none
Multiple Lenovo X230 laptops - "System Event Notification Service" service error / theme problems at boot.

    Question

  • Firstly apologies for the length of this one, I've been on it for a while and wanted to share what I could in the hope it might trigger some ideas.

    I'm currently receiving an influx support tickets for Windows 7 (x64) devices that are getting the "Windows could not connect to the System Event Notification Service" error when logging on for the first time.

    It's predominantly laptops and mainly older Lenovo X230's but there are far more X230 machines without the problem than with it at this time so I'm struggling to tie it down to a specific build, update, application etc. Instances of the issue starting range from 6 months ago to last week and I have around 200 devices affected (but this is rising).

    The issue happens like this for some of the users:

        # User boots machine up from being switched off
        # Machine boots and gets to logon screen
        # User is unable to logon using their fingerprint reader, the green light isn't lit
        # They try to logon using username / password, this fails
        # "Windows could not connect to the System Event Notification Service" error appears (blue, full screen like the "please wait..." when booting)
        # They are then able to try again and the logon is successful
        # Error doesn't occur again until they reboot

    Many of the users report their machines are also very slow to logon (10-30 minutes) and generally not working as well as they normally do. This is a mix of people in the office and connecting in remotely, various different job roles, locations, installed software etc - there isn't a pattern I can pinpoint.

    I've been through huge number of old posts on this and my colleagues on the service desk have dutifully tried the "netsh winsock reset" fix that seems to helped so many but sadly it's having no impact.

    I got hold of of one of the problematic machines and see a slight variation in the problem:

        # I boot the machine up from being switched off
        # Machine boots and gets to logon screen
        # I logon using username / password, this works first time.
        # We use Check Point VPN and this prompts for a login during the Windows logon
        # When the Check Point window appears it's in a Windows Classic theme rather than Aero
        # Subsequent windows and the desktop itself then load in Classic
        # "Windows could not connect to the System Event Notification Service" error appears in the system tray as a balloon notification.
        # Windows theme is a classic "Unsaved theme" and all Aero themes are greyed out, only basic / high contrast ones can be selected.

    If I troubleshoot using the built-in "Appearance and Personalisation" troubleshooter in Control Panel it detects that "Desktop Windows Manager is disabled" - it isn't and it shows as "started" in Services.msc - restarting it has no effect on my ability to select Aero themes.

    Aside from the theme general machine functionality seems unaffected once booted but the delay is causing the users to become frustrated and request new machines. If the machine is rebuilt with the same image, the same software installed and the same updates applied the issue doesn't occur... or at least hasn't immediately.

    I was going to play around with MSConfig and turn things off selectively but decided to use xbootmgr from the Windows Performance Toolkit to see if I could find anything specific happening at boot, "audiodg.exe" seemed incredibly resource hungry.

    We have the Realtek audio driver installed on all these machines as part of the build so I disabled the "enhancements" to see if this might help, on the next boot everything was OK, I thought I'd come up with a workaround. The next 10+ boots all came up with the System Event Notification message. I cried a little inside.

    My next step was to disable the sound card in Device Manager - I lost sound but every single reboot after this was fine, no issues with the theme, no System Event Notification Service errors.

    I tried updating the driver to the latest version and enabled it again - the issue came back, I also tried uninstalling the driver completely and the machine defaulted to the "High Definition Audio Device" (Standard Microsoft driver 6.1.7601.17514) and sound worked with no display issues for one boot, it then went back to the problem on subsequent boots.

    Unfortunately not having sound isn't an option for a workaround as the users are reliant on it for their day to day work, they also can't enable / disable things themselves as we have device manager locked down. 

    I've updated Check Point VPN to the latest build, updated graphics drivers, sound drivers, carried out general maintenance on the test machine to ensure it's operating as well it can be, rebuilt the WMI repository (there were multiple WMI errors in the system logs at boot but these still exist) - so far only disabling the sound in device manager has helped.

    Any thoughts / input / therapy would be really appreciated, unfortunately due to the nature of the customer I can't attach detailed logs but I'm more than happy to pull out specifics from them if anyone wants to check anything.

    Tuesday, January 15, 2019 12:00 PM

All replies

  • Hi,

    Thanks for your detailed description of your issue.

    The root cause may result from the sound card. Have you found the vendor of it and asked for help?

    We can compare the Event logs about the sound card of the machines with the problem and without the problem. the shortcut way is to right click the sound card in device manager > click properties > choose Events tag and view all events.

    If you have reached new progress, please let we know.

