Da quando ho cambiato pc il pc continua a riavviarsi,ho controllato tutti gl'hardware e funzionano normalmente,quindi ora vorrei controllare windows,ma sfogliando il registro di windows non ho capito niente,quindi chiedo il vostro aiuto.
grazie
DA QUI LISTERO TUTTI GL' EVENTI SIMILI CHE PRECEDONO L' EVENTO KERNEL 41(63) (sono tutti di livello informativo),DA DUE CASI DI OGGI:
EVENT 41:
Nome registro: System
Origine: Microsoft-Windows-Kernel-Power
Data: 30/01/2019 16:53:17
ID evento: 41
Categoria attività:(63)
Livello: Critico
Parole chiave: (70368744177664),(2)
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Riavvio del sistema senza un regolare arresto. Questo errore può essere causato da un'interruzione, un arresto anomalo o un'interruzione dell'alimentazione imprevista del sistema.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" />
<EventID>41</EventID>
<Version>6</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000400000000002</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:17.094424100Z" />
<EventRecordID>2096</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BugcheckCode">0</Data>
<Data Name="BugcheckParameter1">0x0</Data>
<Data Name="BugcheckParameter2">0x0</Data>
<Data Name="BugcheckParameter3">0x0</Data>
<Data Name="BugcheckParameter4">0x0</Data>
<Data Name="SleepInProgress">0</Data>
<Data Name="PowerButtonTimestamp">0</Data>
<Data Name="BootAppStatus">0</Data>
<Data Name="Checkpoint">41</Data>
<Data Name="ConnectedStandbyInProgress">false</Data>
<Data Name="SystemSleepTransitionsToOn">2</Data>
<Data Name="CsEntryScenarioInstanceId">0</Data>
<Data Name="BugcheckInfoFromEFI">false</Data>
<Data Name="CheckpointStatus">0</Data>
</EventData>
</Event>
EVENT 6:
Nome registro: System
Origine: Microsoft-Windows-FilterManager
Data: 30/01/2019 16:53:16
ID evento: 6
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Caricamento del filtro del file system 'npsvctrig' (10.0, 2037-02-23T07:11:04.000000000Z) e registrazione con Gestione filtri riusciti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{f3c5e28e-63f6-49c7-a204-e48a1bc4b09d}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:16.617828300Z" />
<EventRecordID>2095</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">9</Data>
<Data Name="DeviceName">npsvctrig</Data>
<Data Name="DeviceTime">2037-02-23T07:11:04.000000000Z</Data>
</EventData>
</Event>
EVENT ID 6:(2nd volta)
Nome registro: System
Origine: Microsoft-Windows-FilterManager
Data: 30/01/2019 16:53:16
ID evento: 6
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Caricamento del filtro del file system 'FileCrypt' (10.0, 2034-08-13T15:30:12.000000000Z) e registrazione con Gestione filtri riusciti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{f3c5e28e-63f6-49c7-a204-e48a1bc4b09d}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:16.541774500Z" />
<EventRecordID>2094</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">9</Data>
<Data Name="DeviceName">FileCrypt</Data>
<Data Name="DeviceTime">2034-08-13T15:30:12.000000000Z</Data>
</EventData>
</Event>
EVENT ID:98
Nome registro: System
Origine: Microsoft-Windows-Ntfs
Data: 30/01/2019 16:53:16
ID evento: 98
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave: (2)
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Volume C: (\Device\HarddiskVolume4) è integro. Non è necessario eseguire alcuna operazione.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Ntfs" Guid="{3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482}" />
<EventID>98</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000002</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:16.479681600Z" />
<EventRecordID>2093</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="396" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="DriveName">C:</Data>
<Data Name="DeviceName">\Device\HarddiskVolume4</Data>
<Data Name="CorruptionActionState">0</Data>
</EventData>
</Event>
EVENT ID 6:(3rd volta)
Nome registro: System
Origine: Microsoft-Windows-FilterManager
Data: 30/01/2019 16:53:11
ID evento: 6
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Caricamento del filtro del file system 'WdFilter' (10.0, 2076-07-13T02:11:44.000000000Z) e registrazione con Gestione filtri riusciti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{f3c5e28e-63f6-49c7-a204-e48a1bc4b09d}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:11.821513500Z" />
<EventRecordID>2092</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">8</Data>
