Event Errors

[Bob Horton]

Hi!

I have a system that seems to work fine with one exception: Norton Save and
Restore, after apparently completing a backup successfully, reports that
"Snapshot failed due to VSS error: catastrophic failure". Investigating
this showed that no services reported being dependent on any other services.
Further, checking in the event log showed a bunch of errors, as follows (I
apologize in advance if the following cut and paste jobs do not wrap
correctly, as I would hate to try to key all this in manually):

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 5/2/2006
Time: 7:06:51 PM
User: BOB-TRI-2006\Bob Horton
Computer: BOB-TRI-2006
Description:
DCOM got error "The service cannot be started, either because it is disabled
or because it has no enabled devices associated with it. " attempting to
start the service MDM with arguments "" in order to run the server:
{0C0A3666-30C9-11D0-8F20-00805F2CD064}


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 5/2/2006
Time: 7:01:24 PM
User: N/A
Computer: BOB-TRI-2006
Description:
The Fast User Switching Compatibility service depends on the following
nonexistent service: TermService

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1090
Date: 5/2/2006
Time: 6:14:01 PM
User: NT AUTHORITY\SYSTEM
Computer: BOB-TRI-2006
Description:
Windows couldn't log the RSoP (Resultant Set of Policies) session status. An
attempt to connect to WMI failed. No more RSoP logging will be done for this
application of policy.

Event Type: Error
Event Source: SecurityCenter
Event Category: None
Event ID: 1802
Date: 5/2/2006
Time: 7:03:48 PM
User: N/A
Computer: BOB-TRI-2006
Description:
The Windows Security Center Service was unable to establish event queries
with WMI to monitor third party AntiVirus and Firewall.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1090
Date: 5/2/2006
Time: 7:03:51 PM
User: NT AUTHORITY\SYSTEM
Computer: BOB-TRI-2006
Description:
Windows couldn't log the RSoP (Resultant Set of Policies) session status. An
attempt to connect to WMI failed. No more RSoP logging will be done for this
application of policy.

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12289
Date: 5/2/2006
Time: 3:03:17 PM
User: N/A
Computer: BOB-TRI-2006
Description:
Volume Shadow Copy Service error: Unexpected error
RegOpenKeyExW(HKLM,SYSTEM\CurrentControlSet\Services\VSS\Providers,0,KEY_ALL_ACCESS,&ptr).
hr = 0x80070002.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 43 4f 52 50 52 56 4d 43 CORPRVMC
0008: 35 35 36 00 00 00 00 00 556.....
0010: 43 4f 52 50 52 56 4d 43 CORPRVMC
0018: 35 32 35 00 00 00 00 00 525.....

The machine is an Athlon 4800+ dual core machine, 2 GB PC 3200 RAM, 400 GB
SATA drive, XP SP2 on an ASUS mobo. Again, the machine seems to work fine,
other than this backup issue, but all these error messages have me confused,
as does the lack of dependencies on the services. I'm afraid that something
serious lurks beneath the surface, but am reluctant to take drastic measures
on a machine that seems to function fine if I don't need to. Does anyone
have an idea what is wrong and/or needs to be fixed, or if this is something
that I need to be concerned with. TIA.

 

[Wesley Vogel]

attempting to start the service MDM

NOTE: Running the Detect and Repair feature within Office causes Mdm.exe to
be re-registered on the system.

[[The Machine Debug Manager runs as a service and is loaded when your
computer starts. If you do not use your computer for debugging purposes, you
can safely turn off the Machine Debug Manager.]]

How to turn off Machine Debug Manager in Office XP
http://support.microsoft.com/kb/321410

Machine Debug Manager Service
http://www.theeldergeek.com/machine_debug_manager.htm

[[Filename: mdm.exe
Program Title: Machine Debug Manager
Comments: Used by developers for debugging. Those who have encountered it
have unchecked it with no degradation in performance. May cause your
computer to "hang" if you have MS Visual Studio
installed and this disabled because it appears to take over error handling -
hence the U recommendatioon. Can also be listed as MDM7. ]]
http://www.windowsstartup.com/wso/detail.php?id=1515

nonexistent service: TermService

TermService is Terminal Services.

