Event Veiwer error

[cholla]

I get this error warning daily in the Windows Event Viewer.

It does not cause any problems.

It may be because I turn off power to my modem & router when I shut down the computer for the night.

Any suggestions will be appreciated.

 

Quote

The IP address lease 192.168.1.3 for the Network Card with network address
0x############ has been denied by the DHCP server 192.168.1.1 (The DHCP
Server sent a DHCPNACK message)

 

[CA3LE]

Because you're turning off the modem and router this is normal.  You can safely ignore this in your event viewer.  😀 

[cholla]

CA3LE,

On 11/6/2023 at 9:37 PM, CA3LE said:

Because you're turning off the modem and router this is normal.  You can safely ignore this in your event viewer.  😀 

 

I thought the same.

Since I do power all equipment off whenever I go to bed.

 

I worked with this some more & found the cause & a solution.

The cause was my OOMA Telo.

When starting my modem , router , & the OOMA Telo they are on their own separate Power strip.

This is so I can start them first & power cycle them without shutting down my computer if I want to.

 

Then I turn on a different power strip for my computer.

 

What was happening is the OOMA Telo started first and received 192.168.1.2 .

My computer Network Card wanted 192.168.1.2 but had to accept 192.168.1.3.

As far as I can tell my network card was denied 192.168.1.3 at first then received it.

So my computer & network card worked & showed 192.168.1.3 using ipconfig /all .

 

The solution was going into my router.

Then using Address Reservation for a higher IP Address 192.168.1.25 for example.

I also set the same in the OOMA Telo as a 'Static IP Address".

 

Now no more error shows up even after several reboots.

 

Edited November 11, 2023 by cholla

[cholla]

Hi all.

Seems a bit slow in the forum these days so I have a couple of more consistent errors.

They are not causing me any problems except filling up my EventViewer.

I have a .bat file for clearing it but it is a daily procedure.

 

If anyone has any information to stop these I would appreciate it.

 

The first is : Schannel Event ID: 36887

The following fatal alert was received: 40.

ProcessID=1128

 

The second is:

Service Control Manager Event ID: 7001

ProcessID=1112

Description:
The Background Intelligent Transfer Service service depends on the

COM+ Event System service which failed to start because of the

following error:
The service cannot be started, either because it is disabled or because

it has no enabled devices associated with it.

 

I do have BITS disabled in Services.

I plan to keep it disabled .I would like to find a way to stop the error.

 

[CA3LE]

Here's what I found.

 

Schannel error 40 means: SSL3_ALERT_HANDSHAKE_FAILURE -- you may be using outdated cyphers in your browser.

 

Service Control Manager Event ID: 7001 -- maybe look at this article. >> How to Solve Service Control Manager Error 7001 Effectively 

 

If this helps let me know.

[cholla]

The second error has been fixed by using the link.

Two of the Services settings were already set to Automatic,

I set Security Accounts Manager to Automatic.

The errors stopped for the second error..

 

I'm still working on the first one.

I checked both browsers I use Firefox & Opera.

Both are using TLS 1.3.

To add to that I cleared Event Viewer & opened & used both browsers with zero errors.

 

The errors are caused by Windows Live Mail the email client I use.

Opening Windows Live Mail does not cause the errors.

When just opened No errors.

It is when an email is opened the error appear.

 

The errors started some time ago when Suddenlink became Optimum.

Quote

As of May 4, 2021, Optimum no longer offers the ability for new and existing Internet customers to create new Optimum email accounts.

 

Optimum left in place the old suddenlink.net as the email addresses for suddenlink email accounts.

This may or may not be the cause but here is the information I have:

Optimum POP3 Incoming mail server:
mail.optimum.net     
110, requires SSL
995, non-secure
Optimum SMTP Outgoing mail server:
mail.optimum.net     
465, requires SSL
587, non-secure

 

suddenlink.net POP3 Server     pop.suddenlink.net
suddenlink.net POP3 Port     995
POP3 Security     SSL

suddenlink.net SMTP Server     smtp.suddenlink.net
suddenlink.net SMTP Port     465
SMTP Security     SSL

 

Optimim states use 110 for SSL while 995 is non-secure.

Suddenlink which are the settings I have states Port  995 for SSL.

This is where I suspect the errors come from.

 

Funny thing Windows Live Mail works fine as far as I can tell & I receive all my email as far as I can tell.

Even a gmail acountI have coming into WLM.

 

If I find more information I will post it.

 

 

Edited March 9 by cholla

[cholla]

I have fixed the SChannel errors.

 

I started with unchecking all of these in Internet Options/Advanced.

SSL 2.0
SSL 3.0
TLS 1.0
TLS 1.1
TLS 1.2

This worked to fix the error but my email images were now all the small black box with a X inside.

Not what I wanted.

So I checked them one at a time & tested with a reboot in between.

All need to be checked.

But that is not all.

I had to go into the Registry & change the settings.

This made the settings permanent.

This is the registry location.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SecurityProviders\SCHANNEL\Protocols

 

Two days now & NO SChannel; errors.

 

This could make my OS less secure.

I use Avast email scanner & I do not use IE or Edge.

So I believe I"m OK

 

[cholla]

Hi CA3LE,

While I got the credit for the solution your link & suggestion sure led me to it.

 

This is a "Warning" I still get in Event Viewer.

I thought I would get the "Errors" fixed first.

There are some "registry handles" that are not closing.

I've tried some suggestions I found on the Internet but none of those worked.

So again I will check out any suggestions.

 

This is the information from Windows Event Viewer:

 

Warning    3/14/2024 11:34:34 AM    User Profile Service    1530    

Log Name:      Application
Source:        Microsoft-Windows-User Profiles Service
Date:          3/14/2024 11:34:34 AM
Event ID:      1530
Task Category: None
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      MY-PC
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.  

 DETAIL -
 3 user registry handles leaked from \Registry\User\S-1-5-21-2165380602-1430432178-1808743609-1000:
Process 3300 (\Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-2165380602-1430432178-1808743609-1000
Process 1060 (\Device\HarddiskVolume3\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-2165380602-1430432178-1808743609-1000
Process 812 (\Device\HarddiskVolume3\Program Files\Avast Software\Avast\aswToolsSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-2165380602-1430432178-1808743609-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1530</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2024-03-14T16:34:34.162109300Z" />
    <EventRecordID>168</EventRecordID>
    <Correlation ActivityID="{86A66C9C-CE07-0005-834C-D7221276DA01}" />
    <Execution ProcessID="1572" ThreadID="3660" />
    <Channel>Application</Channel>
    <Computer>MY-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData Name="EVENT_HIVE_LEAK">
    <Data Name="Detail">3 user registry handles leaked from \Registry\User\S-1-5-21-2165380602-1430432178-1808743609-1000:
Process 3300 (\Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-2165380602-1430432178-1808743609-1000
Process 1060 (\Device\HarddiskVolume3\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-2165380602-1430432178-1808743609-1000
Process 812 (\Device\HarddiskVolume3\Program Files\Avast Software\Avast\aswToolsSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-2165380602-1430432178-1808743609-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall
</Data>
  </EventData>
</Event>