Question Explorer.exe dialogue error pops up just before shutting down randomly

[WrongRookie]

I get this error randomly where the explorer.exe says Application error The instruction 0x4a4163c3 referebced memory at 0x00000000 The memory could not be read Click on OK to terminate the program or some other error that's like this.

So in the event viewer I found that this volume shadow is the main culprit as this is what it shows.

"Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x8007045b, A system shutdown is in progress."

And when I shutdown, that explorer exe error just displays it and only after waiting a while or pressing ok, the shutdown resumes.

Is there any fix for this? I already tried turning it to automatic start(delayed) and did a clean boot but that didn't work. I even did a ram diagnostic test and no errors there either. Its harmless and hasn't done anything but it is rather annoying.

Specs:

Intel i5 13600k

Ram : 64 GB Ripjaws V

GPU : MSI GeForce RTX 2060 VENTUS GP OC 6GB

Motherboard : MSI MAG B660 TOMAHAWK WIFI DDR4 (MS- 7D41)

OS : Windows 11 Pro

Drives: Samsung 980 Pro 1TB

Crucial MX500 2TB

Crucial MX500 4TB

Samsung 870 Evo 2TB

EDIT: if you need the event viewer errors

https://imgur.com/jnWgJNc

View: https://imgur.com/jnWgJNc

https://imgur.com/ay0tBCr

View: https://imgur.com/ay0tBCr

https://imgur.com/Pihv5o0

View: https://imgur.com/Pihv5o0

https://imgur.com/tjEgvwz

View: https://imgur.com/tjEgvwz

 

[Colif]

volume shadow copy is system restore. Have you looked to see how many records you have already? Might need to reduce them

1. Ensure that you have Admin rights.
2. Go to the “Start” menu.
3. Type “Create restore point.”
4. Locate the “Configure” Button.
5. Under “Disk Space usage," use the “Max Usage” slider to adjust the percentage (%) of the disk that will be reserved for System Restore points. The lower the percentage, the fewer restore points will be saved.

https://www.dell.com/support/kbdoc/...-space-by-managing-your-system-restore-points

this shows to disable it but its actually useful sometimes as it creates a restore point before any new drivers installed

Enable or Disable System Restore in Windows 11

This tutorial will show you how to enable or disable the System Restore for all users in Windows 10 and Windows 11. System Restore monitors system changes and saves the system state as a restore point. If a system problem develops as a result of a system change, the user can return the system...

www.elevenforum.com

could disable just to see if it stops error.

other thought:
right click start
choose Terminal (admin)
if it doesn't open as Powershell, select the arrow in title header and choose from list
copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter

Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

 

[WrongRookie]

volume shadow copy is system restore. Have you looked to see how many records you have already? Might need to reduce them


https://www.dell.com/support/kbdoc/...-space-by-managing-your-system-restore-points

this shows to disable it but its actually useful sometimes as it creates a restore point before any new drivers installed

Enable or Disable System Restore in Windows 11

This tutorial will show you how to enable or disable the System Restore for all users in Windows 10 and Windows 11. System Restore monitors system changes and saves the system state as a restore point. If a system problem develops as a result of a system change, the user can return the system...

www.elevenforum.com

could disable just to see if it stops error.

other thought:
right click start
choose Terminal (admin)
if it doesn't open as Powershell, select the arrow in title header and choose from list
copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter

Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

Ok I checked if system restore is on and in my C drive it is. Then I disabled it from the local policy group editor. And I did the Terminal and SFC as suggested. No errors.

I also reduced it to 0%.

Will wait and see if it comes again. But I'm just curious..what does system restore have to do with the explorer.exe error dialog box popping up before shutdown?

 

[Colif]

Event 8193 is likely cause of the explorer pop up.

Cause​

When a Volume Shadow Copy Service (VSS)-based backup is performed, each of the subscribed VSS writers is queried for a list of components. The problem that's described in the Symptoms section occurs when that list generates a metadata file that's larger than the size limitation.

Common causes:

• Too many files in the TemporaryInternetFiles directory-specifically, in C:\Windows\Microsoft.NET\Framework64\v2.0.50727\TemporaryInternetFiles. This causes the System Writer to hit the size limit of the VSS metadata file.
• VSS Writer has added too many components to its metadata file.

https://learn.microsoft.com/en-us/t...storage/event-id-8193-when-you-perform-backup

possible running disk cleanup would help. I believe it clears temp folders.
search for cleanup

looks like its the 2nd choice in the app

if, for some reason, an app hasn't finished doing whatever at shutdown, you will get explorer telling you its not finished yet.. Especially if its related to files.

