Solved need someone to look up some system info on your PC

[JimLewandowski]

Hmmm. I'm not super up on the registry but found this strange difference (remember I didn't manually edit the registry for CKCL until yesterday).

My EnableKernelFlags are set as a DWORD (which I thought was what it ought to be as on the EVENT_TRACE_PROPERTIES struct it is defined as ulong (unsigned, 32-bit, 4-byte field). Brink's is a hex string of 32 bytes (found one webpage on the net that has your hex string for that field but has 36 bytes instead of your 32).

Can anyone who has Win7 PRO screen print your registry (right pane) for:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger

 

[Brink]

Jim,

This top one is from Windows 7 Ultimate 64-bit, and the bottom one from Windows 7 Pro 32-bit on a VM.

 

[JimLewandowski]

Jim,

This top one is from Windows 7 Ultimate 64-bit, and the bottom one from Windows 7 Pro 32-bit on a VM.

Well, my guess is, it doesn't matter if it's a DWORD or a hex string as only the first 4 bytes of the field will be accessed any way. I may change it tonight to test.

However, I think I can rule out security-related as I'm not getting a 0xC0000005 (security) error code. I'm getting 0x57 (invalid parameter).

But, my CKCL starts MANUALLY but won't via whatever (DPS service??) mode it starts at bootup time. How can that be?

 

[JimLewandowski]

Brink, can you screen print the security list on the primary CKCL GUI screen for the Win7 Pro machine you have access to?

 

[Brink]

Here you go.

Windows 7 Pro - Startup Event Trace Session - Security tab for CKCL

 

[JimLewandowski]

Well, that is strange. I clearly didn't delete any SIDs for my CKCL as that...would...be...crazy.

OK final reqeust. Honest.

In one post, from a Win7 PRO machine, exported registry for just the CKCL GUID security (under SECURITY key) and exported registry for the CKCL itself (under WMI key).

I'll export my 2 entries, save it and import this and see if that fixes things.

 

[Brink]

LOL, no problem.

 

[JimLewandowski]

Perfect.

The next question is, if I were to export and then delete the security and CKCL branches, and then import the 2 you have provided above, would DPS and WmiServiceHost appear on the SECURITY panel for CKCL? IOW, what in that long hex security string identifies: System, Administrator, DPS, WmiServiceHost?

Before doing that, I'll export my security branch, add a new SID to CKCL and then look at the registry to see what's been put in to help identify how that security string is encoded. It's almost as if it might have a SID # that is an entry into a Master SID table. Like when you want to assign a new SID to something, you click on advanced and get that long list of A-Z types of "users" of windows.

 

[JimLewandowski]

Well, I imported the 2 PRO keys (security and CKCL) into my registry last night. I then checked the GUI and DPS and WdiServiceHost were in the list on the primary CKCL screen.

So, there is either a definite bug as I was able to get the registry for CKCL in a state that the GUI couldn't handle (certain options greyed out, other parameters in an illegal/functional state) OR CKCL should not be touched whatsoever.

Here is the best part: with my EnableKernelFlags now set to a binary/hex (32-byte) string VS. the DWORD that was there, even though it is 05 02 00 00 ......, on the main GUI panel, the Keywords(ALL) shows 0x00000000. So, CKCL is definitely treated differently as it's not wanting to display what truly the flags are set to.

Upon next boot, I should have CKCL all back to normal. A good learning experience nonetheless. Thanks B for the help.

 

[Brink]

You're most welcome Jim. I'm just glad that you were able to get it sorted.

 

[JimLewandowski]

CKCL is alive. It's aalllliiiiiiiiiiiiiiiiiiiiiiiiiive!

:shock:

 

[Brink]