T
thetapeworm
Guest
Firstly apologies for the length of this one, I've been on it for a while and wanted to share what I could in the hope it might trigger some ideas.
I'm currently receiving an influx support tickets for Windows 7 (x64) devices that are getting the "Windows could not connect to the System Event Notification Service" error when logging on for the first time.
It's predominantly laptops and mainly older Lenovo X230's but there are far more X230 machines without the problem than with it at this time so I'm struggling to tie it down to a specific build, update, application etc. Instances of the issue starting range from 6 months ago to last week and I have around 200 devices affected (but this is rising).
The issue happens like this for some of the users:
# User boots machine up from being switched off
# Machine boots and gets to logon screen
# User is unable to logon using their fingerprint reader, the green light isn't lit
# They try to logon using username / password, this fails
# "Windows could not connect to the System Event Notification Service" error appears (blue, full screen like the "please wait..." when booting)
# They are then able to try again and the logon is successful
# Error doesn't occur again until they reboot
Many of the users report their machines are also very slow to logon (10-30 minutes) and generally not working as well as they normally do. This is a mix of people in the office and connecting in remotely, various different job roles, locations, installed software etc - there isn't a pattern I can pinpoint.
I've been through huge number of old posts on this and my colleagues on the service desk have dutifully tried the "netsh winsock reset" fix that seems to helped so many but sadly it's having no impact.
I got hold of of one of the problematic machines and see a slight variation in the problem:
# I boot the machine up from being switched off
# Machine boots and gets to logon screen
# I logon using username / password, this works first time.
# We use Check Point VPN and this prompts for a login during the Windows logon
# When the Check Point window appears it's in a Windows Classic theme rather than Aero
# Subsequent windows and the desktop itself then load in Classic
# "Windows could not connect to the System Event Notification Service" error appears in the system tray as a balloon notification.
# Windows theme is a classic "Unsaved theme" and all Aero themes are greyed out, only basic / high contrast ones can be selected.
If I troubleshoot using the built-in "Appearance and Personalisation" troubleshooter in Control Panel it detects that "Desktop Windows Manager is disabled" - it isn't and it shows as "started" in Services.msc - restarting it has no effect on my ability to select Aero themes.
Aside from the theme general machine functionality seems unaffected once booted but the delay is causing the users to become frustrated and request new machines. If the machine is rebuilt with the same image, the same software installed and the same updates applied the issue doesn't occur... or at least hasn't immediately.
I was going to play around with MSConfig and turn things off selectively but decided to use xbootmgr from the Windows Performance Toolkit to see if I could find anything specific happening at boot, "audiodg.exe" seemed incredibly resource hungry.
We have the Realtek audio driver installed on all these machines as part of the build so I disabled the "enhancements" to see if this might help, on the next boot everything was OK, I thought I'd come up with a workaround. The next 10+ boots all came up with the System Event Notification message. I cried a little inside.
My next step was to disable the sound card in Device Manager - I lost sound but every single reboot after this was fine, no issues with the theme, no System Event Notification Service errors.
I tried updating the driver to the latest version and enabled it again - the issue came back, I also tried uninstalling the driver completely and the machine defaulted to the "High Definition Audio Device" (Standard Microsoft driver 6.1.7601.17514) and sound worked with no display issues for one boot, it then went back to the problem on subsequent boots.
Unfortunately not having sound isn't an option for a workaround as the users are reliant on it for their day to day work, they also can't enable / disable things themselves as we have device manager locked down.
I've updated Check Point VPN to the latest build, updated graphics drivers, sound drivers, carried out general maintenance on the test machine to ensure it's operating as well it can be, rebuilt the WMI repository (there were multiple WMI errors in the system logs at boot but these still exist) - so far only disabling the sound in device manager has helped.
Any thoughts / input / therapy would be really appreciated, unfortunately due to the nature of the customer I can't attach detailed logs but I'm more than happy to pull out specifics from them if anyone wants to check anything.
More...
I'm currently receiving an influx support tickets for Windows 7 (x64) devices that are getting the "Windows could not connect to the System Event Notification Service" error when logging on for the first time.
It's predominantly laptops and mainly older Lenovo X230's but there are far more X230 machines without the problem than with it at this time so I'm struggling to tie it down to a specific build, update, application etc. Instances of the issue starting range from 6 months ago to last week and I have around 200 devices affected (but this is rising).
The issue happens like this for some of the users:
# User boots machine up from being switched off
# Machine boots and gets to logon screen
# User is unable to logon using their fingerprint reader, the green light isn't lit
# They try to logon using username / password, this fails
# "Windows could not connect to the System Event Notification Service" error appears (blue, full screen like the "please wait..." when booting)
# They are then able to try again and the logon is successful
# Error doesn't occur again until they reboot
Many of the users report their machines are also very slow to logon (10-30 minutes) and generally not working as well as they normally do. This is a mix of people in the office and connecting in remotely, various different job roles, locations, installed software etc - there isn't a pattern I can pinpoint.
I've been through huge number of old posts on this and my colleagues on the service desk have dutifully tried the "netsh winsock reset" fix that seems to helped so many but sadly it's having no impact.
I got hold of of one of the problematic machines and see a slight variation in the problem:
# I boot the machine up from being switched off
# Machine boots and gets to logon screen
# I logon using username / password, this works first time.
# We use Check Point VPN and this prompts for a login during the Windows logon
# When the Check Point window appears it's in a Windows Classic theme rather than Aero
# Subsequent windows and the desktop itself then load in Classic
# "Windows could not connect to the System Event Notification Service" error appears in the system tray as a balloon notification.
# Windows theme is a classic "Unsaved theme" and all Aero themes are greyed out, only basic / high contrast ones can be selected.
If I troubleshoot using the built-in "Appearance and Personalisation" troubleshooter in Control Panel it detects that "Desktop Windows Manager is disabled" - it isn't and it shows as "started" in Services.msc - restarting it has no effect on my ability to select Aero themes.
Aside from the theme general machine functionality seems unaffected once booted but the delay is causing the users to become frustrated and request new machines. If the machine is rebuilt with the same image, the same software installed and the same updates applied the issue doesn't occur... or at least hasn't immediately.
I was going to play around with MSConfig and turn things off selectively but decided to use xbootmgr from the Windows Performance Toolkit to see if I could find anything specific happening at boot, "audiodg.exe" seemed incredibly resource hungry.
We have the Realtek audio driver installed on all these machines as part of the build so I disabled the "enhancements" to see if this might help, on the next boot everything was OK, I thought I'd come up with a workaround. The next 10+ boots all came up with the System Event Notification message. I cried a little inside.
My next step was to disable the sound card in Device Manager - I lost sound but every single reboot after this was fine, no issues with the theme, no System Event Notification Service errors.
I tried updating the driver to the latest version and enabled it again - the issue came back, I also tried uninstalling the driver completely and the machine defaulted to the "High Definition Audio Device" (Standard Microsoft driver 6.1.7601.17514) and sound worked with no display issues for one boot, it then went back to the problem on subsequent boots.
Unfortunately not having sound isn't an option for a workaround as the users are reliant on it for their day to day work, they also can't enable / disable things themselves as we have device manager locked down.
I've updated Check Point VPN to the latest build, updated graphics drivers, sound drivers, carried out general maintenance on the test machine to ensure it's operating as well it can be, rebuilt the WMI repository (there were multiple WMI errors in the system logs at boot but these still exist) - so far only disabling the sound in device manager has helped.
Any thoughts / input / therapy would be really appreciated, unfortunately due to the nature of the customer I can't attach detailed logs but I'm more than happy to pull out specifics from them if anyone wants to check anything.
More...