WIA and hibernation again

William B. Lurie · Apr 2, 2010

John said:
Yes, thats good. The Event Viewer errors relating to these two drivers
should now disappear.

Reboot the machine and give us a fresh list for the Net Start and
Tasklist /svc commands.

Keep checking the Event Log to see if new errors are being recorded, if
you are lucky an event in the log might provide a clue that will lead to
the cause of the problem. If there are no clues in the Event Log then
you will have to look at the loaded modules for more clues. Weeding
through the list of modules is significantly more arduous than disabling
unneeded services. To see the loaded modules enter the following in the
Start Menu Run box:

msinfo32 /category SWEnvLoadedModules

John

Okay, what might be good news. Maybe you can kill this one gremlin.

The run I started at 6:25 PM should have run to hibernate at 8:25.

Instead, when I came in to look at 8:05, my desktop was on.
So I discontinued at looked at Event Log. Sure enough, there was
one event (the only one at all) and it was at 7:49. If hibernate had
been set at 1 hr it would have done so. All consistent. This is an
event we've seen before (but not lately).

Event Type: Error
Event Source: ati2mtag
Event Category: CRT
Event ID: 45062
Date: 4/1/2010
Time: 7:49:25 PM
User: N/A
Computer: COMPAQ-2006
Description:
CRT invalid display type
Data:
0000: 00 00 00 00 01 00 5a 00 ......Z.
0008: 2c 00 00 00 06 b0 00 c0 ,....°.À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I've mentioned this error before but nobody latched onto
it. Since Screen Saver is an issue, maybe this is
the missing link. While I wait for your next comments,
I'll repeat last run exactly, but with screen saver 'none'.

John John - MVP · Apr 2, 2010

William said:
Okay, what might be good news. Maybe you can kill this one gremlin.

The run I started at 6:25 PM should have run to hibernate at 8:25.

Instead, when I came in to look at 8:05, my desktop was on.

6:25 to 8:05... that's less than your 2 hour set time to hibernate. It
won't hibernate if you disturb it before its designated hibernate time,
leave it alone for the full 2 hours. If you set the screen saver to
'None' then it's normal for the desktop to remain on.

So I discontinued at looked at Event Log. Sure enough, there was
one event (the only one at all) and it was at 7:49. If hibernate had
been set at 1 hr it would have done so. All consistent. This is an
event we've seen before (but not lately).

I've mentioned this error before but nobody latched onto
it. Since Screen Saver is an issue, maybe this is
the missing link. While I wait for your next comments,
I'll repeat last run exactly, but with screen saver 'none'.

This at2mtag error was also discussed in an earlier post. It's a bug in
the ATI driver, the solution (which was published in a KB on the ATI
site) was to change a registry setting or roll back the drivers to an
earlier version. ATI has removed the KB article from their site but
even with the newer drivers some users are still seeing the error and
the registry edit is still recommended by experienced ATI users. You
can try the newest ATI drivers and see if it fixes the error, if it
doesn't you should do the registry edit. Get the drivers here:
http://support.amd.com/us/Pages/AMDSupportHub.aspx

John

William B. Lurie · Apr 2, 2010

John said:
6:25 to 8:05... that's less than your 2 hour set time to hibernate. It
won't hibernate if you disturb it before its designated hibernate time,
leave it alone for the full 2 hours. If you set the screen saver to
'None' then it's normal for the desktop to remain on.

This at2mtag error was also discussed in an earlier post. It's a bug in
the ATI driver, the solution (which was published in a KB on the ATI
site) was to change a registry setting or roll back the drivers to an
earlier version. ATI has removed the KB article from their site but
even with the newer drivers some users are still seeing the error and
the registry edit is still recommended by experienced ATI users. You
can try the newest ATI drivers and see if it fixes the error, if it
doesn't you should do the registry edit. Get the drivers here:
http://support.amd.com/us/Pages/AMDSupportHub.aspx

John

I'm in a rush this morning, John, so I won't do useful checking
until after noon. But you're right, the ATI was indeed identified as
a culprit earlier, and I had difficulty removing the bug. Meanwhile
the overnight runs confirm ATI as the major intruder. I'll post the
evidence now and work more later.