Windows XP Home Edition
In Windows XP Home Edition, the following services rely on the Terminal
Services service:
Remote Assistance
Fast User Switching

Windows XP Professional
In Windows XP Professional, the following services rely on the Terminal
Services service:
Remote Assistance
Fast User Switching
Remote Desktop (single connection, console or remote)

Add the Terminal Services component by using the Add/Remove Programs tool in
Control Panel.

Event Source: Userenv
Event ID: 1090

Event ID: 1090
Source: Userenv
http://www.microsoft.com/technet/su...odVer=5.2&EvtID=1090&EvtSrc=Userenv&LCID=1033

Event Source: SecurityCenter
Event ID: 1802

if you are using BitDefender 8 Standard...
http://kb.bitdefender.com/site/view..._reports_BitDefender_8_Standard_disabled.html

Event Source: VSS
Event ID: 12289

Event ID: 12289
Source: VSS
http://www.eventid.net/display.asp?eventid=12289&eventno=2714&source=VSS&phase=1

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Bob Horton]

attempting to start the service MDM

NOTE: Running the Detect and Repair feature within Office causes Mdm.exe
to
be re-registered on the system.

[[The Machine Debug Manager runs as a service and is loaded when your
computer starts. If you do not use your computer for debugging purposes,
you
can safely turn off the Machine Debug Manager.]]

How to turn off Machine Debug Manager in Office XP
http://support.microsoft.com/kb/321410

Machine Debug Manager Service
http://www.theeldergeek.com/machine_debug_manager.htm

[[Filename: mdm.exe
Program Title: Machine Debug Manager
Comments: Used by developers for debugging. Those who have encountered it
have unchecked it with no degradation in performance. May cause your
computer to "hang" if you have MS Visual Studio
installed and this disabled because it appears to take over error
handling -
hence the U recommendatioon. Can also be listed as MDM7. ]]
http://www.windowsstartup.com/wso/detail.php?id=1515

nonexistent service: TermService

TermService is Terminal Services.

Windows XP Home Edition
In Windows XP Home Edition, the following services rely on the Terminal
Services service:
Remote Assistance
Fast User Switching

Windows XP Professional
In Windows XP Professional, the following services rely on the Terminal
Services service:
Remote Assistance
Fast User Switching
Remote Desktop (single connection, console or remote)

Add the Terminal Services component by using the Add/Remove Programs tool
in
Control Panel.

Event Source: Userenv
Event ID: 1090

Event ID: 1090
Source: Userenv
http://www.microsoft.com/technet/su...odVer=5.2&EvtID=1090&EvtSrc=Userenv&LCID=1033

Event Source: SecurityCenter
Event ID: 1802

if you are using BitDefender 8 Standard...
http://kb.bitdefender.com/site/view..._reports_BitDefender_8_Standard_disabled.html

Event Source: VSS
Event ID: 12289

Event ID: 12289
Source: VSS
http://www.eventid.net/display.asp?eventid=12289&eventno=2714&source=VSS&phase=1

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi!

I have a system that seems to work fine with one exception: Norton Save
and Restore, after apparently completing a backup successfully, reports
that "Snapshot failed due to VSS error: catastrophic failure".
Investigating this showed that no services reported being dependent on
any other services. Further, checking in the event log showed a bunch of
errors, as follows (I apologize in advance if the following cut and paste
jobs do not wrap correctly, as I would hate to try to key all this in
manually):

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 5/2/2006
Time: 7:06:51 PM
User: BOB-TRI-2006\Bob Horton
Computer: BOB-TRI-2006
Description:
DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service MDM with arguments "" in order to run the
server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 5/2/2006
Time: 7:01:24 PM
User: N/A
Computer: BOB-TRI-2006
Description:
The Fast User Switching Compatibility service depends on the following
nonexistent service: TermService

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1090
Date: 5/2/2006
Time: 6:14:01 PM
User: NT AUTHORITY\SYSTEM
Computer: BOB-TRI-2006
Description:
Windows couldn't log the RSoP (Resultant Set of Policies) session status.
An attempt to connect to WMI failed. No more RSoP logging will be done
for this application of policy.

