Windows Update - Reverting Changes

r44712 · 29 Nov 2014

Thanks for the reply, here are the details:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
MessageFileName REG_EXPAND_SZ %SystemRoot%\system32\PortableDeviceSyncProvider.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WABSyncProvider/Analytic
OwningPublisher REG_SZ {17f14a23-551d-40cc-a086-e4194d64ed4c}
Enabled REG_DWORD 0x0
Isolation REG_DWORD 0x1
ChannelAccess REG_SZ O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;
;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)
(A;;0x1;;;S-1-5-32-573)
Type REG_DWORD 0x2

I've attached another CBS log, too, having tried another update install....

r44712 · 29 Nov 2014

r44712 said:

Thanks for the reply, here are the details:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
MessageFileName REG_EXPAND_SZ %SystemRoot%\system32\PortableDeviceSyncProvider.dll

Interestingly, I ran the same command on my Win7 "Home Premium" Laptop and got 'more results', I'm guessing some registry keys are missing?:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{
17f14a23-551d-40cc-a086-e4194d64ed4c}
(Default) REG_SZ Microsoft-Windows-WABSyncProvider
ResourceFileName REG_EXPAND_SZ %SystemRoot%\system32\WABSyncProvider.d
ll
MessageFileName REG_EXPAND_SZ %SystemRoot%\system32\PortableDeviceSync
Provider.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{
17f14a23-551d-40cc-a086-e4194d64ed4c}\ChannelReferences

Incidentally, I'm a developer for a Microsoft stack product, so don't worry about simplifying your answers too much....

Thanks in advance.

NoelDP · 29 Nov 2014

There does appear to be data missing there...

Here's my output from the same commands...

Code:

C:\Users\Spare>reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
    (Default)    REG_SZ    Microsoft-Windows-WABSyncProvider
    ResourceFileName    REG_EXPAND_SZ    %SystemRoot%\system32\WABSyncProvider.dll
    MessageFileName    REG_EXPAND_SZ    %SystemRoot%\system32\PortableDeviceSyncProvider.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}\ChannelReferences
 
C:\Users\Spare>reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
    (Default)    REG_SZ    Microsoft-Windows-WABSyncProvider
    ResourceFileName    REG_EXPAND_SZ    %SystemRoot%\system32\WABSyncProvider.dll
    MessageFileName    REG_EXPAND_SZ    %SystemRoot%\system32\PortableDeviceSyncProvider.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}\ChannelReferences
    Count    REG_DWORD    0x1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}\ChannelReferences\0
    (Default)    REG_SZ    Microsoft-Windows-WABSyncProvider/Analytic
    Id    REG_DWORD    0x10
    Flags    REG_DWORD    0x0

I have to admit that this is an area I've not delved into before - so all bets are off

Perhaps copying the relevant data from the 'good' machine will work - but I can't be sure without extensive testing (and I don't have the proper baseline to work from

)

r44712 · 29 Nov 2014

NoelDP said:

There does appear to be data missing there...

Here's my output from the same commands...

Code:

C:\Users\Spare>reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
    (Default)    REG_SZ    Microsoft-Windows-WABSyncProvider
    ResourceFileName    REG_EXPAND_SZ    %SystemRoot%\system32\WABSyncProvider.dll
    MessageFileName    REG_EXPAND_SZ    %SystemRoot%\system32\PortableDeviceSyncProvider.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}\ChannelReferences

I have to admit that this is an area I've not delved into before - so all bets are off

Perhaps copying the relevant data from the 'good' machine will work - but I can't be sure without extensive testing (and I don't have the proper baseline to work from

)

I started with grafting them over from the good machine, but Googling {17f14a23-551d-40cc-a086-e4194d64ed4c} brought up a TechNet article, that suggested deleting all of the sub-entries in WINEVT (risky I know), but this did the trick. All up and running again, thanks!

Incidentally, what sort of events in the CBS Log should I be looking for in case that this happens again (thanks for any tips)?