Type Date Time Source Category Event User Computer
Error 4/2/2010 7:04:05 AM ati2mtag CRT 45062 N/A COMPAQ-2006
Error 4/2/2010 6:02:37 AM ati2mtag CRT 45062 N/A COMPAQ-2006
Error 4/2/2010 5:01:19 AM ati2mtag CRT 45062 N/A COMPAQ-2006
Error 4/2/2010 4:00:00 AM ati2mtag CRT 45062 N/A COMPAQ-2006
Error 4/2/2010 2:58:42 AM ati2mtag CRT 45062 N/A COMPAQ-2006
Error 4/2/2010 1:57:25 AM ati2mtag CRT 45062 N/A COMPAQ-2006
Error 4/2/2010 12:56:07 AM ati2mtag CRT 45062 N/A COMPAQ-2006
Error 4/1/2010 11:54:47 PM ati2mtag CRT 45062 N/A COMPAQ-2006
Error 4/1/2010 10:51:15 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Error 4/1/2010 10:49:33 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Error 4/1/2010 10:44:37 PM ati2mtag CRT 45062 N/A COMPAQ-2006
Error 4/1/2010 9:52:11 PM ati2mtag CRT 45062 N/A COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/1/2010 8:37:14 PM Service Control Manager None 7036 N/A COMPAQ-2006
Error 4/1/2010 8:35:29 PM ntfs Disk 55 N/A COMPAQ-2006
Error 4/1/2010 8:35:28 PM ntfs Disk 55 N/A COMPAQ-2006
Information 4/1/2010 8:35:27 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/1/2010 8:35:47 PM eventlog None 6005 N/A COMPAQ-2006
Information 4/1/2010 8:35:47 PM eventlog None 6009 N/A COMPAQ-2006
Information 4/1/2010 8:34:53 PM eventlog None 6006 N/A COMPAQ-2006
Information 4/1/2010 8:34:52 PM Service Control Manager None 7036 N/A COMPAQ-2006

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 4/1/2010
Time: 8:37:14 PM
User: N/A
Computer: COMPAQ-2006
Description:
The Remote Access Connection Manager service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: ati2mtag
Event Category: CRT
Event ID: 45062
Date: 4/1/2010
Time: 9:52:11 PM
User: N/A
Computer: COMPAQ-2006
Description:
CRT invalid display type
Data:
0000: 00 00 00 00 01 00 5a 00 ......Z.
0008: 2c 00 00 00 06 b0 00 c0 ,....°.À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 4/1/2010
Time: 10:49:33 PM
User: COMPAQ-2006\Compaq_Owner
Computer: COMPAQ-2006
Description:
DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service MDM with arguments "" in order to run
the server:
{0C0A3666-30C9-11D0-8F20-00805F2CD064}

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 4/1/2010
Time: 10:51:15 PM
User: COMPAQ-2006\Compaq_Owner
Computer: COMPAQ-2006
Description:
DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service MDM with arguments "" in order to run
the server:
{0C0A3666-30C9-11D0-8F20-00805F2CD064}

(I don't recognize MDM but maybe that's due to running with
no Internet connection).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

The ati story repeats before the 2 hour deadline time and time again.
The DCOM error is another matter. Comment if you like, I'll be back.....
and this time I *will* go after that driver upgrade or fix, which I
think I downloaded last time. Or maybe I reinstalled a substitute for
the original driver, a "Legacy" which they gave me. I recall I wasn't
happy with it, but now I have a good leader........

