Error in Event Viewer 1

[sensoukami]

Hello,

I get the following error in my Computer Management/Event Viewer/Application:

----------------------

The COM+ Event System detected a corrupt IEventSubscription object. The COM+ Event System has removed object ID {463808B8-0496-4FC3-9364-F1F6F660FDFC}. The subscriber will no longer be notified when the event occurs.

----------------------

Any ideas what this means? In case it helps, I run Win2k Pro with SP4, and I have Visual Studio.NET 2002 and SQL Server.

 

[ImpetusEra]

When you view the even properties it will give an event id number. If you go to

http://www.support.microsoft.com

and search for the event id number you should be able to find a detailed explanation and a fix for it.

 

[sensoukami]

Hey,

I did as you suggested. Problem is, none of the links that came up seemed to fit my situation. Or at least, I dont know enough to decide which.

A search for EventID 4106 brought up a list of 7 items.

Many of them refer to Windows Server, which I dont run. Others refer to Small Business Server or Exchange Server, which I also dont run.

The two that might have been useful were these:

http://support.microsoft.com/default.aspx?scid=kb;en-us;165846

http://support.microsoft.com/default.aspx?scid=kb;en-us;316835

But I checked out my registry as per the instructions in the first one, and everything seemed ok (unless I did something wrong). The second one didnt make sense to me (but seemed specific to Server).

 

[ImpetusEra]

{463808B8-0496-4FC3-9364-F1F6F660FDFC}
That part looks familiar to me as what it will list under security for a folder or device after a user account has been removed. If you have removed any user accounts it may be because of that? In that's the case it should cause any issues. Also, did it list a source along with the event ID?

 

[sensoukami]

Nope, I have not removed a user account since I installed the OS a year ago....


I changed my ISP from a ADSL provider to a cable provider a few weeks back....could that have some bearing on it.

And in answer to your questions, the Source is EventSystem and the Category is Event Service.

Also, the hexadecimal value seems to be different each time...(and it is a Warning, not an error. My original post was inaccurate)

 

[ImpetusEra]

Did the warning start showing up a few weeks ago? I noticed one of those articles mentioned WINS. Do you have any WINS addresses listed under TCP/IP for your cable connection?

 

[sensoukami]

Not sure. Much to my embarrasment, I had recently deleted my Event viewer lists (without saving the log). I have not normally been the type to look at my Viewer, but had decided to start doing so...I guess it wasnt the best idea to have a tabula rasa...

And how do I look for a WINS address under TCP/IP? That is a Server thing isnt it?

 

[ImpetusEra]

right-click my network places, right-click local area connection, properties for TCP/IP, then advanced and you'll see the WINS tab.

 

[sensoukami]

Nope, no WINS addresses listed...(if it helps, I Enable LMHOSTS lookup, and Enable NetBIOS over TCP/IP).

 

[ImpetusEra]

ok, go to run and punch in regedit. Once there navigate to this registry key and delete it, then reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions\{A5978620-5B3F-F1D1-8ED2-00FA0035B753}.

 

[sensoukami]

Was willing to try it (though normally messing with my registry scares me), but that particular key is not there...

Maybe my machine has been taken over by aliens.

 

[ImpetusEra]

I should think any listed under Subscriptions that follow the same format as that one I listed ({A5978620-5B3F-F1D1-8ED2-00FA0035B753) should be ok to remove. I noticed one I had listed was for Windows Updates.

 

[sensoukami]

There are five sub folders in that area of the registry...

Messenger ISEN Logon Subscription
Messegner ISENNetwork Subscription
WU Update
COM+ Notification Subscription
SENS EventSystem Subscription Changed

...wouldnt removing any of these just stop the warning message without actually fixing the underlying issue?

 

[ImpetusEra]

I don't really know. If it were mine though I'd probably take out the COM+ Notification Subscription first.

 

[sensoukami]

I figured that was the one you were driving at...makes a degree of sense. But I sure would like to know what causes it instead of just removing the event notification.

In the grand scheme of things, status quo is not bad. My machine works, and I can do what needs to be done, but having said that, I do have other (apparently unrelated)issues. PCs being what they are, fixing one might help another.

 

[ImpetusEra]

Though it certainly seems like it would be the one, you may have better luck with the ISEN Logon Subscription. I came across some information where someone else received the same error as you, different object id though. Removing the subscription key stopped the warning. As far as I know that is the only place these subscriptions are held at? Maybe it has something to do with the old ASDL connection? Now that you no longer have it the "subscription" is no longer valid? I imagine if you delete it from the registry no harm will come. If it is in fact used by something I imagine it would be "re-created" as it must have been created at one time other than install.

 

[sensoukami]

Well, I just deleted the ISEN Logon (no idea what that is) subscription and rebooted. Nothing seemed to blow up. Lets see what happens!

Thanks for the patient advice by the way...