I would turn system restore on as though it isn't amazingly helpful, fact it creates a restore point before any windows updates or driver updates can be a blessing if you need it.

 

[WrongRookie]

Event 8193 is likely cause of the explorer pop up.


https://learn.microsoft.com/en-us/t...storage/event-id-8193-when-you-perform-backup

possible running disk cleanup would help. I believe it clears temp folders.
search for cleanup

looks like its the 2nd choice in the app

if, for some reason, an app hasn't finished doing whatever at shutdown, you will get explorer telling you its not finished yet.. Especially if its related to files.

I would turn system restore on as though it isn't amazingly helpful, fact it creates a restore point before any windows updates or driver updates can be a blessing if you need it.

I enabled it back deleted all tge temp files including all the system files to free up the space and enabled system restore.

...still gives that error randomly.

 

[Colif]

VSS Event 13

It is a CryptSVC bug in 1903-1909, stop CryptSVC before shutting down either by an elevated command: net stop cryptsvc or in Services and no more VSS errors after booting. I have a basic (with highest elevation) Task Scheduler script with that command that stops the error:


Type : On Event (Basic)
Log : System
Source : User32
EventID : 1074

https://answers.microsoft.com/en-us...nt-id-13/cf3f6a83-85a7-4865-9aef-dd308487229e

I assume you not on 1909 now. Below might help more:


could try the fixes in this thread, it is for both the events - https://answers.microsoft.com/en-us...-13-8139/53ef992d-c4c5-4272-829c-4134de89e495

 

[WrongRookie]

VSS Event 13

https://answers.microsoft.com/en-us...nt-id-13/cf3f6a83-85a7-4865-9aef-dd308487229e

I assume you not on 1909 now. Below might help more:


could try the fixes in this thread, it is for both the events - https://answers.microsoft.com/en-us...-13-8139/53ef992d-c4c5-4272-829c-4134de89e495

I did all of it including creating the script exactly the way it is done..and even after that that error persists...

 

[Colif]

did you post about this on another forum? just asking as I found this when looking today - https://www.elevenforum.com/t/event-id-13-vss.25815/

Please look at these events, check the value of ProcessID field. Then run Task manager, right-click on Name word and turn on Process ID column. Then see what process causes this event.

https://answers.microsoft.com/en-us...9/53ef992d-c4c5-4272-829c-4134de89e495?page=2

let me know what it shows.
I found the event on my PC. It doesn't stop shutdown, but it also doesn't show a process ID so the above won't help here. Last time event occurred on my PC was on 25th May. If it makes you feel any better its the same

Crpytservice - Cryptography Service
not new tasks to try to fix. Might want to read this and see if any solutions
https://www.tenforums.com/general-support/133273-vss-errors-8193-13-a.html (41 page thread)

do you have any external drives attached to PC? they can cause the events it seems.
Do you use Macrium Reflect? I don't but it seems to be mentioned throughout that thread I linked.
No real answers, appears the 2 events started to show in 1909 of Win 10.

 

[WrongRookie]

did you post about this on another forum? just asking as I found this when looking today - https://www.elevenforum.com/t/event-id-13-vss.25815/


https://answers.microsoft.com/en-us...9/53ef992d-c4c5-4272-829c-4134de89e495?page=2

let me know what it shows.
I found the event on my PC. It doesn't stop shutdown, but it also doesn't show a process ID so the above won't help here. Last time event occurred on my PC was on 25th May. If it makes you feel any better its the same

Crpytservice - Cryptography Service
not new tasks to try to fix. Might want to read this and see if any solutions
https://www.tenforums.com/general-support/133273-vss-errors-8193-13-a.html (41 page thread)

do you have any external drives attached to PC? they can cause the events it seems.
Do you use Macrium Reflect? I don't but it seems to be mentioned throughout that thread I linked.
No real answers, appears the 2 events started to show in 1909 of Win 10.

I neither have used externals nor have Macrium.

I don't get it..most of the threads just say that its harmless but its delaying the shutdown process which I don't know whether you can say that's harmless or not.

Really weird that MS hasn't fixed it by now. I tried looking up. Let's see if anything works.

