Event ID 26

[Tom Hall]

XP Pro SP3:

Every time I log off or shut down Windows, a message box pops up briefly
and the following entry appears in my System Event Log:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 5/29/2008
Time: 11:11:59 PM
User: N/A
Computer: TOM
Description:
Application popup: dwwin.exe - DLL Initialization Failed : The application
failed to initialize because the window station is shutting down.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

The text of the message box is that which follows "Application popup:"
above.

The message box only stays for a few seconds and then goes away as the
logoff, shutdown or restart proceeds.

This started happening before I installed Service Pack 3. For a while there
were entries in the Application Log that corresponded timewise with the
System Log entry, but that's stopped happening. There's no other entry in
the Event Logs that I can follow up on.

It's so consistent (and annoying) that I've turned off the Critical Stop
system sound, which is a loud "uh-oh".

Help and Support only offers the suggestion to reinstall the application,
but since this appears to be a Windows core program, I really don't know
what to do.


Tom

 

[Tom Hall]

I'm a little surprised that no one has weighed in on this problem. Is this
one of those mysteries that is destined never to be solved?

Why is DWWIN trying to start up every time the system is shutting down or
restarting?

scratching head...

XP Pro SP3:

Every time I log off or shut down Windows, a message box pops up briefly
and the following entry appears in my System Event Log:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 5/29/2008
Time: 11:11:59 PM
User: N/A
Computer: TOM
Description:
Application popup: dwwin.exe - DLL Initialization Failed : The application
failed to initialize because the window station is shutting down.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

The text of the message box is that which follows "Application popup:"
above.

The message box only stays for a few seconds and then goes away as the
logoff, shutdown or restart proceeds.

This started happening before I installed Service Pack 3. For a while there
were entries in the Application Log that corresponded timewise with the
System Log entry, but that's stopped happening. There's no other entry in
the Event Logs that I can follow up on.

It's so consistent (and annoying) that I've turned off the Critical Stop
system sound, which is a loud "uh-oh".

Help and Support only offers the suggestion to reinstall the application,
but since this appears to be a Windows core program, I really don't know
what to do.


Tom

Tom

 

[John John (MVP)]

It's not dwwin.exe that is trying to start, dwwin.exe is just an error
reporting tool, something else is trying to start when you shutdown the
computer and the error reporting tool is catching it.

John

 

[Tom Hall]

It's not dwwin.exe that is trying to start, dwwin.exe is just an error
reporting tool, something else is trying to start when you shutdown the
computer and the error reporting tool is catching it.

Any suggestions at how I could find out what that something is?


Tom

 

[John John (MVP)]

Any suggestions at how I could find out what that something is?

Dr. Watson creates and stores log and memory dump files (drwtsn32.log
and user.dmp) in the %systemdrive%\Documents and Settings\All
Users\Application Data\Microsoft\Dr Watson folder, look there to see if
the files are present, if yes delete them. The Drwtsn32.log file is
appended each time an error is recorded, the User.dmp file is
overwritten. The easier file to read is the Drwtsn32.log, you don't
want to be reading a large file that has been appended with all past
error records, delete the file and the next time you get an error you
can read the fresh log file with Notepad. Reading and interpreting the
User.dmp file requires special tools and is much more complex and
difficult than reading the log file.

You can also read the log file with Dr. Watson. To start Dr Watson
enter drwtsn32 in the Start Menu Run box, Dr Watson will open and you
will see the application errors in the box at the bottom, just double
click on the file and Dr Watson will open it for you. If the
drwtsn32.log and user.dmp files are not created change the Dr Watson
options to suit.

John

 

[Tom Hall]

Dr. Watson creates and stores log and memory dump files (drwtsn32.log
and user.dmp) in the %systemdrive%\Documents and Settings\All
Users\Application Data\Microsoft\Dr Watson folder, look there to see if
the files are present, if yes delete them. The Drwtsn32.log file is
appended each time an error is recorded, the User.dmp file is
overwritten. The easier file to read is the Drwtsn32.log, you don't
want to be reading a large file that has been appended with all past
error records, delete the file and the next time you get an error you
can read the fresh log file with Notepad. Reading and interpreting the
User.dmp file requires special tools and is much more complex and
difficult than reading the log file.