John John - MVP · Apr 2, 2010

William said:
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 4/1/2010
Time: 10:51:15 PM
User: COMPAQ-2006\Compaq_Owner
Computer: COMPAQ-2006
Description:
DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service MDM with arguments "" in order to run
the server:
{0C0A3666-30C9-11D0-8F20-00805F2CD064}

(I don't recognize MDM but maybe that's due to running with
no Internet connection).

MDM is the infamous Machine Debug Manager, something that hardly anyone
other than programmers need to be bothered with. See if Internet
Explorer or other programs are set to use it.

Ignore the title of this article and the problem that it addresses:

http://support.microsoft.com/kb/822521

just go down where you see the 'Internet Options' screenshot and disable
MDM as shown:

3. Click to select the Disable script debugging (Internet Explorer) and
Disable script debugging (Other) check boxes, and then click to clear
the Display a notification about every script error check box.

Click Apply and OK when done.

John

William B. Lurie · Apr 2, 2010

John said:
6:25 to 8:05... that's less than your 2 hour set time to hibernate. It
won't hibernate if you disturb it before its designated hibernate time,
leave it alone for the full 2 hours. If you set the screen saver to
'None' then it's normal for the desktop to remain on.

This at2mtag error was also discussed in an earlier post. It's a bug in
the ATI driver, the solution (which was published in a KB on the ATI
site) was to change a registry setting or roll back the drivers to an
earlier version. ATI has removed the KB article from their site but
even with the newer drivers some users are still seeing the error and
the registry edit is still recommended by experienced ATI users. You
can try the newest ATI drivers and see if it fixes the error, if it
doesn't you should do the registry edit. Get the drivers here:
http://support.amd.com/us/Pages/AMDSupportHub.aspx

John

I did the MDM correction, John. And I downloaded the ATI Catalyst v10.3
full suite. I'll install it in my clone and see wha' hoppen. When I
downloaded some time ago, they led me to a v10.2 Legacy suite that
I didn't like (but I don't remember why).

William B. Lurie · Apr 2, 2010

William said:
I did the MDM correction, John. And I downloaded the ATI Catalyst v10.3
full suite. I'll install it in my clone and see wha' hoppen. When I
downloaded some time ago, they led me to a v10.2 Legacy suite that
I didn't like (but I don't remember why).

And now the latest news...... I installed the full ATI downloaded
Catalyst system, did the Clean Boot and made a 2+ hour run. Results
below. The interruption every hour is still there. And the
Events errors are the same ati2mtag. Nothing else of consequence.
Run started 12:27 ... events occurred at 1:11 2:13 and then 2:49.
I will get the loaded module list, which I haven't done yet.
I thought new drivers would fix the ATI error.......

Unknown · Apr 2, 2010

Do a Google search for 'CRT Event ID 45062'

William B. Lurie said:
And now the latest news...... I installed the full ATI downloaded
Catalyst system, did the Clean Boot and made a 2+ hour run. Results below.
The interruption every hour is still there. And the
Events errors are the same ati2mtag. Nothing else of consequence.
Run started 12:27 ... events occurred at 1:11 2:13 and then 2:49.
I will get the loaded module list, which I haven't done yet.
I thought new drivers would fix the ATI error.......

Unknown · Apr 2, 2010

Your problem has been reported to ATI and they stated it also occurs with
catalyst 7.9.
IE the problem occurs with every release level.

William B. Lurie · Apr 2, 2010

Dear UNk:
My system was and is way past Catalyst 7.9 ... The one
I just downloaded and installed is 10.3, and it replaces
an earlier one, in the 9 series (I haven't got the number handy).
Going back to a still earlier version is impractical. Where
would I find it, and shouldn't later versions have problems solved,
not introduced anew?(I know....two steps forward, one step back).

Right now I've taken John's avice and have 10.3 in place.....and
still giving the ati2mtag error.

BTW, I went to your link and saw a lot of fixing DCOM but I
didn't see fixing ati2mtag ...maybe I missed it.

