none
Microsoft-Windows-Kernel-EventTracing/Admin Session failed to start with the following error: 0xC0000011 Event ID: 2 on computer boot/restart!

    Question

  • I am getting this error which I see in my Event Viewer on my Windows 8.1 machine. This error happens only once every time I restart or boot the computer. Can someone tell me what is causing this issue? I am not noticing any issues with my PC but just wondering what is this error caused by? I googled other people have the same problem but I cannot find a fix for this.  

    Error: 0xC0000011 Event ID: 2

    ErrorCode
    ">3221225489</DataLoggingMode">276824069</Data>

    I am unable to post the entire error code as your stupid forum keep saying that I am not allowed to post links. 

    • Body text cannot contain images or links until we are able to verify your account.


    Wednesday, April 3, 2019 9:26 AM

All replies

  • I have just identified what is causing this error to happen! However, I still do not know how to fix the problem.

    Whenever I go to Control Panel\Network and Internet\Network Connections and right click on the Ethernet Adaptor and press anything whether it be Status or Properties, immediately I get the Kernel-EventTracing Event ID 2 and there is a long delay up to 6 seconds when the properties box launches. Definitely something is not right there! It should launch immediately.

    This is probably what is causing the problem on PC boot. It is something related to Network Adaptor. I uninstalled it and reinstalled it again, same issue happens. I think it is some Windows corruption. I would be grateful if someone tell me how to fix this problem. 

     Just made another experiment as I am writing this. Tested from Device Manager. I can confirm something related to Network. When I right click on Network Adapter this triggers the Event Tracing Kernel Event ID 2 error. Nothing else causes it.
    Wednesday, April 3, 2019 11:16 AM
  • Hi,

    According to my experience, this event message are harmless and can be safely ignored.

    To  fix it, you could try the following: 

    1. Install the latest updates to keep machine up-to-date.

    2. Update the Network Adapter and check if it helps.

    3. Try to delete the following file: C:\Windows\Logs\NetSetup\service.0.etl

    4. Run SFC /scannow command to scan the integrity of operating system files.

    5. We could create a Custom View without Event ID 2: 

    Best regards,

    Yilia 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, April 4, 2019 6:26 AM
    Moderator
  • When I go to Ethernet Properties there's a long delay when it launches. This is triggering this Event ID 2 error. 
    I also cannot find C:\Windows\Logs\NetSetup\service.0.etl folder. It doesn't exist. Before I never witnessed this kind of error.

    SFC /scannow found corruptions that are unable to fix. But I did the exact same test via F11 yesterday and it didn't find any corruption. 

    I tried to use SFCFix and it couldn't find corrupt files and even inserted my Windows 8.1 DVD.

    I think this issue happened after I installed VPN software in February the 7th. Then first time I noticed the error in 14th of February this year. Since then this error keeps being triggered. I haven't reformatted windows in 4 years since installing Windows 8.1 64-bit Pro.

    I already uninstalled the software long ago. I also can't find a Windows System Restore point before 16 of March.

    Even after
     creating a Custom View without Event ID 2: the error is still showing up. The latest network drivers for my Realtek PCIe GBE Family Controller shows as 2013. I can't find later drivers for that.

    I think I might need to reformat Windows finally to see if the error will go away.

    Edit: I solved the problem partially. I went to Registry Editor and deleted all the folders that contained this code as shown in the error in bold below. Now the error is no longer showing up in Event Viewer or being triggered. However, what I did was probably not wise. I don't know how to restore this now once deleted. I want to see if this error will go away after those registries are restores.
    {B675EC37-BDB6-4648-BC92-F3FDC74D3CA2} 
    Thursday, April 4, 2019 9:40 AM
  • Hi,

    Thanks for your sharing.

    It's recommended to backup registry before we edit it. Then we can restore it if you want.

    How to back up and restore the registry in Windows

    Best regards,

    Yilia 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, April 5, 2019 1:36 AM
    Moderator
  • I decided to reformat Windows yesterday and installed Windows 10. The problem has gone away!

    No more kernel error or delay when loading up Network and Sharing Center or when going to Properties in the Network Adapter. At least I know this is not a hardware issue. Still it would've been great if I knew exactly what caused this corruption to happen.

    I can only speculate that the VPN Software caused this problem but I can't be 100% certain. Sadly SFC /scannow was useless in fixing the problem. Some problems can only be solved with fresh windows re-installation...
    Saturday, April 6, 2019 10:40 AM
  • Hi,

    Thanks for your sharing.

    I am glad to hear that your issue was successfully resolved. 

    If there is anything else we can do for you, please feel free to post in the forum.

    Best Regards,
    Yilia 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, April 15, 2019 3:03 AM
    Moderator