    Best Regards,



    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, January 16, 2019 6:28 AM
  • Many thanks for responding, I appreciate you taking the time to do so.

    I don't think Windows 7 shares the same "events" tab functionality that Windows 10 has unfortunately but I'll try and take some time out tomorrow to do it the old fashioned way and go through the logs manually.

    The sound card in question is just the one that comes with the Lenovo X230 as standard, they specify Realtek audio drivers.

    Wednesday, January 16, 2019 5:15 PM
  • Sounds to me like Possibly the latest drivers are not entirely compatible, Try an old driver package and if that works disable/hide the update
    Wednesday, January 16, 2019 5:22 PM
  • Hi,

    1. I have the same thoughts as Anewton, the latest sound card drivers may not be compatible to your Lenovo X230.

    2. We can try to restart the 'system event notification service' in services.msc and recovery. 

    3. Have you tried 'netsh winsock reset catalog' in safe mode of win7? 

    4. As an administrative user, we can review the system event log for details to find the potential cause.

    Best Regards,


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, January 17, 2019 4:08 AM
  • This is where it becomes somewhat odd - none of the systems had the latest sound card drivers, all of them were built years ago using an older build, all of them worked just fine up until recently. All I can think is that one of the Windows Updates I've pushed out in this time contains something that's causing the problem but then why isn't it affecting all of these X230 machines despite them having the same build and updates applied?

    Another test machine I have here, an X220, won't show the same issue no matter how hard I try to break it, this is running the Conexant 20672 SmartAudio driver though.

    No driver updates have been carried out on the X230s out in the wild, it's just my own test machine I did in the hope that the latest and greatest would magically fix things, it didn't of course :)

    The drivers I've installed on the machine with the symptoms are the ones from the Lenovo downloads page that specifically list this machine as being compatible but I think I'll try to grab a selection of drivers and play with those today to see what happens.

    Restarting the System Event Notification Service doesn't have any impact, it's running and appears to be absolutely fine once the machine is booted, the problem then only manifests itself once it's been powered off and on again.

    "netsh winsock" was one of the first paths we went down as that's the Google answer of choice it seems, sadly it's had no effect on this particular instance of things.

    Hugely grateful for all your suggestions, as someone who works alone and remotely and has 1000s of end users out for my blood at the moment it's nice to find a little bit of support :)

    Thursday, January 17, 2019 9:08 AM
  • Hi,

    Unfortunately, our suggestions didn't work.

    Try to modify the properties in the System Event Notification Service and choose the Restart the Service for the three failures in the Recovery tag. 

    Meanwhile, the startup type of the System Event Notification Service is Automatic.

    Best Regards,


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, January 17, 2019 10:02 AM
  • Ah If they don't have the latest sound drivers then most likely the ones that don't now work have a different iteration of the older driver and downloading the the newer drivers don't or wont work, see if you can establish which version of the driver works by comparing two machines side by side :)

    As an alternative work through the lenovo and or windows updates one by one removing them.

    • Edited by Anewton Thursday, January 17, 2019 1:54 PM
    Thursday, January 17, 2019 1:52 PM
  • Hi,

    Just want to confirm the current situations. Has the issue been solved?

    Please feel free to let us know if you need further assistance.

    Best Regards,


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Monday, January 21, 2019 1:41 AM
  • Very much still under investigation at my side unfortunately - I've replaced the sound card driver on one of the affected machines with the one included in the base image (i.e. the one that's been on the machines for years when this issue wasn't around) and found no change in behaviour.

    I'd hoped it might replace a file that's been updated since and make everything OK again but sadly not.

    As such I'm still working through some of the suggestions above but unfortunately this is in conjunction with a lot of other work too :(

    Tuesday, January 22, 2019 11:13 AM
  • Hi,

    Thanks a lot for your understanding.

    If you make new progress or need other help, please feel free to let we know.

    Best Regards,


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, January 25, 2019 1:58 AM
  • Still waaaaay behind with the list of things I need to do on this one but I did reinstall the original sound card driver from the build on one of the affected machines and it has no impact.

    I'll keep going, I have 200+ users affected now, it's becoming a bit of a focus point for the management.

    Tuesday, January 29, 2019 10:24 AM
  • Hi,

    I am sorry that this issue still hasn't been resolved and even getting serious.

     I would suggest you contact Microsoft Customer Services and Support to get an efficient solution:

    http://support.microsoft.com/contactus/?ln=en-au  where more in-depth investigation can be done so that you would get a more satisfying explanation and solution to this issue.

    Have a nice day!


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, January 29, 2019 10:40 AM