many VSS errors in a fresh nlited XP

[ddead]

yesterday I've installed a nlited windows xp pro sp3. using nlite v1.4.9.1 + SP3 + xable-SP3-UpdatePack-September-v1.0.4a

everything seems ok except that I noticed there are about a hundred VSS errors and a few warning in Event Viewer.

I have not installed anything except audio/video/Ethernet drivers and firefox. so I'm curious why so many errors (and warnings).

here is what happened in Event Viewer:

*** first there are a few information messages.

then there are the first kind of warnings

Event Type: Warning

Event Source: WinMgmt

Event Category: None

Event ID: 63

Date: 10/9/2008

Time: 2:00:49 AM

User: NT AUTHORITY\SYSTEM

Computer: DEVILDOLL

Description:

A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

***3 information messages

then 2nd kind of warnings

Event Type: Warning

Event Source: WinMgmt

Event Category: None

Event ID: 5603

Date: 10/9/2008

Time: 2:03:11 AM

User: NT AUTHORITY\SYSTEM

Computer: DEVILDOLL

Description:

A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

***information messages

then there are many VSS errors. here is one of them.

Event Type: Error

Event Source: VSS

Event Category: None

Event ID: 12289

Date: 10/9/2008

Time: 3:53:43 AM

User: N/A

Computer: DEVILDOLL

Description:

The description for Event ID ( 12289 ) in Source ( VSS ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: OpenService (shSCManager, 'VSS', SERVICE_QUERY_STATUS), 0x80070424.

Data:

0000: 57 53 48 57 53 48 4d 43 WSHWSHMC

0008: 31 39 39 35 00 00 00 00 1995....

0010: 57 53 48 57 53 48 4d 43 WSHWSHMC

0018: 31 39 35 37 00 00 00 00 1957....

then there is one occurrence of the 3rd kind of warning in the middle of these many VSS errors

Event Type: Warning

Event Source: Userenv

Event Category: None

Event ID: 1517

Date: 10/9/2008

Time: 6:04:01 PM

User: NT AUTHORITY\SYSTEM

Computer: DEVILDOLL

Description:

Windows saved user DEVILDOLL\Devildoll registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

please find attached my nlite config file.

thanks in advance for any help

LAST_SESSION.INI

[GrofLuigi]

The first two are warnings, nothing important, Windows (WMI) feels obliged to notify you of something it doesn't like.

VSS is volume shadow copy. You removed it, but some other program is trying to call/notify it (I've seen Defrag do it, probably Backup and other programs). It's also nothing serious.

For the last error you need this, but ideally you should find the real cause. Often (always?) it happens during shutdown when there is a hung ("not responding") program or driver.

From the timestamp of the events you may try to remember which programs you were running at that time.

GL

Edited October 10, 2008 by GrofLuigi

[ddead]

The first two are warnings, nothing important, Windows (WMI) feels obliged to notify you of something it doesn't like.

VSS is volume shadow copy. You removed it, but some other program is trying to call/notify it (I've seen Defrag do it, probably Backup and other programs). It's also nothing serious.

For the last error you need this, but ideally you should find the real cause. Often (always?) it happens during shutdown when there is a hung ("not responding") program or driver.

From the timestamp of the events you may try to remember which programs you were running at that time.

GL

thanks for the reply.

VSS is most probably cause by disk defragmenter.

and the last error might be because of nlite tweak which shuts down hung services/programs

I guess I'll just live with it or experiment with another nlite install