I was able to run the commands, however there were a couple that failed to load, another couple loaded but failed to call the dll register server, and one that also loaded but failed to find the entry-point of the dll register server.
Something interesting that I noticed was that the VSS and SWPRV services said they were not running. However, VSS is set to start automatically and SWPRV is set to start manually.
At the end, the result was still the same, no writers displayed.
OK - let's have a look elsewhere in the registry...
Please open an Elevated Command prompt, and run the following command
REG QUERY HKLM\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216} /S
post the results.
Here it is!
I truly appreciate all the help you are giving!Code:Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Windows\system32>REG QUERY HKLM\Software\Microsoft\EventSystem\{26c409cc-ae86 -11d1-b616-00805fc79216} /S HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{BB07BACD-CD56-4e63-A8FF-CBF0355FB9F4}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 AllowInprocActivation REG_DWORD 0x0 Description REG_SZ Subscribe to this event class to receive object cha nge notifications. EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassID REG_SZ {BB07BACD-CD56-4e63-A8FF-CBF0355FB9F4} EventClassName REG_SZ EventSystem.EventObjectChange2 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} FireInParallel REG_DWORD 0xffffffff FiringInterfaceIID REG_SZ {7701A9C3-BD68-438f-83E0-67BF4F53A422} OwnerSID REG_SZ S-1-5-18 PublisherID REG_SZ {BB07BACD-CD56-4e63-A8FF-CBF0355FB9F4} TypeLib REG_EXPAND_SZ %systemroot%\system32\es.dll HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{D0565000-9DF4-11D1-A281-00C04FCA0AA7}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 AllowInprocActivation REG_DWORD 0x0 Description REG_SZ Subscribe to this event class to receive object cha nge notifications EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassID REG_SZ {D0565000-9DF4-11D1-A281-00C04FCA0AA7} EventClassName REG_SZ EventSystem.EventObjectChange EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} FireInParallel REG_DWORD 0xffffffff FiringInterfaceIID REG_SZ {F4A07D70-2E25-11D1-9964-00C04FBBB345} OwnerSID REG_SZ S-1-5-18 PublisherID REG_SZ {D0564C30-9DF4-11D1-A281-00C04FCA0AA7} TypeLib REG_EXPAND_SZ %systemroot%\system32\es.dll HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{D5978620-5B9F-11D1-8DD2-00AA004ABD5E}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 EventClassID REG_SZ {D5978620-5B9F-11D1-8DD2-00AA004ABD5E} EventClassName REG_SZ SENS Network Events OwnerSID REG_SZ S-1-5-18 FiringInterfaceIID REG_SZ {D597BAB1-5B9F-11D1-8DD2-00AA004ABD5E} AllowInprocActivation REG_DWORD 0xffffffff FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{D5978630-5B9F-11D1-8DD2-00AA004ABD5E}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 EventClassID REG_SZ {D5978630-5B9F-11D1-8DD2-00AA004ABD5E} EventClassName REG_SZ SENS Logon Events OwnerSID REG_SZ S-1-5-18 FiringInterfaceIID REG_SZ {D597BAB3-5B9F-11D1-8DD2-00AA004ABD5E} AllowInprocActivation REG_DWORD 0xffffffff FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} SerialFiringTimeout REG_DWORD 0x2bf20 HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{D5978640-5B9F-11D1-8DD2-00AA004ABD5E}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 EventClassID REG_SZ {D5978640-5B9F-11D1-8DD2-00AA004ABD5E} EventClassName REG_SZ SENS OnNow Events OwnerSID REG_SZ S-1-5-18 FiringInterfaceIID REG_SZ {D597BAB2-5B9F-11D1-8DD2-00AA004ABD5E} AllowInprocActivation REG_DWORD 0xffffffff FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{D5978650-5B9F-11D1-8DD2-00AA004ABD5E}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 EventClassID REG_SZ {D5978650-5B9F-11D1-8DD2-00AA004ABD5E} EventClassName REG_SZ SENS Logon2 Events OwnerSID REG_SZ S-1-5-18 FiringInterfaceIID REG_SZ {D597BAB4-5B9F-11D1-8DD2-00AA004ABD5E} AllowInprocActivation REG_DWORD 0xffffffff FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} SerialFiringTimeout REG_DWORD 0x2bf20 HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{ECABB0C3-7F19-11D2-978E-0000F8757E2A}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 AllowInprocActivation REG_DWORD 0xffffffff EventClassID REG_SZ {ECABB0C3-7F19-11D2-978E-0000F8757E2A} EventClassName REG_SZ ComEvents.ComServiceEvents FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} OwnerSID REG_SZ S-1-5-18 Typelib REG_EXPAND_SZ %windir%\system32\comsvcs.dll HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{ECABB0C6-7F19-11D2-978E-0000F8757E2A}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 AllowInprocActivation REG_DWORD 0xffffffff EventClassID REG_SZ {ECABB0C6-7F19-11D2-978E-0000F8757E2A} EventClassName REG_SZ ComEvents.ComSystemAppEventData FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} OwnerSID REG_SZ S-1-5-18 Typelib REG_EXPAND_SZ %windir%\system32\comsvcs.dll HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 EventClassID REG_SZ {FAF53CC4-BD73-4E36-83F1-2B23F46E513E} EventClassName REG_SZ VssEvent OwnerSID REG_SZ S-1-5-18 TypeLib REG_EXPAND_SZ %systemroot%\system32\EVENTCLS.DLL AllowInprocActivation REG_DWORD 0xffffffff FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} C:\Windows\system32>
There's one entry missing there - but I don't know if it's of any importance or not :s
Let's see if adding it makes any difference...