William B. Lurie · Apr 2, 2010

Went there again, UN, and read many many posts, all
describing the same problem, and no solution I could find
other than going back to earlier versions (7). I doubt
that I could get it if I wanted it, and doubt that I'd
go way back and ignore what must have been real improvements
since then. Interesting that nobody has a solution, altho' I
though John was leading me to one. Let's believe in him; he
makes the most sense.

John John - MVP · Apr 2, 2010

William said:
And now the latest news...... I installed the full ATI downloaded
Catalyst system, did the Clean Boot and made a 2+ hour run. Results
below. The interruption every hour is still there. And the
Events errors are the same ati2mtag. Nothing else of consequence.
Run started 12:27 ... events occurred at 1:11 2:13 and then 2:49.
I will get the loaded module list, which I haven't done yet.
I thought new drivers would fix the ATI error.......

Do the registry edit and get the ATI error out of your hair:

Copy and paste the stuff between the ===== lines to a notepad file:

==================================================================
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Atierecord]
"eRecordEnable"=dword:00000000
"eRecordEnablePopups"=dword:00000000

==================================================================

In an easy to find location save the file as a .reg file (for example,
ati.reg). Right click on the .reg file and select "Merge". Reboot
after you merge the file to the registry.

Image Name PID

=====================================================
System Idle Process 0
...
...

ctfmon.exe 1416

Do you have Microsoft Office installed? And which IE version are you
running?

You may as well get rid of ctfmon, it's another one of these things that
most folks don't really need running on their computer. See here:

http://support.microsoft.com/kb/282599
Frequently asked questions about Ctfmon.exe

Follow these instructions and disable Ctfmon:

_Step 1:_ Uninstall Alternative User Input
To uninstall the alternative user input feature, set the installation
state to Not Available in Office XP Setup.

1. Quit all Office programs.

2. Click Start and then click Control Panel.

3. In Control Panel, click Add or Remove Programs.

4. In the Currently installed programs list, click to select
Microsoft Office XP product, where Office XP product is the name of the
specific Office product being used. If you are using a standalone
version of one of the Office programs, click to select the appropriate
product in the list. Click Change.

5. In the Maintenance Mode Options dialog box, select Add or Remove
Features, and then click Next. This displays the Choose installation
options for all Office applications and tools dialog box.

6. Click the plus sign (+) next to Office Shared Features to expand it.

7. Click the icon next to Alternative User Input, and then select
Not Available.

8. Click Update.

NOTE: If you have multiple Office XP products installed, for example,
Office XP Professional and Publisher 2002, you must repeat the preceding
steps for each installed product.

_Step 2:_ Remove Alternative User Input Services from Text Services

1. Click Start, point to Settings, and then click Control Panel.

2. In the Control Panel, click Date, Time, Language, and Regional
Options, and then click Regional and Language Options. On the Languages
tab, click Details.

3. Under Installed Services, select each input item that is listed,
and then click Remove to remove the item. All items must be removed, one
by one, except the following input service:

English (United States)- default Keyboard United States 101

_Step 3:_ Run Regsvr32 /U on the Msimtf.dll and Msctf.dll Files

1. Click Start and then click Run.
2. In the Run dialog box, type the following command:
Regsvr32.exe /u msimtf.dll
3. Click OK.
4. Repeat steps 1 through 3 for the Msctf.dll file.

John

William B. Lurie · Apr 3, 2010

William said:
John, I believe you asked me to get this Loaded Modules list:

(Sorry it's so long, but......) so I snipped it.

Now results on Clone system with latest ATI driver and
with your ATI error-out-of-your-hair fix, John:

Ran the usual 2.3 hour attempt to hibernate. Started as always
with clean boot and with emptied Events logs. After 2.3 hours, I jiggled
the mouse and it came alive, as usual. It had not hibernated. There were
*no* events in that interval, recorded in the Events Log. I checked
Services and found I had set Error Reporting as Manual, Event Log
Automatic, WIA Disabled. I checked Drivers and found ati2mtag Running.

