New
#11
There is nothing recorded in the event logs during safe mode stage. There is an error recorded after booting into normal mode
"The previous system shutdown at <time> on <date> was unexpected." event ID 6008
To me it pointing towards a corrupt file or could it be a registry setting. I would have thought this would have been fixed when I performed the repair install.
"The previous system shutdown at <time> on <date> was unexpected." event ID 6008... so a crash. Tell me details about this event in event log.[/QUOTE]
See attached screenshot of event...I hope that is what you are looking for.
There is no bluescreen dump file created. The current setting for bluescreen is kernel memory dump. It is really looking like I will need to rebuild the machine from scratch.
Not one thing is written to the event log during the safe mode boot process.
I checked what services are started in safe mode on my laptop and there is only svchost.exe and lsass.exe Both of these executable would be used in normal mode as well which works fine. I am thinking it could be a driver file which is replaced by the proper hardware driver in normal mode. What do you think?
I am running out of time...they want their laptop back at the end of the weekend. So If I need to rebuild it then I really need to start Friday They are not comfortable not being able to boot into safe mode if there is a problem.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot has all the services that start in safemode. There are a lot! Even EventLog is in that list so Events will be logged in eventlog and eventviewer works. Many events should be logged in eventlog during safe mode. Unless.... it crashes before eventlog service is running.
svchost.exe isn't a service. It is sort of container that runs multiple services svchost.exe - Wikipedia, the free encyclopedia