EventID 28 error

Patrick 36 Reputation points
2022-10-14T20:29:06.57+00:00

I get these errors consistently. What app or hardware is causing it?

Error setting traits on Provider {77811378-e885-4ac2-a580-bc86e4f1bc93}. Error: 0xC0000005

250673-error-28.jpg

Windows 11
Windows 11
A Microsoft operating system designed for productivity, creativity, and ease of use.
8,218 questions

13 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. S.Sengupta 15,191 Reputation points MVP
    2022-10-15T00:35:06.047+00:00

    This could be due to a badly installed version of WMI, WMI repository upgrade failure, insufficient disk space or insufficient memory.

    Check it here:

    Event ID - 28

    1 person found this answer helpful.
  2. ScepticalSara 6 Reputation points
    2022-12-16T16:16:54.097+00:00

    I THINK I PROBLEM HAVE SAME ISSUE. THIS PROBLEM OCCURS WHEN IM USING HYPER VM. MY HYPER VIRTUAL MACHINE WAS PAUSED AT THAT TIME, HYperVM Virtual Switcher went wrong ealier than this problem occued.PID was isolated to LsaIso.exe, WHICH IS Highly RELATIVE TO MICROSOFT CREDENTIAL GUARD SERVICE. THEN I GET MY COMPUTER LOST OF VIDEO SIGNAL BUT STILL WITH MUSIC PLAYING BACKGROUND. MY LAPTOP WAS LENOVO ThinkBook16P Gen2, AMD 5800H,RTX 3060 Laptop,24Gigs of RAM and 37Gigs of Virtual Memory.

    1 person found this answer helpful.
  3. Shura 1 Reputation point
    2022-10-21T07:43:47.773+00:00

    Identical error, windows 11 Pro. What motherboard do you have?

  4. Zbyte 1 Reputation point
    2022-11-05T22:01:57.52+00:00

    Same exact error

    "logman query providers | findstr 77811378"

    Came back empty

  5. MotoX80 31,656 Reputation points
    2022-11-06T21:48:10.067+00:00

    Take a look at this. Is anyone running credential guard?

    https://answers.microsoft.com/en-us/windows/forum/all/event-28-kernel-eventtracing-event-6147-event-6155/cb486a5c-ae2a-4c5a-92b1-5ca61fca3532

    If you look at the XML view of the event, do you see a line similar to the one that the user reported? 

     <Execution ProcessID="1032" ThreadID="1036" />

    In the task manager details tab, look to see what program is the PID in your event. If you see a common name like svchost, right click and select "Go to services" to see what it's hosting. Is it always the same PID? Same process name?

    I'm also wondering if some other event is logged at the same time as the 28 event. Here's my RecentEvents.ps1 Powershell script that reads events from all event logs and sorts by TOD.

    https://learn.microsoft.com/en-us/answers/questions/102481/eventlog-madness.html

    Look for the 28 events and see if there is some other event that consistently occurs around the same time. The hope is that it will point us to root cause of the event.
    .