This was a good news-bad news thing to me, John. Good news that
I didn't get the ATI Error. Good news that I didn't get *any* errors,
but bad news that it didn't hibernate. It's after 10 PM now and
I can't wait up to see what you're going to make of this (or what I sent
earlier), and what to do next. I might as well set up the Clone
to run again overnight, making sure I have everything set right.

William B. Lurie · Apr 3, 2010

William said:
Now results on Clone system with latest ATI driver and
with your ATI error-out-of-your-hair fix, John:

Ran the usual 2.3 hour attempt to hibernate. Started as always
with clean boot and with emptied Events logs. After 2.3 hours, I jiggled
the mouse and it came alive, as usual. It had not hibernated. There were
*no* events in that interval, recorded in the Events Log. I checked
Services and found I had set Error Reporting as Manual, Event Log
Automatic, WIA Disabled. I checked Drivers and found ati2mtag Running.

This was a good news-bad news thing to me, John. Good news that
I didn't get the ATI Error. Good news that I didn't get *any* errors,
but bad news that it didn't hibernate. It's after 10 PM now and
I can't wait up to see what you're going to make of this (or what I sent
earlier), and what to do next. I might as well set up the Clone
to run again overnight, making sure I have everything set right.

Continuing on next morning. Overnight run, would have expected it to
be just a repeat of previous, since I made no changes. Not true,
but nothing *bad* showed up. See these:

These Windows services are started:

COM+ Event System
Cryptographic Services
DCOM Server Process Launcher
DHCP Client
Event Log
Fast User Switching Compatibility
Help and Support
IPSEC Services
Network Connections
Network Location Awareness (NLA)
Plug and Play
Protected Storage
Remote Access Connection Manager
Remote Procedure Call (RPC)
Security Accounts Manager
Server
Shell Hardware Detection
System Event Notification
Telephony
Terminal Services
Themes
Windows Audio
Windows Firewall/Internet Connection Sharing (ICS)
Windows Management Instrumentation
Wireless Zero Configuration
Workstation

The command completed successfully.

Image Name PID Services

========================= ======
=============================================
System Idle Process 0 N/A

System 4 N/A

smss.exe 1200 N/A

csrss.exe 1280 N/A

winlogon.exe 1312 N/A

services.exe 1356 Eventlog, PlugPlay

lsass.exe 1368 PolicyAgent, ProtectedStorage, SamSs

svchost.exe 1516 DcomLaunch, TermService

svchost.exe 1624 RpcSs

svchost.exe 1780 AudioSrv, CryptSvc, Dhcp, EventSystem,

FastUserSwitchingCompatibility,
helpsvc,
lanmanserver, lanmanworkstation,
Netman,
Nla, RasMan, SENS, SharedAccess,

ShellHWDetection, TapiSrv, Themes,
winmgmt,
WZCSVC

explorer.exe 640 N/A

cmd.exe 1688 N/A

tasklist.exe 420 N/A

wmiprvse.exe

Type Date Time Source Category Event User Computer
Information 4/2/2010 10:12:55 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager None 7035
Compaq_Owner COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:11:08 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/2/2010 10:11:26 PM eventlog None 6005 N/A COMPAQ-2006
Information 4/2/2010 10:11:26 PM eventlog None 6009 N/A COMPAQ-2006
Information 4/2/2010 10:10:34 PM eventlog None 6006 N/A COMPAQ-2006
Information 4/2/2010 10:10:33 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7035
Compaq_Owner COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/2/2010 10:08:10 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/2/2010 10:08:29 PM eventlog None 6005 N/A COMPAQ-2006
Information 4/2/2010 10:08:29 PM eventlog None 6009 N/A COMPAQ-2006
Information 4/2/2010 9:52:13 PM eventlog None 6006 N/A COMPAQ-2006
Information 4/2/2010 9:50:01 PM Service Control Manager None 7035
Compaq_Owner COMPAQ-2006

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 4/2/2010
Time: 10:12:55 PM
User: COMPAQ-2006\Compaq_Owner
Computer: COMPAQ-2006
Description:
The Remote Access Connection Manager service was successfully sent a
start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Notice, no ati2 problems. A lot of information calls but
no complaints or errors. But no sign of it going to hibernation.
So at first glance, we have it all fixed, but the goal we set
out for, we have not achieved. I'm going back there to see what happens
if I set it to hibernate after only 1 hour. Maybe you'll have some
comment......

