"Known folders" errors in event viewer
Question
Answers
All replies
-
Looks like a sata driver error. Your controller need a different driver. You can check for new 'chipset drivers' on your system makers site.
Rating posts helps other usersMark L. Ferguson MS-MVP
Mark,
How did you come up with sata driver errors? (just curious) I have several of these errors for different folders:
For example:
Error 0x80070005 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files'.Error 0x80070002 occurred while verifying known folder {fdd39ad0-238f-46af-adb4-6c85480369c7} with path 'C:\Windows\system32\config\systemprofile\Documents'.
Error 0x80070002 occurred while verifying known folder {625b53c3-ab48-4ec1-ba1f-a1ef4146fc19} with path 'C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu'.
-
Hi! Think I found an easier solution.
I've had this problem for some time too.
I'm using a Windows 7 (Ultimate) 64-bit OS. I've just managed to download and install SP1 (didn't know I didn't have it?!), check event viewer and found a few volume shadow errors (0 restore points!).
I have in the past created folders in syswow64, even recently creating one for a missing folder @
C:\Windows\Resources\0409
I decided to take an alternative approach -
1. go to event viewer and find the offending GUID
(Applications and Services Logs > Microsoft > Windows > Known Folders > Operation > Details tab
(see above!)
Copy the {GUID} (in my case it was {ae50c081-ebd2-438a-8655-8a092e34987a}
run regedit and CTRL+Find the GUID.
Change the relative path from
Microsoft\Windows\Recent
to
%appdata%\Microsoft\Windows\Recent
(you should be able to access the special folder in question by pasting the new, full relative path into an address bar / run box.
Keen to know if this is useful for anyone else!
Hard for my to track as I now have 5 builds... I <3 Virtualization!
-
The 0x07E error is usually the controller. Folder access problems also indicate some disk corruption problem.
Rating posts helps other usersMark L. Ferguson MS-MVP <marquee behavior="alternate" direction="right" height="100" loop="5" scrollamount="4" scrolldelay="25" style="left:10px;width:100px;top:0px;height:40px;" width="200">Hi Mark!
How do you do your quick HEX math magic?! 0x07E - is that 0x80070005 ? and 0x80070002?
Re that error "usually being the controller", how do you know/what do you mean?
Using windows 7's native vhd support, I have several builds, basically clones. I'm trying to see what is causing the error (what event occurs), alas eventviewer's application/system logs reveal nothing.
Is there a way to debug this? using process monitor / explorer ?
I've tried following the lead of Dr. Russinovich, but I'm a novice. I need help!
The most insight I've got is think is from Mr. Harris, ie
The path mentioned, C:\Windows\system32\config\systemprofile\AppData, is a bit surprising. The system profile is an area on disk that services running under the "local system" account use like another user's profile (my documents, etc.), but the apps that typically run under local system generally don't make much use of this area. Have you configured custom services that might be related?
Burt Harris -
hi Luke, I am still having this annoyance too. Looking as deep as possible into it (or trying too)
did you ever find a resolution, or a root-cause?
trying to follow this to see what's causing the event ("folder verification"), also comparing to other builds on same laptop, to see which aren't affected...
I think it might be windows update. just a hunch. there was a hotfix, but the link is dead.
First I want to see a correlation between the event and the OS. It's just kind of bugging my mind that the issue occurs sometimes on some systems, but (seemingly) not so on other VHDs.
(I'm trying to make a rock steady build. And keep it clean and running smooth. It's not easy)
ISSUE: UNRESOLVED. CAUSE: UNKNOWN
UPDATE: Cause identified by PID in event viewer. for me, re
"Error 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\Windows\system32\config\systemprofile\Desktop'."
the PID each time corresponds to windows search service ID. The question is why it's building a "bad desktop path", instead of referencing the special folder
- Edited by JonnyH3425675 Saturday, October 25, 2014 12:42 PM
-
wow!!! the CAUSE and the solution, without directly hacking the registry?!
attempting now!!
-
Another culprit candidate:
I suspect windows search references these on some occasions.
On closer inspection, I discovered this location does have a (protected,hidden, manually created, empty) Desktop folder (just to shut MS up).
Hope anyone suffering this annoyance discovers this. Wonder how prolific the issue is...
-
SOLVED
{MANUAL QUOTE, thanks again to the above contributors}
-
VoteI am having the same problem...even the missing folders match the ones in sejong's proposed batch file.
Update: the following is incorrect most of the time, but I am leaving it here because others may find this info useful. When you see a bold "END SPECULATIVE / BEGIN CORRECT" block, everything from then on is true (to my knowledge) and has me much closer to the problem.
