Log Name:      System
Source:        EventLog
Date:          9/25/2021 8:20:12 AM
Event ID:      6008
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-O36BR36
Description:
The previous system shutdown at 7:45:29 AM on ‎9/‎25/‎2021 was unexpected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6008</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-25T13:20:12.5736642Z" />
    <EventRecordID>15905</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security />
  </System>
  <EventData>
    <Data>7:45:29 AM</Data>
    <Data>‎9/‎25/‎2021</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>4809</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Binary>E50709000600190007002D001D004700E5070900060019000C002D001D004700600900003C000000010000006009000001000000B00400000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          9/24/2021 9:13:08 PM
Event ID:      6008
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-O36BR36
Description:
The previous system shutdown at 8:44:46 PM on ‎9/‎24/‎2021 was unexpected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6008</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-25T02:13:08.9032298Z" />
    <EventRecordID>15712</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security />
  </System>
  <EventData>
    <Data>8:44:46 PM</Data>
    <Data>‎9/‎24/‎2021</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>50409</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Binary>E50709000500180014002C002E00BA00E50709000600190001002C002E00BA00600900003C000000010000006009000001000000B00400000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          9/25/2021 6:25:45 AM
Event ID:      7000
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-O36BR36
Description:
The AMDRyzenMasterDriver service failed to start due to the following error: 
Cannot create a file when that file already exists.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-25T11:25:45.2316748Z" />
    <EventRecordID>15874</EventRecordID>
    <Correlation />
    <Execution ProcessID="488" ThreadID="8620" />
    <Channel>System</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">AMDRyzenMasterDriver</Data>
    <Data Name="param2">%%183</Data>
    <Binary>41004D004400520079007A0065006E004D00610073007400650072004400720069007600650072000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          9/25/2021 6:25:32 AM
Event ID:      7000
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-O36BR36
Description:
The AMDRyzenMasterDriver service failed to start due to the following error: 
Cannot create a file when that file already exists.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-25T11:25:32.4956665Z" />
    <EventRecordID>15870</EventRecordID>
    <Correlation />
    <Execution ProcessID="488" ThreadID="1780" />
    <Channel>System</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">AMDRyzenMasterDriver</Data>
    <Data Name="param2">%%183</Data>
    <Binary>41004D004400520079007A0065006E004D00610073007400650072004400720069007600650072000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-PnP
Date:          9/25/2021 7:56:57 PM
Event ID:      225
Task Category: (223)
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      DESKTOP-O36BR36
Description:
The application \Device\HarddiskVolume4\Windows\System32\audiodg.exe with process id 3604 stopped the removal or ejection for the device PCI\VEN_1002&DEV_AAF0&SUBSYS_AAF01043&REV_00\4&1c3d25bb&0&0119.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="{9c205a39-1250-487d-abd7-e831c6290539}" />
    <EventID>225</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>223</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-26T00:56:57.3884113Z" />
    <EventRecordID>16072</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="18748" />
    <Channel>System</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ProcessId">3604</Data>
    <Data Name="ProcessNameLength">52</Data>
    <Data Name="ProcessName">\Device\HarddiskVolume4\Windows\System32\audiodg.exe</Data>
    <Data Name="DeviceInstanceLength">62</Data>
    <Data Name="DeviceInstance">PCI\VEN_1002&amp;DEV_AAF0&amp;SUBSYS_AAF01043&amp;REV_00\4&amp;1c3d25bb&amp;0&amp;0119</Data>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-User Device Registration/Admin
Source:        Microsoft-Windows-User Device Registration
Date:          9/26/2021 7:25:02 AM
Event ID:      360
Task Category: None
Level:         Warning
Keywords:      
User:          DESKTOP-O36BR36\d_ehr
Computer:      DESKTOP-O36BR36
Description:
Windows Hello for Business provisioning will not be launched. 
Device is AAD joined ( AADJ or DJ++ ): Not Tested 
User has logged on with AAD credentials: No 
Windows Hello for Business policy is enabled: Not Tested 
Windows Hello for Business post-logon provisioning is enabled: Not Tested 
Local computer meets Windows hello for business hardware requirements: Not Tested 
User is not connected to the machine via Remote Desktop: Yes 
User certificate for on premise auth policy is enabled: Not Tested 
Machine is governed by none policy. 