You can also read the log file with Dr. Watson. To start Dr Watson
enter drwtsn32 in the Start Menu Run box, Dr Watson will open and you
will see the application errors in the box at the bottom, just double
click on the file and Dr Watson will open it for you. If the
drwtsn32.log and user.dmp files are not created change the Dr Watson
options to suit.

Some interesting discoveries:

I found the Dr. Watson logfile in the location you mentioned. It was about
10 mb in size but the last time it was written to was November 2006.

I then remembered that I had disabled Dr. Watson using instructions from a
Microsoft Help and Support page Article ID: 188296. Don't ask me why I did
that because I don't remember

Using the instructions on that page, I had saved the registry information
in AeDebug before removing it. I have just now restored that key and its
values:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug]
"Auto"="1"
"Debugger"="drwtsn32 -p %ld -e %ld -g"
"UserDebuggerHotKey"=dword:00000000

The message box continues to appear at each restart, logoff or shutdown and
the Event ID 26 entries continue to appear in the Event Log, but so far the
Dr. Watson log has not reappeared.

When I ran drtwsn32, the only box that was ticked was the "Create Crash
Dump File". I ticked off "Dump Symbol Table", "Dump All Thread Contexts"
and "Visual Notification" but after several logoffs and restarts,
drwtsn32.log has not reappeared.


Tom

 

[John John (MVP)]

[snip]

I then remembered that I had disabled Dr. Watson using instructions from a
Microsoft Help and Support page Article ID: 188296. Don't ask me why I did
that because I don't remember

[snip]

The message box continues to appear at each restart, logoff or shutdown and
the Event ID 26 entries continue to appear in the Event Log, but so far the
Dr. Watson log has not reappeared.

When I ran drtwsn32, the only box that was ticked was the "Create Crash
Dump File". I ticked off "Dump Symbol Table", "Dump All Thread Contexts"
and "Visual Notification" but after several logoffs and restarts,
drwtsn32.log has not reappeared.

I'm not sure but maybe look in the Advanced System Properties and
re-enable Error Reporting, that might cause Dr. Watson to create the files.

Those dwwin.exe errors are hard to pin down, they can be caused by just
about anything. Does this happen if you reboot and shutdown the machine
immediately after it is booted? If yes do a try it again with a Clean
Boot, does it still persist when shutting down immediately after a Clean
Boot?

You might find out more by monitoring and logging the shutdown activity.
You can monitor file and registry access during shutdowns by using
SysInternals' Process Monitor and configuring it to do Boot Logging.
After you enable Boot Logging reboot the computer and Process Monitor
will log activity until you disable boot logging, it will log activity
right through the next shutdown and reboot, you can then look in the log
to see if you can find any clues in the activities that are logged
during the shutdown.

John

 

[Tom Hall]

I'm not sure but maybe look in the Advanced System Properties and
re-enable Error Reporting, that might cause Dr. Watson to create the files.

Did this. Still no Dr. Watson log file.

Those dwwin.exe errors are hard to pin down, they can be caused by just
about anything. Does this happen if you reboot and shutdown the machine
immediately after it is booted? If yes do a try it again with a Clean
Boot, does it still persist when shutting down immediately after a Clean
Boot?

The error occurs even if I immediately restart after a clean boot.

You might find out more by monitoring and logging the shutdown activity.
You can monitor file and registry access during shutdowns by using
SysInternals' Process Monitor and configuring it to do Boot Logging.
After you enable Boot Logging reboot the computer and Process Monitor
will log activity until you disable boot logging, it will log activity
right through the next shutdown and reboot, you can then look in the log
to see if you can find any clues in the activities that are logged
during the shutdown.

I'm having a bit of trouble finding out how to use Process Monitor. The
help file is apparently unusable since the systinternals website was
swallowed up by Microsoft. All I get no matter what I click on says "the
address is not valid" or "navigation to the web page was cancelled".

I started Process Monitor and then restarted the system. After the restart,
when I ran Process Monitor again, it asked me if I wanted to save the boot
log. I said yes, and after nearly 10 minutes of crunching, I got the
following set of files:

shutdown.PML 260688 KB 6/9/2008 6:27:46 PM
shutdown-1.PML 284039 KB 6/9/2008 6:28:36 PM
shutdown-2.PML 240694 KB 6/9/2008 6:29:04 PM
shutdown-3.PML 274782 KB 6/9/2008 6:29:34 PM
shutdown-4.PML 356577 KB 6/9/2008 6:31:04 PM
shutdown-5.PML 141514 KB 6/9/2008 6:31:04 PM

There's nothing readable in any of these files. and considering their size,
even if they were readable, I could spend the rest of my life poring over
them.