 

[Colif]

The last time I had it run was the 18th May.
Nothing shows as having run on that day in reliability history - so its not tied to windows update or store updates.
no errors in windows error reporting on that day - I don't know why I looked here... running out of places.

https://learn.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service

Curious when your last one was made.
Its not obvious how to look for that either

1. Search for "create restore point"
2. open control panel result
3. click on System restore... button
4. A wizard opens up
5. click next and it will show you date choices. You can click a button at bottom to show more.

Obviously don't pick one... as it will roll back system. We are just looking so click cancel

my creation dates don't coincide with my last run time. It makes one a week it seems.

curious what processes are involved as could trace one... if we knew what to trace.


have you tried a clean boot to see if it still has same problem at shutdown?

Try a clean boot and see if it changes anything - make sure to read instructions and make sure NOT to disable any microsoft services or windows won't load right - https://support.microsoft.com/en-au/help/929135/how-to-perform-a-clean-boot-in-windows

It doesn’t delete anything, it just stops non Microsoft programs running with start. Easy to reverse.

if clean boot fixes it, it shows its likely a startup program. You should, over a number of startups. restart the programs you stopped to isolate the one that is to blame.

 

[WrongRookie]

The last time I had it run was the 18th May.
Nothing shows as having run on that day in reliability history - so its not tied to windows update or store updates.
no errors in windows error reporting on that day - I don't know why I looked here... running out of places.

https://learn.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service

Curious when your last one was made.
Its not obvious how to look for that either

1. Search for "create restore point"
2. open control panel result
3. click on System restore... button
4. A wizard opens up
5. click next and it will show you date choices. You can click a button at bottom to show more.

Obviously don't pick one... as it will roll back system. We are just looking so click cancel

my creation dates don't coincide with my last run time. It makes one a week it seems.

curious what processes are involved as could trace one... if we knew what to trace.


have you tried a clean boot to see if it still has same problem at shutdown?

Try a clean boot and see if it changes anything - make sure to read instructions and make sure NOT to disable any microsoft services or windows won't load right - https://support.microsoft.com/en-au/help/929135/how-to-perform-a-clean-boot-in-windows

It doesn’t delete anything, it just stops non Microsoft programs running with start. Easy to reverse.

if clean boot fixes it, it shows its likely a startup program. You should, over a number of startups. restart the programs you stopped to isolate the one that is to blame.

Here are the dates that it created last.

https://imgur.com/o1ghwjs

View: https://imgur.com/o1ghwjs


I already did a clean boot once and the error still shows up but I will try it again.

Would be nice if TomsHardware staff actually looked at this error and made it a public thing so more people are aware of it and MS can just fix it.

 

[Colif]

its not a massive error that stops large proportion of the population being able to use windows... instead its an obscure problem or I would have found an answer by now

Staff don't look on forums very much. They don't just look after Tom's anymore. They only come here if we need their help.

I wonder if anything shows on the shutdown logs

Where and How to See the Shutdown and Startup Log in Windows 11 and 10? Quick Solution Here.

Do you want to know where and how to see the shutdown and startup log in Windows 10 and 11? The are several ways to view the log. This guide will give you the best and simple methods you can use. Keep reading!

www.auslogics.com

Have you asked on here?
https://www.elevenforum.com/
they might be able to tell you how to stop it. Must be a way to track what is going wrong. I don't know myself.
They are forum I would ask if I was stuck...

 

[WrongRookie]

Found the errors in the shutdown log

https://imgur.com/ENF3Z1m

View: https://imgur.com/ENF3Z1m


Yeah I'll ask the forums there.

 

[Colif]

41(63) is windows reacting to a restart. It doesn't know why it restarted.
Every startup it runs a report and if it finds previous shutdown was unexpected, it creates that event.
event 6008 is similar. It happens at same time as 41(63)... they travel as a pair. It starts the event logging system and probably creates the report that creates 41(63)

you had 3 restarts in space of 12 minutes... you don't remember 3 restarts in a row? At 1.30ish in afternoon... though it was a Sunday.

no BSOD reported.

Might be hardware then... if windows doesn't know why.

Not sure if shutdown log would show all events occurring at time... it might.

maybe run crystaldiskinfo (blue icon) and check drives health as if it can't write, maybe its the nvme...
could run Samsung Magician and check 2 of them

 

[WrongRookie]

41(63) is windows reacting to a restart. It doesn't know why it restarted.
Every startup it runs a report and if it finds previous shutdown was unexpected, it creates that event.
event 6008 is similar. It happens at same time as 41(63)... they travel as a pair. It starts the event logging system and probably creates the report that creates 41(63)

you had 3 restarts in space of 12 minutes... you don't remember 3 restarts in a row? At 1.30ish in afternoon... though it was a Sunday.

no BSOD reported.