John John - MVP · Apr 3, 2010

William said:
Now results on Clone system with latest ATI driver and
with your ATI error-out-of-your-hair fix, John:

Ran the usual 2.3 hour attempt to hibernate. Started as always
with clean boot and with emptied Events logs. After 2.3 hours, I jiggled
the mouse and it came alive, as usual. It had not hibernated. There were
*no* events in that interval, recorded in the Events Log. I checked
Services and found I had set Error Reporting as Manual, Event Log
Automatic, WIA Disabled. I checked Drivers and found ati2mtag Running.

This was a good news-bad news thing to me, John. Good news that
I didn't get the ATI Error. Good news that I didn't get *any* errors,
but bad news that it didn't hibernate. It's after 10 PM now and
I can't wait up to see what you're going to make of this (or what I sent
earlier), and what to do next. I might as well set up the Clone
to run again overnight, making sure I have everything set right.

Just a hunch here... did you remove the old ATI drivers before
installing the new ones? (in Add/Remove Programs). If you didn't it
would be worth a try to remove the ATI/Catatlyst software and then
reinstall the drivers.

1- Go in Add/Remove Programs and uninstall ATI software.

2- Go in Device Manager and Uninstall the Display Adapter.

3- Reboot the computer. Windows will find the Display Adapter and it
will want to install it. *DO* *NOT* let Windows install the adapter,
cancel/exit your way out.

4- Install the new Catalyst drivers.

John

PS: *After* you reinstall the Catalyst drivers give us an updated Net
Start and Tasklist /svc.

Note: Keep Screen Saver set to NONE while you troubleshoot this problem!

John John - MVP · Apr 3, 2010

William said:
Continuing on next morning. Overnight run, would have expected it to
be just a repeat of previous, since I made no changes. Not true,
but nothing *bad* showed up. See these:

Image Name PID Services
========================= ======
=============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 1200 N/A
csrss.exe 1280 N/A
winlogon.exe 1312 N/A
services.exe 1356 Eventlog, PlugPlay
lsass.exe 1368 PolicyAgent, ProtectedStorage, SamSs
svchost.exe 1516 DcomLaunch, TermService
svchost.exe 1624 RpcSs
svchost.exe 1780 AudioSrv, CryptSvc, Dhcp, EventSystem,
FastUserSwitchingCompatibility, helpsvc,
lanmanserver, lanmanworkstation, Netman,
Nla, RasMan, SENS, SharedAccess,
ShellHWDetection, TapiSrv, Themes,
winmgmt,
WZCSVC
explorer.exe 640 N/A
cmd.exe 1688 N/A
tasklist.exe 420 N/A
wmiprvse.exe

Type Date Time Source Category Event User Computer
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7035 Compaq_Owner COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/2/2010 10:12:55 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:11:08 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/2/2010 10:11:26 PM eventlog None 6005
N/A COMPAQ-2006
Information 4/2/2010 10:11:26 PM eventlog None 6009
N/A COMPAQ-2006
Information 4/2/2010 10:10:34 PM eventlog None 6006
N/A COMPAQ-2006
Information 4/2/2010 10:10:33 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7035 Compaq_Owner COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/2/2010 10:09:57 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/2/2010 10:08:10 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/2/2010 10:08:29 PM eventlog None 6005
N/A COMPAQ-2006
Information 4/2/2010 10:08:29 PM eventlog None 6009
N/A COMPAQ-2006
Information 4/2/2010 9:52:13 PM eventlog None 6006
N/A COMPAQ-2006
Information 4/2/2010 9:50:01 PM Service Control Manager
None 7035 Compaq_Owner COMPAQ-2006