Please open an Elevated Command Prompt, and run the following command...
reboot and see if the list is now populating properly.Code:REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions /ve .
Looks like it did add the entry
Code:Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Windows\system32>REG QUERY HKLM\Software\Microsoft\EventSystem\{26c409cc-ae86 -11d1-b616-00805fc79216} /S HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{BB07BACD-CD56-4e63-A8FF-CBF0355FB9F4}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 AllowInprocActivation REG_DWORD 0x0 Description REG_SZ Subscribe to this event class to receive object cha nge notifications. EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassID REG_SZ {BB07BACD-CD56-4e63-A8FF-CBF0355FB9F4} EventClassName REG_SZ EventSystem.EventObjectChange2 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} FireInParallel REG_DWORD 0xffffffff FiringInterfaceIID REG_SZ {7701A9C3-BD68-438f-83E0-67BF4F53A422} OwnerSID REG_SZ S-1-5-18 PublisherID REG_SZ {BB07BACD-CD56-4e63-A8FF-CBF0355FB9F4} TypeLib REG_EXPAND_SZ %systemroot%\system32\es.dll HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{D0565000-9DF4-11D1-A281-00C04FCA0AA7}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 AllowInprocActivation REG_DWORD 0x0 Description REG_SZ Subscribe to this event class to receive object cha nge notifications EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassID REG_SZ {D0565000-9DF4-11D1-A281-00C04FCA0AA7} EventClassName REG_SZ EventSystem.EventObjectChange EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} FireInParallel REG_DWORD 0xffffffff FiringInterfaceIID REG_SZ {F4A07D70-2E25-11D1-9964-00C04FBBB345} OwnerSID REG_SZ S-1-5-18 PublisherID REG_SZ {D0564C30-9DF4-11D1-A281-00C04FCA0AA7} TypeLib REG_EXPAND_SZ %systemroot%\system32\es.dll HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{D5978620-5B9F-11D1-8DD2-00AA004ABD5E}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 EventClassID REG_SZ {D5978620-5B9F-11D1-8DD2-00AA004ABD5E} EventClassName REG_SZ SENS Network Events OwnerSID REG_SZ S-1-5-18 FiringInterfaceIID REG_SZ {D597BAB1-5B9F-11D1-8DD2-00AA004ABD5E} AllowInprocActivation REG_DWORD 0xffffffff FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{D5978630-5B9F-11D1-8DD2-00AA004ABD5E}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 EventClassID REG_SZ {D5978630-5B9F-11D1-8DD2-00AA004ABD5E} EventClassName REG_SZ SENS Logon Events OwnerSID REG_SZ S-1-5-18 FiringInterfaceIID REG_SZ {D597BAB3-5B9F-11D1-8DD2-00AA004ABD5E} AllowInprocActivation REG_DWORD 0xffffffff FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} SerialFiringTimeout REG_DWORD 0x2bf20 HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{D5978640-5B9F-11D1-8DD2-00AA004ABD5E}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 EventClassID REG_SZ {D5978640-5B9F-11D1-8DD2-00AA004ABD5E} EventClassName REG_SZ SENS OnNow Events OwnerSID REG_SZ S-1-5-18 FiringInterfaceIID REG_SZ {D597BAB2-5B9F-11D1-8DD2-00AA004ABD5E} AllowInprocActivation REG_DWORD 0xffffffff FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{D5978650-5B9F-11D1-8DD2-00AA004ABD5E}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 EventClassID REG_SZ {D5978650-5B9F-11D1-8DD2-00AA004ABD5E} EventClassName REG_SZ SENS Logon2 Events OwnerSID REG_SZ S-1-5-18 FiringInterfaceIID REG_SZ {D597BAB4-5B9F-11D1-8DD2-00AA004ABD5E} AllowInprocActivation REG_DWORD 0xffffffff FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} SerialFiringTimeout REG_DWORD 0x2bf20 HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{ECABB0C3-7F19-11D2-978E-0000F8757E2A}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 AllowInprocActivation REG_DWORD 0xffffffff EventClassID REG_SZ {ECABB0C3-7F19-11D2-978E-0000F8757E2A} EventClassName REG_SZ ComEvents.ComServiceEvents FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} OwnerSID REG_SZ S-1-5-18 Typelib REG_EXPAND_SZ %windir%\system32\comsvcs.dll HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{ECABB0C6-7F19-11D2-978E-0000F8757E2A}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 AllowInprocActivation REG_DWORD 0xffffffff EventClassID REG_SZ {ECABB0C6-7F19-11D2-978E-0000F8757E2A} EventClassName REG_SZ ComEvents.ComSystemAppEventData FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} OwnerSID REG_SZ S-1-5-18 Typelib REG_EXPAND_SZ %windir%\system32\comsvcs.dll HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000 -0000-000000000000}-{00000000-0000-0000-0000-000000000000} Active REG_DWORD 0x1 EventClassID REG_SZ {FAF53CC4-BD73-4E36-83F1-2B23F46E513E} EventClassName REG_SZ VssEvent OwnerSID REG_SZ S-1-5-18 TypeLib REG_EXPAND_SZ %systemroot%\system32\EVENTCLS.DLL AllowInprocActivation REG_DWORD 0xffffffff FireInParallel REG_DWORD 0x0 EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000} EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000} HKEY_LOCAL_MACHINE\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805 fc79216}\Subscriptions (Default) REG_SZ C:\Windows\system32>
Quote