Might be hardware then... if windows doesn't know why.

Not sure if shutdown log would show all events occurring at time... it might.

maybe run crystaldiskinfo (blue icon) and check drives health as if it can't write, maybe its the nvme...
could run Samsung Magician and check 2 of them

I did three restarts. All of them were to do a clean boot troubleshooting.

crystaldisk shows all the drives running fine with no errors either.

https://imgur.com/PzGtj7C

View: https://imgur.com/PzGtj7C

https://imgur.com/nGdETN1

View: https://imgur.com/nGdETN1

https://imgur.com/eWVanw4

View: https://imgur.com/eWVanw4

https://imgur.com/KZ1OAqO

View: https://imgur.com/KZ1OAqO

 

[WrongRookie]

I decided to reset everything and i reinstalled windows again.

Can it wait for a few days before the topic can close? Not sure when the error will pop up again.

 

[Colif]

just leave it open until you sure its not happening...

 

[WrongRookie]

just leave it open until you sure its not happening...

I apologize for dragging it this long. I get that its harmless but its an annoying bug especially since there is no possible symptom that I can find other than it being system restore(and the issue persists even if its turned off).

Its very annoying that MS has not done anything to fix this. That said, so far the issue hasn't appeared.

 

[Colif]

its your problem, you can keep thread open as long as its helpful to you

 

[WrongRookie]

Even after reinstalling it, the error still persists....guess I'll try those forums.

Edit: eleven7 doesn't accept new registrations. Are there any other alternatives?

 

[Colif]

Edit: eleven7 doesn't accept new registrations. Are there any other alternatives?

that is a new one... um

Super User

Q&A for computer enthusiasts and power users

superuser.com

are we sure that is the cause. Its really strange it occurs after a reinstall. Its why I checked the drives out... see what the above say.. not sure if they do long threads, most times the answers are on 1st page.

any USB drives attached?

could ask on here as well: https://www.sysnative.com/forums/

 

[WrongRookie]

that is a new one... um

Super User

Q&A for computer enthusiasts and power users

superuser.com

are we sure that is the cause. Its really strange it occurs after a reinstall. Its why I checked the drives out... see what the above say.. not sure if they do long threads, most times the answers are on 1st page.

any USB drives attached?

could ask on here as well: https://www.sysnative.com/forums/

There are no usb drives attached. I asked on reddit and they told me to check this.

https://kb.eventtracker.com/evtpass/evtpages/EventId_13_VSS_65030.asp

Make sure that third-party installed VSS providers are operating properly

To make sure that third-party installed VSS providers are operating properly:
Open an elevated Command Prompt. Click Start , click All Programs , click Accessories , right-click Command Prompt , and then click Run as administrator .
Type vssadmin list providers at the command prompt.
For each provider in the list, use the vssadmin create shadow command to create a shadow copy of the volume for which the provider is responsible.

But in the cmd, it only shows Microsoft software shadow copy provider.

Just curious but when I did list and typed list shadows, it managed to have a shadow of one volume with the old desktop name and the other as the new one.

Is it a good idea to delete the old volume shadow now that I reinstalled windows?

Will check out from the other site.

I don't think its the issue with the drives since the event viewer clearly just says volume shadow is the main error. And the drives have worked fine with no errors. Not saying it isn't the one but I highly doubt that is the main issue.

The only other issue that is not an error but a warning is this one.

A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

That's probably for the local account though.

 

[Colif]

Is it a good idea to delete the old volume shadow now that I reinstalled windows?

i think so, the current install isn't linked to it. Or shouldn't be.

A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

You need to install the Intel Consumer Me driver that I suspected in my original post for that error to go away.

link
Intel management Engine Interface driver.
See under Other Drivers
https://www.msi.com/Motherboard/MAG-B660-TOMAHAWK-WIFI-DDR4/support#driver

it is for local account.

 

[WrongRookie]

I want to make an update on this. So I guess now it no longer appears as it used to probably with the windows update.

So I guess it's good?

 

[Colif]

Some windows problems tend to fix themselves.

for a few months I would get explorer stopping shutdown, then it just stopped happening.

I had a problem with my Office account for a few months, then it just stopped when Microsoft fixed something.

its the same as internet connection problems, sometimes the cause is out of your control and you just have to wait for someone else to fix it.