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 4/2/2010
Time: 10:12:55 PM
User: COMPAQ-2006\Compaq_Owner
Computer: COMPAQ-2006
Description:
The Remote Access Connection Manager service was successfully sent a
start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Notice, no ati2 problems. A lot of information calls but
no complaints or errors. But no sign of it going to hibernation.
So at first glance, we have it all fixed, but the goal we set
out for, we have not achieved. I'm going back there to see what happens
if I set it to hibernate after only 1 hour. Maybe you'll have some
comment......

I find it surprising that you installed new Catalyst drivers but that no
ATI services or processes show up in the Net Start or Tasklist
results... Did you go in Services.msc and disable them? See my other
post about reinstalling the drivers.

Also, do not use screen savers while you try to fix this. When you come
back to the machine after two hours what do you see? Is the screen just
black? Or...?

John

William B. Lurie · Apr 3, 2010

John said:
I find it surprising that you installed new Catalyst drivers but that no
ATI services or processes show up in the Net Start or Tasklist
results... Did you go in Services.msc and disable them? See my other
post about reinstalling the drivers.

Also, do not use screen savers while you try to fix this. When you come
back to the machine after two hours what do you see? Is the screen just
black? Or...?

John

Okay, John, I'll UNinstall the drivers and reinstall. I had just
let it install, figuring it would write over the old, or do what
it needed to do. Yes, screen savers are off. When I go back after 2
hours, it is at Desktop with all icons, but somewhat earlier a glance
showed all black screen. As for disabling in services.msc .... I
believe I reported what they were set for, but I'll check when I go
there now. BTW ... a 1.5 hour run this morning with hibernate set at
1 hour......same result, it just didn't hibernate.

Unknown · Apr 3, 2010

Wholeheartedly agree with you. He's the best (and is an MVP) on all
newsgroups.

John John - MVP · Apr 3, 2010

Thanks for the compliment... or surely you jest. Some in these groups
have forgotten more than I will ever know...

John

Unknown · Apr 3, 2010

Don't be modest. I've followed your posts for a long time and you're the
best.
(Most intelligent).

William B. Lurie · Apr 3, 2010

As the saying goes, John, you EARNED it.
Now please see my post at bottom of this message.

Don't be modest. I've followed your posts for a long time and you're the
best.
(Most intelligent).

John, I went back to the clone and changed a few things, and for the
first time I got a run which did go to hibernation at some time
within the period 12:40 to 1400. I think the changes I made were to
re-enable ATI Smart and ATI Hotkey as Manual......and I may have
re-enabled WIA. I'll go back and check. Meanwhile, here are the
pertinent Logs etcetera. I know it's kinda long but I figure you
want to see it.

Time Source Category Event User Computer
Failure Audit 4/3/2010 2:00:09 PM Security Policy Change 615 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:22:58 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:22:58 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:22:54 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:22:54 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:36 PM Security Policy Change 848 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:35 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:22 PM Security Logon/Logoff 540 ANONYMOUS LOGON COMPAQ-2006
Success Audit 4/3/2010 12:22:20 PM Security Policy Change 615 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:22:12 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:12 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:11 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:09 PM Security Privilege Use 576 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:22:09 PM Security Logon/Logoff 528 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:22:09 PM Security Account Logon 680 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:09 PM Security Logon/Logoff 538 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:22:09 PM Security Privilege Use 576 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:22:09 PM Security Logon/Logoff 528 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:22:09 PM Security Account Logon 680 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:08 PM Security Policy Change 806 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 518 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:22:04 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:20:41 PM Security System Event 513 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:20:39 PM Security Logon/Logoff 538 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:20:34 PM Security Logon/Logoff 551 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:19:04 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:19:04 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 849 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Policy Change 848 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:18:59 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:18:58 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:43 PM Security Logon/Logoff 540 ANONYMOUS LOGON COMPAQ-2006
Success Audit 4/3/2010 12:18:41 PM Security Policy Change 615 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:18:33 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:32 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:32 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:31 PM Security Privilege Use 576 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:18:31 PM Security Logon/Logoff 528 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:18:31 PM Security Account Logon 680 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:31 PM Security Logon/Logoff 538 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:18:31 PM Security Privilege Use 576 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:18:31 PM Security Logon/Logoff 528 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 12:18:31 PM Security Account Logon 680 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:30 PM Security Policy Change 806 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 518 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 515 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:18:26 PM Security System Event 514 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:17:31 PM Security System Event 513 SYSTEM COMPAQ-2006
Success Audit 4/3/2010 12:17:25 PM Security Logon/Logoff 551 Compaq_Owner COMPAQ-2006
Success Audit 4/3/2010 10:45:50 AM Security System Event 517 SYSTEM COMPAQ-2006