<Data Name="DeviceName">WdFilter</Data>
<Data Name="DeviceTime">2076-07-13T02:11:44.000000000Z</Data>
</EventData>
</Event>
EVENT ID 6:(4th volta)
Nome registro: System
Origine: Microsoft-Windows-FilterManager
Data: 30/01/2019 16:53:11
ID evento: 6
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Caricamento del filtro del file system 'Wof' (10.0, 1988-11-15T00:36:29.000000000Z) e registrazione con Gestione filtri riusciti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{f3c5e28e-63f6-49c7-a204-e48a1bc4b09d}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:11.820869200Z" />
<EventRecordID>2091</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">3</Data>
<Data Name="DeviceName">Wof</Data>
<Data Name="DeviceTime">1988-11-15T00:36:29.000000000Z</Data>
</EventData>
</Event>
EVENT ID 6:(5th volta)
Nome registro: System
Origine: Microsoft-Windows-FilterManager
Data: 30/01/2019 16:53:11
ID evento: 6
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Caricamento del filtro del file system 'FileInfo' (10.0, 2041-01-31T08:18:31.000000000Z) e registrazione con Gestione filtri riusciti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{f3c5e28e-63f6-49c7-a204-e48a1bc4b09d}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:11.820396500Z" />
<EventRecordID>2090</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">8</Data>
<Data Name="DeviceName">FileInfo</Data>
<Data Name="DeviceTime">2041-01-31T08:18:31.000000000Z</Data>
</EventData>
</Event>
EVENT ID 20(6):
Nome registro: System
Origine: Microsoft-Windows-Kernel-General
Data: 30/01/2019 16:53:10
ID evento: 20
Categoria attività:(6)
Livello: Informazioni
Parole chiave: Time
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Configurazione secondo intercalare aggiornata.
Motivo: Leap second data initialized from registry during boot
Secondi intercalare abilitati: true
Conteggio nuovo secondo intercalare: 0
Conteggio precedente secondo intercalare: 0
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-General" Guid="{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}" />
<EventID>20</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>6</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.832893200Z" />
<EventRecordID>2089</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="UpdateReason">0</Data>
<Data Name="EnabledNew">true</Data>
<Data Name="CountNew">0</Data>
<Data Name="CountOld">0</Data>
</EventData>
</Event>
EVENT ID 30(21)
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 30
Categoria attività:(21)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Il firmware ha comunicato le metriche di avvio.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>30</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>21</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824958100Z" />
<EventRecordID>2088</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="ResetEndStart">0</Data>
<Data Name="LoadOSImageStart">16757</Data>
<Data Name="StartOSImageStart">18716</Data>
<Data Name="ExitBootServicesEntry">21197</Data>
<Data Name="ExitBootServicesExit">21201</Data>
</EventData>
</Event>
EVENT ID 32(58):
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 32
Categoria attività:(58)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Il file bootmgr ha atteso l'input dell'utente per 0 minuti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>32</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>58</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824885400Z" />
<EventRecordID>2087</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BitlockerUserInputTime">0</Data>
</EventData>
</Event>
EVENT ID 18(57):
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 18
Categoria attività:(57)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Nel sistema sono presenti 0x1 opzioni di avvio.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>18</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>57</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824865300Z" />
<EventRecordID>2086</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="EntryCount">1</Data>
</EventData>
</Event>
EVENT ID 27(33)
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 27
Categoria attività:(33)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Tipo di avvio: 0x0.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>27</EventID>
<Version>1</Version>
<Level>4</Level>
<Task>33</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824808700Z" />
