System Event Log - Unusual Timestamp sequence


  • Windows 8.1 Pro 64-bit, Opteron 2280

    These system events

    6009 = OS Version

    6005 = Event Log service has started

    6013 = system uptime

    are being inserted into the system even log (before system was last shutdown) apparently just above event 50037 DHCPv4 Client service is stopped.

    According to the timestamps. The rogue events should appear after Directory-Services-SAM 16962. which has an earlier timestamp than event 6009 which should be the very first entry after the previous shutdown event.

    Viewing events from newest to oldest

    I hadn't noticed this before but it's been there since I installed and activated it last year. At first I thought it might be an infected WLAN driver, but security software (including MSRT) has not picked up anything abnormal.

    Fast Startup is disabled. It made no difference when it was enabled.

    What might be the cause of this behaviour?

    Thursday, December 7, 2017 2:12 PM

All replies