Type Date Time Source Category Event User Computer
Information 4/3/2010 2:02:37 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 2:02:36 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/3/2010 2:00:10 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/3/2010 12:23:27 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:21:40 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/3/2010 12:22:04 PM eventlog None 6005 N/A COMPAQ-2006
Information 4/3/2010 12:22:04 PM eventlog None 6009 N/A COMPAQ-2006
Information 4/3/2010 12:20:41 PM eventlog None 6006 N/A COMPAQ-2006
Information 4/3/2010 12:20:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/3/2010 12:19:54 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/3/2010 12:18:07 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/3/2010 12:18:26 PM eventlog None 6005 N/A COMPAQ-2006
Information 4/3/2010 12:18:26 PM eventlog None 6009 N/A COMPAQ-2006
Information 4/3/2010 12:17:31 PM eventlog None 6006 N/A COMPAQ-2006

These Windows services are started:

COM+ Event System
Cryptographic Services
DCOM Server Process Launcher
DHCP Client
Error Reporting Service
Event Log
Fast User Switching Compatibility
Help and Support
IPSEC Services
Network Connections
Network Location Awareness (NLA)
Plug and Play
Protected Storage
Remote Access Connection Manager
Remote Procedure Call (RPC)
Security Accounts Manager
Server
Shell Hardware Detection
System Event Notification
Telephony
Terminal Services
Themes
Windows Audio
Windows Firewall/Internet Connection Sharing (ICS)
Windows Image Acquisition (WIA)
Windows Management Instrumentation
Wireless Zero Configuration
Workstation

The command completed successfully.

Image Name PID Services
========================= ====== =============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 1200 N/A
csrss.exe 1284 N/A
winlogon.exe 1316 N/A
services.exe 1360 Eventlog, PlugPlay
lsass.exe 1372 PolicyAgent, ProtectedStorage, SamSs
svchost.exe 1532 DcomLaunch, TermService
svchost.exe 1640 RpcSs
svchost.exe 1812 AudioSrv, CryptSvc, Dhcp, ERSvc,
EventSystem, FastUserSwitchingCompatibility,
helpsvc, lanmanserver, lanmanworkstation,
Netman, Nla, RasMan, SENS, SharedAccess,
ShellHWDetection, TapiSrv, Themes, winmgmt,
WZCSVC
explorer.exe 648 N/A
mmc.exe 1612 N/A
svchost.exe 376 stisvc
cmd.exe 1000 N/A
tasklist.exe 308 N/A
wmiprvse.exe 720 N/A

I'm going back to verify that I said above.

WIA and hibernation again

William B. Lurie

John John - MVP

William B. Lurie

John John - MVP

William B. Lurie

William B. Lurie

Unknown

Unknown

William B. Lurie

William B. Lurie

John John - MVP

William B. Lurie

William B. Lurie

John John - MVP

John John - MVP

William B. Lurie

Unknown

John John - MVP

Unknown

William B. Lurie