<EventRecordID>2085</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BootType">0</Data>
<Data Name="LoadOptions"> NOEXECUTE=OPTIN</Data>
</EventData>
</Event>
EVENT ID 25(32):
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 25
Categoria attività:(32)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Criteri del menu di avvio: 0x1.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>25</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>32</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824808400Z" />
<EventRecordID>2084</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BootMenuPolicy">1</Data>
</EventData>
</Event>
EVENT ID 20(31)
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 20
Categoria attività:(31)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Ultimo stato di arresto riuscito: false. Ultimo stato di avvio riuscito: true.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>20</EventID>
<Version>1</Version>
<Level>4</Level>
<Task>31</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824760700Z" />
<EventRecordID>2083</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="LastShutdownGood">false</Data>
<Data Name="LastBootGood">true</Data>
<Data Name="LastBootId">14</Data>
<Data Name="BootStatusPolicy">2</Data>
</EventData>
</Event>
EVENT ID 153(62):
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 153
Categoria attività:(62)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
La sicurezza basata sulla virtualizzazione (criteri: 0) è disabled.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>153</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>62</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824682000Z" />
<EventRecordID>2082</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Status">0</Data>
<Data Name="EnableDisableReason">0</Data>
<Data Name="VsmPolicy">0</Data>
</EventData>
</Event>
EVENT ID 12(1)
Nome registro: System
Origine: Microsoft-Windows-Kernel-General
Data: 30/01/2019 16:53:10
ID evento: 12
Categoria attività:(1)
Livello: Informazioni
Parole chiave: (128)
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Sistema operativo avviato all'ora di sistema 2019-01-30T15:53:10.500000000Z.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-General" Guid="{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}" />
<EventID>12</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>1</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000080</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824629000Z" />
<EventRecordID>2078</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="MajorVersion">10</Data>
<Data Name="MinorVersion">0</Data>
<Data Name="BuildVersion">17763</Data>
<Data Name="QfeVersion">253</Data>
<Data Name="ServiceVersion">0</Data>
<Data Name="BootMode">0</Data>
<Data Name="StartTime">2019-01-30T15:53:10.500000000Z</Data>
</EventData>
</Event>
grazie
DA QUI LISTERO TUTTI GL' EVENTI SIMILI CHE PRECEDONO L' EVENTO KERNEL 41(63) (sono tutti di livello informativo),DA DUE CASI DI OGGI:
EVENT 41:
Nome registro: System
Origine: Microsoft-Windows-Kernel-Power
Data: 30/01/2019 16:53:17
ID evento: 41
Categoria attività:(63)
Livello: Critico
Parole chiave: (70368744177664),(2)
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Riavvio del sistema senza un regolare arresto. Questo errore può essere causato da un'interruzione, un arresto anomalo o un'interruzione dell'alimentazione imprevista del sistema.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" />
<EventID>41</EventID>
<Version>6</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000400000000002</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:17.094424100Z" />
<EventRecordID>2096</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BugcheckCode">0</Data>
<Data Name="BugcheckParameter1">0x0</Data>
<Data Name="BugcheckParameter2">0x0</Data>
<Data Name="BugcheckParameter3">0x0</Data>
<Data Name="BugcheckParameter4">0x0</Data>
<Data Name="SleepInProgress">0</Data>
<Data Name="PowerButtonTimestamp">0</Data>
<Data Name="BootAppStatus">0</Data>
<Data Name="Checkpoint">41</Data>
<Data Name="ConnectedStandbyInProgress">false</Data>
<Data Name="SystemSleepTransitionsToOn">2</Data>
<Data Name="CsEntryScenarioInstanceId">0</Data>
<Data Name="BugcheckInfoFromEFI">false</Data>
<Data Name="CheckpointStatus">0</Data>
</EventData>
</Event>
EVENT 6:
Nome registro: System
Origine: Microsoft-Windows-FilterManager
Data: 30/01/2019 16:53:16
ID evento: 6