Event Type: Error
Event Source: SecurityCenter
Event Category: None
Event ID: 1802
Date: 5/2/2006
Time: 7:03:48 PM
User: N/A
Computer: BOB-TRI-2006
Description:
The Windows Security Center Service was unable to establish event queries
with WMI to monitor third party AntiVirus and Firewall.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1090
Date: 5/2/2006
Time: 7:03:51 PM
User: NT AUTHORITY\SYSTEM
Computer: BOB-TRI-2006
Description:
Windows couldn't log the RSoP (Resultant Set of Policies) session status.
An attempt to connect to WMI failed. No more RSoP logging will be done
for this application of policy.

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12289
Date: 5/2/2006
Time: 3:03:17 PM
User: N/A
Computer: BOB-TRI-2006
Description:
Volume Shadow Copy Service error: Unexpected error
RegOpenKeyExW(HKLM,SYSTEM\CurrentControlSet\Services\VSS\Providers,0,KEY_ALL
_ACCESS,&ptr).
hr = 0x80070002.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 43 4f 52 50 52 56 4d 43 CORPRVMC
0008: 35 35 36 00 00 00 00 00 556.....
0010: 43 4f 52 50 52 56 4d 43 CORPRVMC
0018: 35 32 35 00 00 00 00 00 525.....

The machine is an Athlon 4800+ dual core machine, 2 GB PC 3200 RAM, 400
GB
SATA drive, XP SP2 on an ASUS mobo. Again, the machine seems to work
fine, other than this backup issue, but all these error messages have me
confused, as does the lack of dependencies on the services. I'm afraid
that something serious lurks beneath the surface, but am reluctant to
take drastic measures on a machine that seems to function fine if I don't
need to. Does anyone have an idea what is wrong and/or needs to be
fixed, or if this is something that I need to be concerned with. TIA.

See, that's my problem. All these services show as installed when you view
the "services" tab. However, something is not working right, as ALL the
services show that they have no dependencies and when you check the event
log you see that services that show as installed and started apparently
aren't. For example, there is no way to add terminal services to the
installation through Control Panel; XP apparently thinks it's already there.
VSS is apparently not working or at least not working correctly, as that is
where I started getting the error message from Norton Save and restore (BTW,
no response from Symantec after 96 hours). This is very strange. Also,
when I tried to run SFC, I keep getting a message to insert XP Disk 2. What
Disk 2? I have legitimate XP disks for XP Home and Pro, both full retail
and upgrade, OEM disks for Pro and Media Center (we are an Action Pack
subscriber), and the only software I have with a second disk is Media Center
OEM. I tried using that disk but that isn't what it wants.

I did check the event log numbers but didn't find anything that seemed to
address what I'm seeing.

Any help would be greatly appreciated. This is truly weird since I wouldn't
think the system would be running if all the services were truly
independent.

 

[Bob Horton]

attempting to start the service MDM

NOTE: Running the Detect and Repair feature within Office causes Mdm.exe
to
be re-registered on the system.

[[The Machine Debug Manager runs as a service and is loaded when your
computer starts. If you do not use your computer for debugging purposes,
you
can safely turn off the Machine Debug Manager.]]

How to turn off Machine Debug Manager in Office XP
http://support.microsoft.com/kb/321410

Machine Debug Manager Service
http://www.theeldergeek.com/machine_debug_manager.htm

[[Filename: mdm.exe
Program Title: Machine Debug Manager
Comments: Used by developers for debugging. Those who have encountered it
have unchecked it with no degradation in performance. May cause your
computer to "hang" if you have MS Visual Studio
installed and this disabled because it appears to take over error
handling -
hence the U recommendatioon. Can also be listed as MDM7. ]]
http://www.windowsstartup.com/wso/detail.php?id=1515

nonexistent service: TermService

TermService is Terminal Services.

Windows XP Home Edition
In Windows XP Home Edition, the following services rely on the Terminal
Services service:
Remote Assistance
Fast User Switching

Windows XP Professional
In Windows XP Professional, the following services rely on the Terminal
Services service:
Remote Assistance
Fast User Switching
Remote Desktop (single connection, console or remote)

Add the Terminal Services component by using the Add/Remove Programs tool
in
Control Panel.