Cloud trust for on premise auth policy is enabled: Not Tested 
User account has Cloud TGT: Not Tested 
See https://go.microsoft.com/fwlink/?linkid=832647 for more details.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Device Registration" Guid="{23b8d46b-67dd-40a3-b636-d43e50552c6d}" />
    <EventID>360</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-26T12:25:02.5565894Z" />
    <EventRecordID>167</EventRecordID>
    <Correlation />
    <Execution ProcessID="4852" ThreadID="5788" />
    <Channel>Microsoft-Windows-User Device Registration/Admin</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security UserID="S-1-5-21-1606878850-1814730049-3310847063-1001" />
  </System>
  <EventData>
    <Data Name="Message">Windows Hello for Business provisioning will not be launched.</Data>
    <Data Name="DeviceIsJoined">Not Tested</Data>
    <Data Name="AADPrt">No</Data>
    <Data Name="NgcPolicyEnabled">Not Tested</Data>
    <Data Name="NgcPostLogonProvisioningEnabled">Not Tested</Data>
    <Data Name="NgcHardwarePolicyMet">Not Tested</Data>
    <Data Name="UserIsRemote">Yes</Data>
    <Data Name="LogonCertRequired">Not Tested</Data>
    <Data Name="MachinePolicySource">none</Data>
    <Data Name="UseCloudTrust">Not Tested</Data>
    <Data Name="CloudTgt">Not Tested</Data>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-User Device Registration/Admin
Source:        Microsoft-Windows-User Device Registration
Date:          9/25/2021 8:20:22 AM
Event ID:      360
Task Category: None
Level:         Warning
Keywords:      
User:          DESKTOP-O36BR36\d_ehr
Computer:      DESKTOP-O36BR36
Description:
Windows Hello for Business provisioning will not be launched. 
Device is AAD joined ( AADJ or DJ++ ): Not Tested 
User has logged on with AAD credentials: No 
Windows Hello for Business policy is enabled: Not Tested 
Windows Hello for Business post-logon provisioning is enabled: Not Tested 
Local computer meets Windows hello for business hardware requirements: Not Tested 
User is not connected to the machine via Remote Desktop: Yes 
User certificate for on premise auth policy is enabled: Not Tested 
Machine is governed by none policy. 
Cloud trust for on premise auth policy is enabled: Not Tested 
User account has Cloud TGT: Not Tested 
See https://go.microsoft.com/fwlink/?linkid=832647 for more details.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Device Registration" Guid="{23b8d46b-67dd-40a3-b636-d43e50552c6d}" />
    <EventID>360</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-25T13:20:22.7243125Z" />
    <EventRecordID>166</EventRecordID>
    <Correlation />
    <Execution ProcessID="8432" ThreadID="8576" />
    <Channel>Microsoft-Windows-User Device Registration/Admin</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security UserID="S-1-5-21-1606878850-1814730049-3310847063-1001" />
  </System>
  <EventData>
    <Data Name="Message">Windows Hello for Business provisioning will not be launched.</Data>
    <Data Name="DeviceIsJoined">Not Tested</Data>
    <Data Name="AADPrt">No</Data>
    <Data Name="NgcPolicyEnabled">Not Tested</Data>
    <Data Name="NgcPostLogonProvisioningEnabled">Not Tested</Data>
    <Data Name="NgcHardwarePolicyMet">Not Tested</Data>
    <Data Name="UserIsRemote">Yes</Data>
    <Data Name="LogonCertRequired">Not Tested</Data>
    <Data Name="MachinePolicySource">none</Data>
    <Data Name="UseCloudTrust">Not Tested</Data>
    <Data Name="CloudTgt">Not Tested</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-UserModePowerService
Date:          9/25/2021 8:20:13 AM
Event ID:      12
Task Category: (10)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      DESKTOP-O36BR36
Description:
Process C:\Windows\System32\DriverStore\FileRepository\u0370882.inf_amd64_16efd232c9cc1313\B370998\atieclxx.exe (process ID:2572) reset policy scheme from {9897998c-92de-4669-853f-b7cd3ecb2790} to {9897998c-92de-4669-853f-b7cd3ecb2790}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-UserModePowerService" Guid="{ce8dee0b-d539-4000-b0f8-77bed049c590}" />
    <EventID>12</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>10</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-25T13:20:13.8916269Z" />
    <EventRecordID>15954</EventRecordID>
    <Correlation />
    <Execution ProcessID="756" ThreadID="1032" />
    <Channel>System</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ProcessPath">C:\Windows\System32\DriverStore\FileRepository\u0370882.inf_amd64_16efd232c9cc1313\B370998\atieclxx.exe</Data>
    <Data Name="ProcessPid">2572</Data>
    <Data Name="OldSchemeGuid">{9897998c-92de-4669-853f-b7cd3ecb2790}</Data>