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Caricamento del filtro del file system 'npsvctrig' (10.0, 2037-02-23T07:11:04.000000000Z) e registrazione con Gestione filtri riusciti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{f3c5e28e-63f6-49c7-a204-e48a1bc4b09d}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:16.617828300Z" />
<EventRecordID>2095</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">9</Data>
<Data Name="DeviceName">npsvctrig</Data>
<Data Name="DeviceTime">2037-02-23T07:11:04.000000000Z</Data>
</EventData>
</Event>
EVENT ID 6:(2nd volta)
Nome registro: System
Origine: Microsoft-Windows-FilterManager
Data: 30/01/2019 16:53:16
ID evento: 6
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Caricamento del filtro del file system 'FileCrypt' (10.0, 2034-08-13T15:30:12.000000000Z) e registrazione con Gestione filtri riusciti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{f3c5e28e-63f6-49c7-a204-e48a1bc4b09d}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:16.541774500Z" />
<EventRecordID>2094</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">9</Data>
<Data Name="DeviceName">FileCrypt</Data>
<Data Name="DeviceTime">2034-08-13T15:30:12.000000000Z</Data>
</EventData>
</Event>
EVENT ID:98
Nome registro: System
Origine: Microsoft-Windows-Ntfs
Data: 30/01/2019 16:53:16
ID evento: 98
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave: (2)
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Volume C: (\Device\HarddiskVolume4) è integro. Non è necessario eseguire alcuna operazione.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Ntfs" Guid="{3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482}" />
<EventID>98</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000002</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:16.479681600Z" />
<EventRecordID>2093</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="396" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="DriveName">C:</Data>
<Data Name="DeviceName">\Device\HarddiskVolume4</Data>
<Data Name="CorruptionActionState">0</Data>
</EventData>
</Event>
EVENT ID 6:(3rd volta)
Nome registro: System
Origine: Microsoft-Windows-FilterManager
Data: 30/01/2019 16:53:11
ID evento: 6
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Caricamento del filtro del file system 'WdFilter' (10.0, 2076-07-13T02:11:44.000000000Z) e registrazione con Gestione filtri riusciti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{f3c5e28e-63f6-49c7-a204-e48a1bc4b09d}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:11.821513500Z" />
<EventRecordID>2092</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">8</Data>
<Data Name="DeviceName">WdFilter</Data>
<Data Name="DeviceTime">2076-07-13T02:11:44.000000000Z</Data>
</EventData>
</Event>
EVENT ID 6:(4th volta)
Nome registro: System
Origine: Microsoft-Windows-FilterManager
Data: 30/01/2019 16:53:11
ID evento: 6
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Caricamento del filtro del file system 'Wof' (10.0, 1988-11-15T00:36:29.000000000Z) e registrazione con Gestione filtri riusciti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{f3c5e28e-63f6-49c7-a204-e48a1bc4b09d}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:11.820869200Z" />
<EventRecordID>2091</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">3</Data>
<Data Name="DeviceName">Wof</Data>
<Data Name="DeviceTime">1988-11-15T00:36:29.000000000Z</Data>
</EventData>
</Event>
EVENT ID 6:(5th volta)
Nome registro: System
Origine: Microsoft-Windows-FilterManager
Data: 30/01/2019 16:53:11
ID evento: 6
Categoria attività:Nessuna
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Caricamento del filtro del file system 'FileInfo' (10.0, 2041-01-31T08:18:31.000000000Z) e registrazione con Gestione filtri riusciti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{f3c5e28e-63f6-49c7-a204-e48a1bc4b09d}" />
<EventID>6</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:11.820396500Z" />
<EventRecordID>2090</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x0</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">8</Data>
<Data Name="DeviceName">FileInfo</Data>
<Data Name="DeviceTime">2041-01-31T08:18:31.000000000Z</Data>
</EventData>
</Event>
EVENT ID 20(6):
Nome registro: System
Origine: Microsoft-Windows-Kernel-General
Data: 30/01/2019 16:53:10
ID evento: 20
Categoria attività:(6)
Livello: Informazioni
Parole chiave: Time
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Configurazione secondo intercalare aggiornata.