After all this - still no Dr. Watson logs.


Tom

 

[John John (MVP)]

I'm having a bit of trouble finding out how to use Process Monitor. The
help file is apparently unusable since the systinternals website was
swallowed up by Microsoft. All I get no matter what I click on says "the
address is not valid" or "navigation to the web page was cancelled".

Read here:
http://forum.sysinternals.com/forum_posts.asp?TID=12369&PID=56217 the
same applies to Process Monitor.

I started Process Monitor and then restarted the system. After the restart,
when I ran Process Monitor again, it asked me if I wanted to save the boot
log. I said yes, and after nearly 10 minutes of crunching

I don't know what is going on with your computer but after enabling the
boot logging option and going through a reboot/shutdown cycle, when I
launch Process Monitor it saves only one file and it takes less than a
minute to do it.

There's nothing readable in any of these files. and considering their size,
even if they were readable, I could spend the rest of my life poring over
them.

You have to open the saved log file with Process Monitor. Yes the files
are very large, when Windows boots it queries the registry about 75,000
times and more, it could easily do 200,000 queries. In addition to that
information all the file system activity is recorded, that is a lot of
information to be gathered! The trick is to look for activity during
the shutdown period to see if anything looks suspicious, yes it is
tedious but I'm out of ideas, unless someone else has a better idea to
help track it down I don't know what to suggest. When you go to
shutdown the computer keep an eye on the clock and only start the
shutdown at exactly the same time as the minute changes, then when you
look in the log files look at the the activity starting at the same
minute counter, this will narrow it down a bit, but yes, there is still
a lot of stuff to weed through!

After all this - still no Dr. Watson logs.

Maybe it's too late in the shutdown process for Dr. Watson to create
log/dumd files. Dwwin.exe is the Error Reporting part of the tool, it
creates an XML file to be sent along with the microdump file, search
your hard drive for files created in the last day and look for files
created or modified at the shutdown time, you may be able to find
something that way.

If you want to test Dr. Watson's ability to create log/dump files just
open Task Manager and record the PID number of a process that can be
terminated without affecting the stability of the Windows session, you
could start Notepad for example and use the PID for it. Then in the
Start Menu Run box enter the following command:

drwtsn32 -p PID Number

John

 

[Tom Hall]

I don't know what is going on with your computer but after enabling the
boot logging option and going through a reboot/shutdown cycle, when I
launch Process Monitor it saves only one file and it takes less than a
minute to do it.

After enabling boot logging, I started ProcMon and then immediately
initiated a restart. AFAIK ProcMon did not start up automatically when the
system came back up. I started ProcMon manually and I thinki that's when it
asked me if I wanted to save the boot log information. I said yes, and
that's when it crunched away until it had created 6 files, each about
150-200 mb in size.

Unfortunately, another issue surfaced WRT my ftp server which I
occasionally turn on so clients can upload files. The server was last used
in March, and when I started it yesterday, it refused all connections,
saying an error (unspecified) occurred while trying to open port 21.

I had port 21 opened through the router and in the past clients had no
trouble accessing the server. The only significant change I had made to the
system between March and now was the addition of Service Pack 3, so I
decided to roll back to SP2 to see if that fixed the problem.

Unfortunately, the computer locked up in the middle of the rollback after
it appeared to have copied a bunch of dll and exe files to system32. Even
though it appeared that spuninst had copied back all the SP2 files, when I
rebooted the system, it still identified itself as SP3, so I attempted to
continue the uninstall.

At this point Windows warned me that a whole bunch of hardware "might" not
work if I proceeded with the rollback, and the list of potentially affected
devices was quite long, so I elected to abort the rollback at that point.

