Windows Events — Event ID Reference & Troubleshooting

Windows Event ID 1008 – Perflib: Performance Counter Provider Load Failure

Event ID 1008 indicates a performance counter provider failed to load or initialize properly. This warning typically affects system monitoring tools and performance data collection without impacting core functionality.

Windows Event ID 1005 – DCOM: Distributed COM Service Startup Failure

Event ID 1005 indicates a DCOM service failed to start within the configured timeout period, typically affecting COM+ applications and distributed services on Windows systems.

Windows Event ID 1004 – Application Error: Application Crash or Hang Detection

Event ID 1004 indicates an application has crashed, hung, or encountered a critical error. This event helps administrators track application stability and identify problematic software across Windows systems.

Windows Event ID 1003 – Application Error: Application Crash or Hang Detection

Event ID 1003 indicates an application crash or hang detected by Windows Error Reporting. This critical event logs when applications terminate unexpectedly or become unresponsive, requiring immediate investigation.

Windows Event ID 903 – Microsoft-Windows-Kernel-General: System Time Changed

Event ID 903 indicates the system time has been changed, either manually by a user or automatically through time synchronization services. Critical for security auditing and compliance tracking.

Windows Event ID 902 – DNS Client: DNS Query Timeout or Resolution Failure

Event ID 902 indicates DNS client query timeouts or resolution failures when Windows cannot resolve domain names within the configured timeout period.

Windows Event ID 900 – Kernel-General: System Boot Performance Monitoring

Event ID 900 tracks Windows boot performance metrics, recording system startup times and boot phases. Generated by Kernel-General during system initialization to monitor boot duration and identify performance bottlenecks.

Windows Event ID 326 – Volsnap: Volume Shadow Copy Service Writer Error

Event ID 326 indicates a Volume Shadow Copy Service (VSS) writer error during backup operations. This event fires when VSS writers fail to complete snapshot creation or encounter timeout issues.

Windows Event ID 325 – System: Boot Configuration Data Store Corruption

Event ID 325 indicates corruption or issues with the Boot Configuration Data (BCD) store, typically occurring during system startup when Windows cannot properly read boot configuration settings.

Windows Event ID 302 – Unknown: System Process or Service Initialization Event

Event ID 302 indicates a system process or service initialization event that occurs during Windows startup or service management operations, typically logged when core system components begin their initialization sequence.

Windows Event ID 301 – Unknown: System Performance Counter Collection Error

Event ID 301 indicates a performance counter collection failure or registry corruption affecting system monitoring capabilities and performance data gathering.

Windows Event ID 300 – Unknown: Generic Application or System Event

Event ID 300 from an unknown source typically indicates a generic application or system event that requires investigation to determine the actual source and significance.

Windows Event ID 264 – DNS Client: DNS Query Response Timeout

Event ID 264 indicates DNS query timeouts from the Windows DNS Client service, typically occurring when DNS servers fail to respond within the configured timeout period.

Windows Event ID 258 – System: Process Termination with Exit Code

Event ID 258 indicates a process has terminated with a specific exit code, often signaling application crashes, forced terminations, or abnormal process endings that require investigation.

Windows Event ID 256 – Unknown: Generic Application or System Error Event

Event ID 256 represents a generic error condition from an unspecified source, often indicating application crashes, service failures, or system component issues requiring detailed investigation.

Windows Event ID 105 – Microsoft-Windows-Kernel-Power: System Power State Transition

Event ID 105 from Microsoft-Windows-Kernel-Power indicates system power state transitions, typically when Windows enters or exits sleep, hibernate, or shutdown states. Critical for power management troubleshooting.

Windows Event ID 102 – Microsoft-Windows-Kernel-Power: System Power State Transition

Event ID 102 indicates a system power state transition, typically when Windows enters or exits sleep, hibernate, or shutdown states. Critical for diagnosing power management issues.

Windows Event ID 63 – Service Control Manager: Service Start Pending Timeout

Event ID 63 indicates a Windows service failed to start within the configured timeout period. This critical event helps identify service startup issues and potential system performance problems.

Windows Event ID 45 – Kernel-Power: System Power State Transition

Event ID 45 from Kernel-Power indicates a system power state transition, typically when Windows enters or exits sleep, hibernate, or shutdown states. Critical for power management troubleshooting.

Windows Event ID 32 – EventLog: File System Redirector

Event ID 32 indicates the File System Redirector has started successfully. This informational event confirms that Windows file system redirection services are operational and ready to handle file system requests.

Windows Event ID 31 – System: Service Control Manager Timeout

Event ID 31 indicates a service failed to respond to a start or control request within the timeout period, typically 30 seconds, causing the Service Control Manager to log this warning.