Event Source: Userenv
Event ID: 1090

Event ID: 1090
Source: Userenv
http://www.microsoft.com/technet/su...odVer=5.2&EvtID=1090&EvtSrc=Userenv&LCID=1033

Event Source: SecurityCenter
Event ID: 1802

if you are using BitDefender 8 Standard...
http://kb.bitdefender.com/site/view..._reports_BitDefender_8_Standard_disabled.html

Event Source: VSS
Event ID: 12289

Event ID: 12289
Source: VSS
http://www.eventid.net/display.asp?eventid=12289&eventno=2714&source=VSS&phase=1

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi!

I have a system that seems to work fine with one exception: Norton Save
and Restore, after apparently completing a backup successfully, reports
that "Snapshot failed due to VSS error: catastrophic failure".
Investigating this showed that no services reported being dependent on
any other services. Further, checking in the event log showed a bunch of
errors, as follows (I apologize in advance if the following cut and
paste
jobs do not wrap correctly, as I would hate to try to key all this in
manually):

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 5/2/2006
Time: 7:06:51 PM
User: BOB-TRI-2006\Bob Horton
Computer: BOB-TRI-2006
Description:
DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service MDM with arguments "" in order to run
the
server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 5/2/2006
Time: 7:01:24 PM
User: N/A
Computer: BOB-TRI-2006
Description:
The Fast User Switching Compatibility service depends on the following
nonexistent service: TermService

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1090
Date: 5/2/2006
Time: 6:14:01 PM
User: NT AUTHORITY\SYSTEM
Computer: BOB-TRI-2006
Description:
Windows couldn't log the RSoP (Resultant Set of Policies) session
status.
An attempt to connect to WMI failed. No more RSoP logging will be done
for this application of policy.

Event Type: Error
Event Source: SecurityCenter
Event Category: None
Event ID: 1802
Date: 5/2/2006
Time: 7:03:48 PM
User: N/A
Computer: BOB-TRI-2006
Description:
The Windows Security Center Service was unable to establish event
queries
with WMI to monitor third party AntiVirus and Firewall.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1090
Date: 5/2/2006
Time: 7:03:51 PM
User: NT AUTHORITY\SYSTEM
Computer: BOB-TRI-2006
Description:
Windows couldn't log the RSoP (Resultant Set of Policies) session
status.
An attempt to connect to WMI failed. No more RSoP logging will be done
for this application of policy.

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12289
Date: 5/2/2006
Time: 3:03:17 PM
User: N/A
Computer: BOB-TRI-2006
Description:
Volume Shadow Copy Service error: Unexpected error
RegOpenKeyExW(HKLM,SYSTEM\CurrentControlSet\Services\VSS\Providers,0,KEY_ALL
_ACCESS,&ptr).
hr = 0x80070002.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 43 4f 52 50 52 56 4d 43 CORPRVMC
0008: 35 35 36 00 00 00 00 00 556.....
0010: 43 4f 52 50 52 56 4d 43 CORPRVMC
0018: 35 32 35 00 00 00 00 00 525.....

The machine is an Athlon 4800+ dual core machine, 2 GB PC 3200 RAM, 400
GB
SATA drive, XP SP2 on an ASUS mobo. Again, the machine seems to work
fine, other than this backup issue, but all these error messages have me
confused, as does the lack of dependencies on the services. I'm afraid
that something serious lurks beneath the surface, but am reluctant to
take drastic measures on a machine that seems to function fine if I
don't
need to. Does anyone have an idea what is wrong and/or needs to be
fixed, or if this is something that I need to be concerned with. TIA.

See, that's my problem. All these services show as installed when you
view the "services" tab. However, something is not working right, as ALL
the services show that they have no dependencies and when you check the
event log you see that services that show as installed and started
apparently aren't. For example, there is no way to add terminal services
to the installation through Control Panel; XP apparently thinks it's
already there. VSS is apparently not working or at least not working
correctly, as that is where I started getting the error message from
Norton Save and restore (BTW, no response from Symantec after 96 hours).
This is very strange. Also, when I tried to run SFC, I keep getting a
message to insert XP Disk 2. What Disk 2? I have legitimate XP disks for
XP Home and Pro, both full retail and upgrade, OEM disks for Pro and Media
Center (we are an Action Pack subscriber), and the only software I have
with a second disk is Media Center OEM. I tried using that disk but that
isn't what it wants.

