Solved! Win10 crashing, no dump file to analyze

merk

Senior member
May 29, 2003
471
9
91
Windows 10 pro 1909 18363.1016

So starting a few days ago windows has started randomly bluescreening. I can't read a dump file because "Dump file creation failed due to error during dump creation."
Another thing i noticed in the event log is that it's recording the unexpected shutdown at the wrong time.
"The previous system shutdown at 7:31:36 PM on ‎9/‎6/‎2020 was unexpected." But it actually crashed at around 8:11pm
But the timestamps on the event log entries after the reboot are showing the correct time. And I haven't noticed the system clock showing the wrong time.

The last thing in the event log prior to the crash is this (and it appears multiple times a day):
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
and APPID
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
to the user MYPCNAME\MYUSERNAME SID (S-1-5-21-1186387186-3346954459-1088633368-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Anyone have any suggestions on how to fix this? Or at least figure out the cause? I can't think of anything that changed a few days ago. I don't remember installing any new software, or changing any windows settings.

Oh and i searched through the registry for that AppiD and CLSid - found several entries in the registry, but nothing that actually told me what it is or pointed to any executable or anything
 
Last edited:
Solution
Seasonic warrants that PSU line for 7 years, so it very well could be at the point where it might need to be replaced. If you do determine the PSU is bad and it is still just in warranty according to your receipt, I'd definitely recommend RMAing it as Seasonic PSUs are very good in general.

If it were my system, how I'd proceed would depend upon whether or not I had a spare PSU. If I did, I'd test with the spare PSU first thing.

If I didn't have a spare PSU, I'd check everything else I could before purchasing a new PSU (like running a memory diagnostic one module at a time, a system drive check, check for overheating, etc). Then, if those tests didn't turn up anything, I'd probably run a SFC /scannow check from an elevated...

Steltek

Diamond Member
Mar 29, 2001
3,034
748
136
A system turning off like that without a BSOD and dump file being written is far more indicative of failing hardware than a software problem.

What are the make/model of your system components, and the age of your power supply? Are you overclocking your system?

I'd start by running a memory diagnostic (either Windows Memory Diagnostic or Memtest86+) on your memory modules. Test one module at a time. If you aren't tracking system component temperatures, install software to do this and make sure you aren't overheating. If you haven't blown out your computer case recently, now would be a good time to do it as well.

BTW, if that error you are referencing is an Event 10016 DCOM error, it is a red herring for your problem - they often result from problems, but they don't usually cause problems in and of themselves. In fact, DCOM errors happen all the time in Windows by design and you can mostly ignore them. You can spend the time to trace them down and eventually fix them if you want, but in the vast majority of situations ignoring them doesn't cause any issues beyond cluttering up your system log.
 

merk

Senior member
May 29, 2003
471
9
91
So most of the components in my system are about 2 years old or newer. However, i realized after looking through my email receipts, my PSU is from 2013. Not really sure how long PSU's are supposed to last, although a 7 year old component seems pretty old to me. Does a 7 year old PSU seem like a likely culprit? it's a seasonic x650 gold.

And no, nothing is overclocked.
 

Steltek

Diamond Member
Mar 29, 2001
3,034
748
136
Seasonic warrants that PSU line for 7 years, so it very well could be at the point where it might need to be replaced. If you do determine the PSU is bad and it is still just in warranty according to your receipt, I'd definitely recommend RMAing it as Seasonic PSUs are very good in general.

If it were my system, how I'd proceed would depend upon whether or not I had a spare PSU. If I did, I'd test with the spare PSU first thing.

If I didn't have a spare PSU, I'd check everything else I could before purchasing a new PSU (like running a memory diagnostic one module at a time, a system drive check, check for overheating, etc). Then, if those tests didn't turn up anything, I'd probably run a SFC /scannow check from an elevated command prompt to ensure that there isn't system file corruption which is preventing a crash dump from being written. If no problems were indicated, I'd then run a read-only CHKDSK check of the system drive to check for file system corruption (running in read only mode will drop out with a warning that it can't complete without changing anything, giving you the chance to back up your important files before you fix it).