The effect of all this is that the Event ID entries no longer appear in the
Event Log, even though the message box continues to appear at every
shutdown or restart. In place of the event ID 26 entries, there are two
errors which appear related:

Event Type: Error
Event Source: Rasman
Event Category: None
Event ID: 20132
Date: 6/11/2008
Time: 9:12:08 AM
User: N/A
Computer: TOM
Description:
Remote Access Connection Manager failed to start because the RAS RPC module
failed to initialize. The specified procedure could not be found.


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7f 00 00 00 ...

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 6/11/2008
Time: 9:12:09 AM
User: N/A
Computer: TOM
Description:
The Remote Access Connection Manager service terminated with the following
error:
The specified procedure could not be found.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

The system _appears_ to be running normally. Everything that needs to work
does work - except for the FTP server (GuildFTP 0.999.14).

At this point I'm wondering whether to ignore the warnings and attempt to
rollback to SP2 again, attempt to reinstall SP3 (I downloaded the last
release candidate for SP3 a few days before it was officially released), or
leave well enough alone and continue on until the system falls over.


Tom

 

[John John (MVP)]

I had port 21 opened through the router and in the past clients had no
trouble accessing the server. The only significant change I had made to the
system between March and now was the addition of Service Pack 3, so I
decided to roll back to SP2 to see if that fixed the problem.

Unfortunately, the computer locked up in the middle of the rollback after
it appeared to have copied a bunch of dll and exe files to system32. Even
though it appeared that spuninst had copied back all the SP2 files, when I
rebooted the system, it still identified itself as SP3, so I attempted to
continue the uninstall.

At this point Windows warned me that a whole bunch of hardware "might" not
work if I proceeded with the rollback, and the list of potentially affected
devices was quite long, so I elected to abort the rollback at that point.

[snip]

At this point I'm wondering whether to ignore the warnings and attempt to
rollback to SP2 again, attempt to reinstall SP3 (I downloaded the last
release candidate for SP3 a few days before it was officially released), or
leave well enough alone and continue on until the system falls over.

Installing Beta and RC software is always a risky business and should
only be done on test machines that you are willing to flatten and
rebuild when things go wrong. Also, applying a service pack to a
machine already experiencing problems is usually a bad idea unless there
are specific fixes for the problems in the service pack. In view of the
different problems that you are experiencing I can only suggest that you
try a repair install or that you flatten the box and rebuild it.

John

 

[Tom Hall]

Installing Beta and RC software is always a risky business and should
only be done on test machines that you are willing to flatten and
rebuild when things go wrong.

This was actually my second rollback to SP2. My first upgrade to SP3 was
done with the RC I downloaded. After the first rollback which was
uneventful, I later reinstalled SP3 through Windows Update.

It was the second attempted rollback that produced the problems. However, a
second attempt succeeded, although I had to go through the activation
process afterwards.

Also, applying a service pack to a
machine already experiencing problems is usually a bad idea unless there
are specific fixes for the problems in the service pack. In view of the
different problems that you are experiencing I can only suggest that you
try a repair install or that you flatten the box and rebuild it.

I have a recovery CD that came with the computer when I bought it from a
retail outlet. I was prepared to use it if all else failed.

At the moment, I'm running with SP2 and everything seems to be fine, with
one exception. At startup, I'm getting a new error in the event log:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/12/2008
Time: 9:25:54 AM
User: N/A
Computer: TOM
Description:
The Upload Manager service failed to start due to the following error:
The account specified for this service is different from the account
specified for other services running in the same process.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

When I try to start the service manually, I get the same error message, but
preceded by "Error 1079".

Someone once told me that my life would be a lot simpler if I ignored the
Event Log unless there were clearly evident problems with the machine.
AFAIK, everything here is running as it should. If this error in the Event
Log goes unsolved, what wall am I likely to hit down the road?

By the way, thank you for all the help you've given me on the situation
thus far.


Tom

 

[Tom Hall]

At the moment, I'm running with SP2 and everything seems to be fine, with
one exception. At startup, I'm getting a new error in the event log:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/12/2008
Time: 9:25:54 AM
User: N/A
Computer: TOM
Description:
The Upload Manager service failed to start due to the following error:
The account specified for this service is different from the account
specified for other services running in the same process.

I think I may have fixed the problem. I checked the service and it was set
to log on as a network service, so I changed it to local system and then
was able to start the service manually.

This computer is not networked with any other machines, so I'm not sure if
the Upload Manager is something that would significantly impact the system
in any case.


Tom