I did check the event log numbers but didn't find anything that seemed to
address what I'm seeing.

Any help would be greatly appreciated. This is truly weird since I
wouldn't think the system would be running if all the services were truly
independent.

Responding to my own post, I just did an "over the top" repair install. It
seems to have gotten all the major services running and the dependencies
re-established. Knock on wood, I think this one's OK now. Thank you for
your help Wesley.

 

[Wesley Vogel]

view the "services" tab.

Forget using msconfig with services.

Open Services....
Start | Run | Type: services.msc | Click OK |

Double click a service | Dependencies tab shows what other service(s) that
service may depend on and what other service(s) depend on that service.


Most all of those services will be listed in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
if they are installed. Some are hidden from services.msc.

Uses the Service Name not the Display Name. I.e TermService instead of
Terminal Services.

DependOnService lists the service dependencies. I.e...
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService
Value Name: DependOnService
Data Type: REG_MULTI_SZ
Value Data: RPCSS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS

Value Name: DependOnService
Data Type: REG_MULTI_SZ
Value Data: RPCSS

Try these commands in a command prompt.

sc query ServiceName You have to use the Service Name not the Display Name.

sc query termservice

sc query vss

If a service is not installed, you get...
[[The specified service does not exist as an installed service.]]

--------------
C:\>sc query mdm
[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service.
--------------

The following command lists the state of all the installed services.
And shows both SERVICE_NAME and DISPLAY_NAME.

sc query state= all

[[Windows couldn't log the RSoP (Resultant Set of Policies) session status.
An
attempt to connect to WMI failed. No more RSoP logging will be done for this
application of policy.]]

This may be of some interest...

Repairing and re-registering the WMI
http://windowsxp.mvps.org/repairwmi.htm

System File Checker (sfc.exe) replaces screwed up system files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

If you have XP Home and it asks for your XP Pro CD, see this KB article...

You may be prompted to insert a Windows XP Professional CD when you run the
System File Checker tool in Windows XP Home Edition
http://support.microsoft.com/default.aspx?scid=kb;en-us;897128

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

Explains a whole bunch about sfc.exe.
scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html

Description of Windows XP and Windows Server 2003 System File Checker
(Sfc.exe)
http://support.microsoft.com/?kbid=310747

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

attempting to start the service MDM

NOTE: Running the Detect and Repair feature within Office causes Mdm.exe
to
be re-registered on the system.

[[The Machine Debug Manager runs as a service and is loaded when your
computer starts. If you do not use your computer for debugging purposes,
you
can safely turn off the Machine Debug Manager.]]

How to turn off Machine Debug Manager in Office XP
http://support.microsoft.com/kb/321410

Machine Debug Manager Service
http://www.theeldergeek.com/machine_debug_manager.htm

[[Filename: mdm.exe
Program Title: Machine Debug Manager
Comments: Used by developers for debugging. Those who have encountered it
have unchecked it with no degradation in performance. May cause your
computer to "hang" if you have MS Visual Studio
installed and this disabled because it appears to take over error
handling -
hence the U recommendatioon. Can also be listed as MDM7. ]]
http://www.windowsstartup.com/wso/detail.php?id=1515

nonexistent service: TermService

TermService is Terminal Services.

Windows XP Home Edition
In Windows XP Home Edition, the following services rely on the Terminal
Services service:
Remote Assistance
Fast User Switching

Windows XP Professional
In Windows XP Professional, the following services rely on the Terminal
Services service:
Remote Assistance
Fast User Switching
Remote Desktop (single connection, console or remote)

Add the Terminal Services component by using the Add/Remove Programs tool
in
Control Panel.