If at this point nothing else turns up, I'd then probably purchase a new PSU.

I guess you could also run a Prime95 stability test session with the old PSU to see if it shuts down under load. My only reservation with that would be that the more times it shuts down, the higher the likelihood it is going to damage something else. Plus, without running the other checks first, you still wouldn't be able to pinpoint a cause for the shutdowns.
 
  • Like
Reactions: DAPUNISHER
Solution

merk

Senior member
May 29, 2003
471
9
91
Ok, it crashed again. Although this time is was able to create memory dump.
This was probably caused by the following module: ntkrnlmp.exe (nt!SeConvertSidToStringSid+0x203A)
Bugcheck code: 0x154 (0xFFFF8F860BF45000, 0xFFFFF00FB68658C0, 0x2, 0x0)
Error: UNEXPECTED_STORE_EXCEPTION

It says this is probably a typical software driver bug, but if it was another driver, it can't be identified.
At the time the crash occurred I was batch editing some images. According to task manager, the cpu was bouncing between 20-40% and power usage was listed as 'very high' for the program.
 

Steltek

Diamond Member
Mar 29, 2001
3,034
748
136
Actually, that error can result from defective hardware, a bad driver, or a software bug. It can be a difficult one to diagnose.

Have you run a Windows memory diagnostic, SFC/scannow and CHKDSK (in read only mode) yet? It also wouldn't hurt to run a manufacturer diagnostic test on your hard drive or SSD drive to test for faults.

When you run the memory diagnostic (you can use either the built-in Windows Memory Diagnostic or MEMTEST86+), make sure to only test with one memory module installed at a time.

One final question - do you have a USB hub or some sort of USB/card reader hub (like one you'd install in a 5 1/4" or 3 1/2" drive bay) installed in your system?

@VirtualLarry is also right in that you could try to roll back to a prior system restore point to see if it fixes the problem as well. You might check your Windows Update history to see if Windows snuck in any driver updates on you.
 

merk

Senior member
May 29, 2003
471
9
91
I'll run those tests and see what they turn up. I do not have any sort of USB reader/hub/drivebay plugged in. I may have had a USB XQD card reader plugged in when the crash happened. I can't remember if i had removed it before or after the crash.

I do have some LED lights in my case - and if i remember correctly, the controller for the lights is plugged into one of the USB headers on my motherboard. Other then that, it's just a usb keyboard and mouse.
 

Steltek

Diamond Member
Mar 29, 2001
3,034
748
136
I'll run those tests and see what they turn up. I do not have any sort of USB reader/hub/drivebay plugged in. I may have had a USB XQD card reader plugged in when the crash happened. I can't remember if i had removed it before or after the crash.

I do have some LED lights in my case - and if i remember correctly, the controller for the lights is plugged into one of the USB headers on my motherboard. Other then that, it's just a usb keyboard and mouse.

LEDs shouldn't be the problem, unless something is shorting out or you have a bad PSU. If the card reader wasn't plugged in when the prior shutdowns occurred, it probably isn't involved either. The only reason I asked about USB/card reader hubs in general is that people who have them tend to grandfather them from system to system, and older ones have been noted in the past not to play very nicely with newer versions of Windows and newer motherboards.
 

merk

Senior member
May 29, 2003
471
9
91
so i ran the memory diagnostic, but i ran it with all the memory modules in place. I assumed the only reason to do it one at a time was to determine which module was faulty? If so, none are faulty since it found no problems.

chkdsk found nothing
sfc came up with a handful of errors, but not that any files were corrupt, just that there were file permissions set twice:
2020-09-16 02:07:28, Info CSI 00000089 Warning: Overlap: Directory \??\C:\WINDOWS\System32\drivers\en-US\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}

There is a firmware update available for the ssd my OS is running on. Kinda doubt that's the issue though since it's been running on that drive for a year or two now.
 