Then I remembered something: I have Windows 7 x64 ...Many of the things that are in C:\Windows\system32 in 32-bit Windows are in the 64-bit equivalent:C:\Windows\SysWOW64
Sure enough, for example, even though this was NOT there:
C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
THIS one is there(!!!)
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network ShortcutsSo instead of putting blank folders in the incorrect places, we should find-out why Known Folders got it wrong.
I will post again when I figure this out...in the meantime, I'm open to suggestions too. ;)
END SPECULATIVE / BEGIN CORRECT
I just spent the past few hours digging through the registry and the web. Actually it has to do with the USERPROFILE abstracted Environment variables.
Example
I'll use the one from above...this is the *incorrect* path that throws the Event Viewer 1002 entry:
C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
I was able to find-out, that this is the correct path the Folder should be pointing to. (Test it yourself, I am sure you will find the correct locations all already there....)
C:\Users\Mikey\AppData\Roaming\Microsoft\Windows\Network Shortcuts
So basically, most of the path is exactly the same, but something is spitting out the first part of the folder to be 1) when it should be 2)
- C:\Windows\system32\config\systemprofile\
- C:\Users\MyName\
To prove this pattern, I went into the registry. Each of those errors has a corresponding GUID to the "Known Folder". In this case the
Folder Guid = {C5ABBF53-E17F-4121-8900-86626FC2C973}
I went into the registry and searched for it. I didn't find much, but the node corresponding to that guid/folder had the following keys:
ParentFolder = {3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}
RelativePath = Microsoft\Windows\Network Shortcuts
Notice that the "RelativePath" is the end of the folder. So I then searched the registry for the ParentFolder Guid. There were many times this came up, but always as ParentFolder. However, when I finally made it to its actual node, I found out why...this is what I found:
Folder Guid = {3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}
Name = AppData
RelativePath = AppData\Roaming
Do you see how interesting this is? ...Take this all together and you have:
..\AppData\Roaming\Microsoft\Windows\Network Shortcuts
All spelled out explicitly! So then I got to thinking, all we are missing is the "off" parts..
The correct: C:\Users\MyName\
The incorrectly used: C:\Windows\system32\config\systemprofile\
I was wondering why the registry trail dies right there, but I realized that c:\Users\MyName\ is the value of the Environment Variable %USERPROFILE% !!! (Try putting that into Windows explorer (just %USERPROFILE% with the % and all) - you will map right to c:\Users\MyName\) ...So no more path-mapping is needed.
However, look at the "bad" one, I do not know of the environment variable if there is one, but it clearly is equivalent to "SystemProfile" ...heck, "systemprofile" is explicitly stated at the end of the path!Then I looked back at the Event Viewer: look at the General Tab of one of the Events...it says:
User: SYSTEM
So whatever is calling Known Folders and throwing up this error is calling on behalf of "SYSTEM" and not your user. Thus, instead of going to USERPROFILE and getting the correct Known Folder using the algorithm I reverse-engineered above, it stuck-on a *system* profile that is essentially meaningless (probably because one never logs in as "System" and the first login of a new User creates many of those folders for itself...)
LOL Phew! It has been a long day, I am sorry to say that that is as far as I could get...I"m sorry if you read this far only to findout that I don't know what to do next. Since the first part of the path is neither registry nor environment variable driven (as I hoped) it is somewhere in the code of what is making all of those errors happen. I am also VERY tired and this is not as grammatically/structurally correct as most of my other posts.
I am mainly posting this for three reasons 1) To get this down on paper for when I follow-up on it next. 2) Share with you how far I got. and 3) Find out if I am mistaken and there is some little step I missed...please let there be something I missed! :)
cheers!
MikeY
PS - I found the same issues on my laptop! They appear to happen when booting up...
Saturday, June 18, 2011 10:46 PM -
Vote
Great Post.
I used Event Viewer's "Custom Views" along with "Custom Range..." under Logged to narrow in on a 10 minute window before after the Known Folder error log, and selected everything.
The result in my case was an Information Event with Source "volsnap" that is responsible for the shadow copying of your files (I assume for Restore point?).
That being said .... I just found the following:
Click the "Help" button in the users Dialog Box (found in Computer Management -> Local Users and Groups -> Users ->yourusername)
It took a couple of re-reads for me to narrow in on this particular line:
"If no home folder is assigned, the system assigns a default local home folder to the user account (on the root directory where the operating system files are installed as the initial version)."
Now that ~could~ imply that the "root directory" is system32 ... perhaps. It definetly implies the SYSTEM is doing it on behalf of you. Nicely fits this scenerio, but does it hold water?
In any case, even if not, messing with this dialog box may prove useful.
I'm not about to do it on my drive I've just spent an eternity setting up, but I do have a spare one lying around .....now where did I put it?
I fear Mr. Ferguson assumes too much
-
