the computer which will replace the missing or corrupt files & check if the issue persists.

a. Type ‘cmd’ in the Start Search box. Right click on cmd in the Program list and then select the option Run as administrator.

Note: If you are prompted for an administrator password or for confirmation, type your password, or click Continue.

b. Type the following command, and then press ENTER:

sfc /scannow

For more information refer this link.

How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7

Hope the information helps.

Please post back and let us know.

Was this answer helpful?

0 comments No comments

0 additional answers

Sort by: Most helpful