Steltek

Diamond Member
Mar 29, 2001
3,034
748
136
Crucial/Micron drive?

This. What is the specific make and model of your SSD drive?

SSD firmware updates are not just issued to correct device defects, but can also be issued to resolve OS compatibility issues. It is entirely possible a Windows update or feature change has made your SSD unstable.

It is possible that installation of the new firmware could resolve your problem. However, if you decide to install it, make sure to back up your data first - if your PSU is actually failing, a power failure during a firmware flash could catastrophically brick the drive and result in data loss.

BTW, it doesn't hurt that you tested all the memory modules at once. The main reason you normally want to test them separately is that, if one has an error, you can easily identify the defective module (which you can't do if testing them together). They all passed, so you are probably good there.

You'll probably have to run the following command to fix the errors your SFC scan found but couldn't fix:

DISM /Online /Cleanup-Image /RestoreHealth

Again, I'd make sure to have a valid backup of your important files before doing this. If the DISM command doesn't work to fix the issue or errors out, you may need to do a Win10 repair install to fix the problem. If you don't know how to do one, post back.
 
Last edited:

merk

Senior member
May 29, 2003
471
9
91
It is a samsung 960 evo m.2. I tried looking for some release notes as to what the firmware might fix but I couldn't find anything. I'm also not using the samsung driver - using the default microsoft driver.
 

Steltek

Diamond Member
Mar 29, 2001
3,034
748
136
I don't recall reading about the NVMe 960 Evo have any issues like yours (I have one, so I watch for that kind of thing). As a result, I'd hold off on the firmware update for now (at least until you exhaust all other options).

I'm still suspecting the PSU is the culprit at this point.

If you want, you could run a Prime95 session to see if the system shuts off when significantly loaded down. If you go this route, I'd use something like Ultimate Boot CD or Stresslinux.org's Linux distro (both of which have a version of Prime95) so as to eliminate Windows and the SSD as cause of the shutdowns. If it doesn't crash then, you could try to run Furmark in Windows to really load down the PSU (just watch your CPU/GPU temps to ensure Furmark doesn't do some type of damage).
 

merk

Senior member
May 29, 2003
471
9
91
is Stresslinux still active? last time a new build was uploaded was 2011 - and none of the download links seem to work anymore unfortunately.
 

Steltek

Diamond Member
Mar 29, 2001
3,034
748
136
is Stresslinux still active? last time a new build was uploaded was 2011 - and none of the download links seem to work anymore unfortunately.

Doesn't look like it is. Just assumed and didn't even check the download links. Sorry about that.
 

merk

Senior member
May 29, 2003
471
9
91
I haven't had a chance to run any other tests yet. But the same app that i was running last time when it crashed - that app itself just crashed right now. It's never done that before, but since these blue screens have started happening, it's been giving strange errors. The other day it stopped during a long batch process. And today it just crashed with no error or warning. I found these two entries in the application event log though:

Faulting application name: Aurora HDR.exe, version: 1.0.0.2550, time stamp: 0x5e515510
Faulting module name: VCRUNTIME140.dll, version: 14.26.28808.1, time stamp: 0x5eecdb07
Exception code: 0xc0000005
Fault offset: 0x0000000000001243
Faulting process id: 0xa720
Faulting application start time: 0x01d6912e785f17a5
Faulting application path: C:\Program Files\Skylum\Aurora HDR\Aurora HDR.exe
Faulting module path: C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll
Report Id: 3d482b2e-8806-4303-b703-966892a625c1
Faulting package full name:
Faulting package-relative application ID:
 

merk

Senior member
May 29, 2003
471
9
91
So i just replaced the 650W PSU with a new 750W unit. With the 650w psu being 7 years old, figured I should swap it out anyhow. I'll see if I get any more crashes over the next week or so. Hopefully that'll resolve it.