Okay, happened again. I left my laptop powered on and with the lid closed. Came back 8 hours later and found it turned off. When powered on it came up in recovery mode and notified me that windows did not shutdown correctly. I chose not to boot to safe mode. Checked the event viewer and found what is in the code box.
Code:
Log Name: Security
Source: Microsoft-Windows-Eventlog
Date: 12/26/2010 10:18:42 PM
Event ID: 1101
Task Category: Event processing
Level: Error
Keywords: Audit Success
User: N/A
Computer: TheBells-PC
Description:
Audit events have been dropped by the transport. 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Eventlog" Guid="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" />
<EventID>1101</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>101</Task>
<Opcode>0</Opcode>
<Keywords>0x4020000000000000</Keywords>
<TimeCreated SystemTime="2010-12-27T04:18:42.894030500Z" />
<EventRecordID>17860</EventRecordID>
<Correlation />
<Execution ProcessID="980" ThreadID="1032" />
<Channel>Security</Channel>
<Computer>TheBells-PC</Computer>
<Security />
</System>
<UserData>
<AuditEventsDropped xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog">
<Reason>0</Reason>
</AuditEventsDropped>
</UserData>
</Event>
Don't know what this one is.
Code:
Log Name: Microsoft-Windows-Kernel-EventTracing/Admin
Source: Microsoft-Windows-Kernel-EventTracing
Date: 12/26/2010 10:18:35 PM
Event ID: 3
Task Category: Session
Level: Error
Keywords: Session
User: SYSTEM
Computer: TheBells-PC
Description:
Session "Microsoft Security Essentials OOBE" stopped due to the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
<EventID>3</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>14</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime="2010-12-27T04:18:35.374817300Z" />
<EventRecordID>36</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="148" />
<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
<Computer>TheBells-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SessionName">Microsoft Security Essentials OOBE</Data>
<Data Name="FileName">C:\ProgramData\Microsoft\Microsoft Security Essentials\Support\MSSEOOBE.etl</Data>
<Data Name="ErrorCode">3221225485</Data>
<Data Name="LoggingMode">5</Data>
</EventData>
</Event>
I'm assuming the above code is referring to Microsoft Security Essentials ending prematurely due to this unexpected shutdown event.
Code:
Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: 12/26/2010 10:18:33 PM
Event ID: 41
Task Category: (63)
Level: Critical
Keywords: (2)
User: SYSTEM
Computer: TheBells-PC
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>41</EventID>
<Version>2</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000002</Keywords>
<TimeCreated SystemTime="2010-12-27T04:18:33.097213300Z" />
<EventRecordID>19536</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>TheBells-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BugcheckCode">0</Data>
<Data Name="BugcheckParameter1">0x0</Data>
<Data Name="BugcheckParameter2">0x0</Data>
<Data Name="BugcheckParameter3">0x0</Data>
<Data Name="BugcheckParameter4">0x0</Data>
<Data Name="SleepInProgress">false</Data>
<Data Name="PowerButtonTimestamp">0</Data>
</EventData>
</Event>
This must be the unexpected shutdown.
Code:
Log Name: System
Source: EventLog
Date: 12/26/2010 10:18:41 PM
Event ID: 6008
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: TheBells-PC
Description:
The previous system shutdown at 4:24:49 PM on 12/26/2010 was unexpected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="EventLog" />
<EventID Qualifiers="32768">6008</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-12-27T04:18:41.000000000Z" />
<EventRecordID>19530</EventRecordID>
<Channel>System</Channel>
<Computer>TheBells-PC</Computer>
<Security />
</System>
<EventData>
<Data>4:24:49 PM</Data>
<Data>12/26/2010</Data>
<Data>
</Data>
<Data>
</Data>
<Data>63803</Data>
<Data>
</Data>
<Data>
</Data>
<Binary>DA070C0000001A001000180031000E02DA070C0000001A001600180031000E02080700003C0000000100000008070000000000008403000001000000D8050000</Binary>
</EventData>
</Event>
This deals with the shutdown as well.
Code:
Log Name: System
Source: bowser
Date: 12/26/2010 10:44:14 AM
Event ID: 8003
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: TheBells-PC
Description:
The master browser has received a server announcement from the computer B-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{F531C2C4-12DE-45B2-9427-154318ECFAFF}. The master browser is stopping or an election is being forced.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="bowser" />
<EventID Qualifiers="49152">8003</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-12-26T16:44:14.343139000Z" />
<EventRecordID>19517</EventRecordID>
<Channel>System</Channel>
<Computer>TheBells-PC</Computer>
<Security />
</System>
<EventData>
<Data>\Device\LanmanDatagramReceiver</Data>
<Data>B-PC</Data>
<Data>NetBT_Tcpip_{F531C2C4-12DE-45B2-9427-154318ECFAFF}</Data>
<Binary>000000000300320000000000431F00C0000000000000000000000000000000000000000000000000</Binary>
</EventData>
</Event>
And I have no idea what this means. Root cause of my problem, perhaps?