Motivo: Leap second data initialized from registry during boot
Secondi intercalare abilitati: true
Conteggio nuovo secondo intercalare: 0
Conteggio precedente secondo intercalare: 0
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-General" Guid="{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}" />
<EventID>20</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>6</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.832893200Z" />
<EventRecordID>2089</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="UpdateReason">0</Data>
<Data Name="EnabledNew">true</Data>
<Data Name="CountNew">0</Data>
<Data Name="CountOld">0</Data>
</EventData>
</Event>
EVENT ID 30(21)
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 30
Categoria attività:(21)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Il firmware ha comunicato le metriche di avvio.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>30</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>21</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824958100Z" />
<EventRecordID>2088</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="ResetEndStart">0</Data>
<Data Name="LoadOSImageStart">16757</Data>
<Data Name="StartOSImageStart">18716</Data>
<Data Name="ExitBootServicesEntry">21197</Data>
<Data Name="ExitBootServicesExit">21201</Data>
</EventData>
</Event>
EVENT ID 32(58):
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 32
Categoria attività:(58)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Il file bootmgr ha atteso l'input dell'utente per 0 minuti.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>32</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>58</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824885400Z" />
<EventRecordID>2087</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BitlockerUserInputTime">0</Data>
</EventData>
</Event>
EVENT ID 18(57):
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 18
Categoria attività:(57)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Nel sistema sono presenti 0x1 opzioni di avvio.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>18</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>57</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824865300Z" />
<EventRecordID>2086</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="EntryCount">1</Data>
</EventData>
</Event>
EVENT ID 27(33)
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 27
Categoria attività:(33)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Tipo di avvio: 0x0.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>27</EventID>
<Version>1</Version>
<Level>4</Level>
<Task>33</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824808700Z" />
<EventRecordID>2085</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BootType">0</Data>
<Data Name="LoadOptions"> NOEXECUTE=OPTIN</Data>
</EventData>
</Event>
EVENT ID 25(32):
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 25
Categoria attività:(32)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Criteri del menu di avvio: 0x1.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>25</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>32</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824808400Z" />
<EventRecordID>2084</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BootMenuPolicy">1</Data>
</EventData>
</Event>
EVENT ID 20(31)
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 20
Categoria attività:(31)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Ultimo stato di arresto riuscito: false. Ultimo stato di avvio riuscito: true.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>20</EventID>
<Version>1</Version>
<Level>4</Level>
<Task>31</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824760700Z" />
<EventRecordID>2083</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="LastShutdownGood">false</Data>
<Data Name="LastBootGood">true</Data>
<Data Name="LastBootId">14</Data>
<Data Name="BootStatusPolicy">2</Data>
</EventData>
</Event>
EVENT ID 153(62):
Nome registro: System
Origine: Microsoft-Windows-Kernel-Boot
Data: 30/01/2019 16:53:10
ID evento: 153
Categoria attività:(62)
Livello: Informazioni
Parole chiave:
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
La sicurezza basata sulla virtualizzazione (criteri: 0) è disabled.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Boot" Guid="{15ca44ff-4d7a-4baa-bba5-0998955e531e}" />
<EventID>153</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>62</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824682000Z" />
<EventRecordID>2082</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Status">0</Data>
<Data Name="EnableDisableReason">0</Data>
<Data Name="VsmPolicy">0</Data>
</EventData>
</Event>
EVENT ID 12(1)
Nome registro: System
Origine: Microsoft-Windows-Kernel-General
Data: 30/01/2019 16:53:10
ID evento: 12
Categoria attività:(1)
Livello: Informazioni
Parole chiave: (128)
Utente: SYSTEM
Computer: DESKTOP-ROR62TJ
Descrizione:
Sistema operativo avviato all'ora di sistema 2019-01-30T15:53:10.500000000Z.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-General" Guid="{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}" />
<EventID>12</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>1</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000080</Keywords>
<TimeCreated SystemTime="2019-01-30T15:53:10.824629000Z" />
<EventRecordID>2078</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-ROR62TJ</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="MajorVersion">10</Data>
<Data Name="MinorVersion">0</Data>
<Data Name="BuildVersion">17763</Data>
<Data Name="QfeVersion">253</Data>
<Data Name="ServiceVersion">0</Data>
<Data Name="BootMode">0</Data>
<Data Name="StartTime">2019-01-30T15:53:10.500000000Z</Data>
</EventData>
</Event>