Event Source: Userenv
Event ID: 1090

Event ID: 1090
Source: Userenv
http://www.microsoft.com/technet/su...odVer=5.2&EvtID=1090&EvtSrc=Userenv&LCID=1033

Event Source: SecurityCenter
Event ID: 1802

if you are using BitDefender 8 Standard...
http://kb.bitdefender.com/site/view..._reports_BitDefender_8_Standard_disabled.html

Event Source: VSS
Event ID: 12289

Event ID: 12289
Source: VSS
http://www.eventid.net/display.asp?eventid=12289&eventno=2714&source=VSS&phase=1

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi!

I have a system that seems to work fine with one exception: Norton Save
and Restore, after apparently completing a backup successfully, reports
that "Snapshot failed due to VSS error: catastrophic failure".
Investigating this showed that no services reported being dependent on
any other services. Further, checking in the event log showed a bunch of
errors, as follows (I apologize in advance if the following cut and
paste jobs do not wrap correctly, as I would hate to try to key all
this in manually):

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 5/2/2006
Time: 7:06:51 PM
User: BOB-TRI-2006\Bob Horton
Computer: BOB-TRI-2006
Description:
DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service MDM with arguments "" in order to run
the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 5/2/2006
Time: 7:01:24 PM
User: N/A
Computer: BOB-TRI-2006
Description:
The Fast User Switching Compatibility service depends on the following
nonexistent service: TermService

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1090
Date: 5/2/2006
Time: 6:14:01 PM
User: NT AUTHORITY\SYSTEM
Computer: BOB-TRI-2006
Description:
Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will
be done for this application of policy.

Event Type: Error
Event Source: SecurityCenter
Event Category: None
Event ID: 1802
Date: 5/2/2006
Time: 7:03:48 PM
User: N/A
Computer: BOB-TRI-2006
Description:
The Windows Security Center Service was unable to establish event
queries with WMI to monitor third party AntiVirus and Firewall.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1090
Date: 5/2/2006
Time: 7:03:51 PM
User: NT AUTHORITY\SYSTEM
Computer: BOB-TRI-2006
Description:
Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will
be done for this application of policy.

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12289
Date: 5/2/2006
Time: 3:03:17 PM
User: N/A
Computer: BOB-TRI-2006
Description:
Volume Shadow Copy Service error: Unexpected error

RegOpenKeyExW(HKLM,SYSTEM\CurrentControlSet\Services\VSS\Providers,0,KEY_ALL
_ACCESS,&ptr).

hr = 0x80070002.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 43 4f 52 50 52 56 4d 43 CORPRVMC
0008: 35 35 36 00 00 00 00 00 556.....
0010: 43 4f 52 50 52 56 4d 43 CORPRVMC
0018: 35 32 35 00 00 00 00 00 525.....

The machine is an Athlon 4800+ dual core machine, 2 GB PC 3200 RAM, 400
GB
SATA drive, XP SP2 on an ASUS mobo. Again, the machine seems to work
fine, other than this backup issue, but all these error messages have me
confused, as does the lack of dependencies on the services. I'm afraid
that something serious lurks beneath the surface, but am reluctant to
take drastic measures on a machine that seems to function fine if I
don't need to. Does anyone have an idea what is wrong and/or needs to
be fixed, or if this is something that I need to be concerned with.
TIA. --
Bob Horton

See, that's my problem. All these services show as installed when you
view the "services" tab. However, something is not working right, as ALL
the services show that they have no dependencies and when you check the
event log you see that services that show as installed and started
apparently aren't. For example, there is no way to add terminal services
to the installation through Control Panel; XP apparently thinks it's
already there. VSS is apparently not working or at least not working
correctly, as that is where I started getting the error message from
Norton Save and restore (BTW, no response from Symantec after 96 hours).
This is very strange. Also, when I tried to run SFC, I keep getting a
message to insert XP Disk 2. What Disk 2? I have legitimate XP disks
for XP Home and Pro, both full retail and upgrade, OEM disks for Pro and
Media Center (we are an Action Pack subscriber), and the only software I
have with a second disk is Media Center OEM. I tried using that disk but
that isn't what it wants.

I did check the event log numbers but didn't find anything that seemed to
address what I'm seeing.

Any help would be greatly appreciated. This is truly weird since I
wouldn't think the system would be running if all the services were truly
independent.