System event log get thousand events - UserModePowerService

Salka, Milan 21 Reputation points
2024-03-11T08:37:17.3933333+00:00

Hello,

On notebook - So far, everything looks and feels good, but the system event log is showing multiple UserModePowerService events, ID 12. This happens a few times a second, then every few seconds, generating hundreds of events. Message generated by this event:

Process C:\Windows\System32\WUDFHost.exe (process ID:1656) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e}

The event happen when the laptop is powered from its power supply (no other investigation).

How can be possible to set up in the system to find app (who is calling process WUDFHost.exe), which generate/trigger this event, please?

Tested solutions mentioned at https://www.reddit.com/r/DellXPS/comments/tzbil... - but not helpful.

Contacted Intel - answered "the events viewer entries you are seeing cannot be tied to a specific Intel component...".

Intel DDT unistalled, system restarted, and events still created in event viewer...

For that reason I am asking for help to find the sw tool (with description) how may I find core reason - who is triggering this event.

Thank you.

Overview of events example is attached in screenshot.

Image

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,735 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Wesley Li 4,505 Reputation points
    2024-03-13T05:48:05.9566667+00:00

    Hello

    The process WUDFHost.exe is associated with the Windows User Mode Driver Framework (WUDF) and is responsible for managing user-mode drivers.

     

    The event you’re seeing, where the WUDFHost.exe process resets the policy scheme, is likely related to a driver or service on your system. However, identifying the exact driver or service causing these events can be challenging as multiple drivers can be loaded onto the WUDFHost.exe process.

     

    Here are some steps you can take to investigate further:

     

    Check Running Services: Open Task Manager, go to the Processes tab, then right-click any column header and turn on the Command line column. In that column, you may be able to see what process is loaded on WUDFHost.exe.

    [WUDFHost.exe (User-mode Driver Framework Host Process) accessed my - Microsoft Community](https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fanswers.microsoft.com%2Fen-us%2Fwindows%2Fforum%2Fall%2Fwudfhostexe-user-mode-driver-framework-host%2F15d68fb0-bd25-42de-8e94-27fcb9e51dee&data=05%7C02%7Cwesleyl%40wicresoft.com%7C45577e500c754601a4fe08dc43200999%7Cb2ae8dd9097749768706861b488b1512%7C0%7C0%7C638459052227346494%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=lfKZvd0Nx8QenYlhfW4xrAXoiBoAm5IH7NhqHPauLlI%3D&reserved=0"原始 URL: https://answers.microsoft.com/en-us/windows/forum/all/wudfhostexe-user-mode-driver-framework-host/15d68fb0-bd25-42de-8e94-27fcb9e51dee。如果你信任此链接, 请单击或点击。")

     

    Clean Boot: Perform a clean boot to start Windows with a minimal set of drivers and startup programs. This can help you identify if the issue is being caused by a third-party application or service.

     

    Event Viewer: Use Event Viewer to inspect the detailed properties of the event. This might give you more information about the source of the event.

     

    Software Tools: There are software tools available that can monitor and report on system events and processes. These might help you identify the source of the events. However, please be aware that these tools should be used with caution and only downloaded from reputable sources.

     

    While these events might be annoying, they are not necessarily indicative of a problem with your system. If your system is running normally and you’re not experiencing any issues, these events might be safely ignored.

    [Question about Driver Event History - Microsoft Community](https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fanswers.microsoft.com%2Fen-us%2Fwindows%2Fforum%2Fall%2Fquestion-about-driver-event-history%2F729fe6d6-6c0e-4b85-b29d-1568503af475&data=05%7C02%7Cwesleyl%40wicresoft.com%7C45577e500c754601a4fe08dc43200999%7Cb2ae8dd9097749768706861b488b1512%7C0%7C0%7C638459052227359495%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=h3DCEDIZscIRGi2NosITjAhEilSg7s9T%2BDS6%2BX8ChhQ%3D&reserved=0"原始 URL: https://answers.microsoft.com/en-us/windows/forum/all/question-about-driver-event-history/729fe6d6-6c0e-4b85-b29d-1568503af475。如果你信任此链接, 请单击或点击。")

    0 comments No comments