    <Data Name="NewSchemeGuid">{9897998c-92de-4669-853f-b7cd3ecb2790}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-UserModePowerService
Date:          9/25/2021 6:25:30 AM
Event ID:      12
Task Category: (10)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      DESKTOP-O36BR36
Description:
Process C:\Windows\System32\DriverStore\FileRepository\u0370882.inf_amd64_16efd232c9cc1313\B370998\atieclxx.exe (process ID:2556) reset policy scheme from {9897998c-92de-4669-853f-b7cd3ecb2790} to {9897998c-92de-4669-853f-b7cd3ecb2790}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-UserModePowerService" Guid="{ce8dee0b-d539-4000-b0f8-77bed049c590}" />
    <EventID>12</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>10</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-25T11:25:30.6535214Z" />
    <EventRecordID>15864</EventRecordID>
    <Correlation />
    <Execution ProcessID="812" ThreadID="1356" />
    <Channel>System</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ProcessPath">C:\Windows\System32\DriverStore\FileRepository\u0370882.inf_amd64_16efd232c9cc1313\B370998\atieclxx.exe</Data>
    <Data Name="ProcessPid">2556</Data>
    <Data Name="OldSchemeGuid">{9897998c-92de-4669-853f-b7cd3ecb2790}</Data>
    <Data Name="NewSchemeGuid">{9897998c-92de-4669-853f-b7cd3ecb2790}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-UserModePowerService
Date:          9/24/2021 9:13:09 PM
Event ID:      12
Task Category: (10)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      DESKTOP-O36BR36
Description:
Process C:\Windows\System32\DriverStore\FileRepository\u0370882.inf_amd64_16efd232c9cc1313\B370998\atieclxx.exe (process ID:2692) reset policy scheme from {9897998c-92de-4669-853f-b7cd3ecb2790} to {9897998c-92de-4669-853f-b7cd3ecb2790}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-UserModePowerService" Guid="{ce8dee0b-d539-4000-b0f8-77bed049c590}" />
    <EventID>12</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>10</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-25T02:13:09.9191749Z" />
    <EventRecordID>15761</EventRecordID>
    <Correlation />
    <Execution ProcessID="760" ThreadID="1548" />
    <Channel>System</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ProcessPath">C:\Windows\System32\DriverStore\FileRepository\u0370882.inf_amd64_16efd232c9cc1313\B370998\atieclxx.exe</Data>
    <Data Name="ProcessPid">2692</Data>
    <Data Name="OldSchemeGuid">{9897998c-92de-4669-853f-b7cd3ecb2790}</Data>
    <Data Name="NewSchemeGuid">{9897998c-92de-4669-853f-b7cd3ecb2790}</Data>
  </EventData>
</Event>

Log Name:      Security
Source:        Microsoft-Windows-Eventlog
Date:          9/25/2021 8:20:12 AM
Event ID:      1101
Task Category: Event processing
Level:         Error
Keywords:      Audit Success
User:          N/A
Computer:      DESKTOP-O36BR36
Description:
Audit events have been dropped by the transport.  0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Eventlog" Guid="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" />
    <EventID>1101</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>101</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4020000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-25T13:20:12.8551166Z" />
    <EventRecordID>292211</EventRecordID>
    <Correlation />
    <Execution ProcessID="1636" ThreadID="2360" />
    <Channel>Security</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security />
  </System>
  <UserData>
    <AuditEventsDropped xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog">
      <Reason>0</Reason>
    </AuditEventsDropped>
  </UserData>
</Event>

Log Name:      Security
Source:        Microsoft-Windows-Eventlog
Date:          9/24/2021 9:13:09 PM
Event ID:      1101
Task Category: Event processing
Level:         Error
Keywords:      Audit Success
User:          N/A
Computer:      DESKTOP-O36BR36
Description:
Audit events have been dropped by the transport.  0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Eventlog" Guid="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" />
    <EventID>1101</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>101</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4020000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-25T02:13:09.1840557Z" />
    <EventRecordID>290545</EventRecordID>
    <Correlation />
    <Execution ProcessID="1716" ThreadID="2452" />
    <Channel>Security</Channel>
    <Computer>DESKTOP-O36BR36</Computer>
    <Security />
  </System>
  <UserData>
    <AuditEventsDropped xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog">
      <Reason>0</Reason>
    </AuditEventsDropped>
  </UserData>
</Event>