Hi, I've got a small portable hard drive that I use to store my photos connected to my PC and up until recently all has been fine. Now for some strange reason the PC no longer sees it. I've tried plugging it into other PC's and it is fine but plug it into my PC and all I get is the bingly bong connection noise repeated every few seconds. I've tried it in different usb ports and the result is the same. Any ideas? Thanks.
PC not seeing hard drive
- Thread starter jerica
- Start date
- Oct 11, 2014
- 39,502
- 4,425
- 146,290
First of all it is good that other PC's can see the files and hopefully open them.
However, it is highly recommended that you copy your photos on the portable hard drive to another file location, verify their accessibility, and that the photo's are indeed viewable. Just in case...
That said, the problem is most likely with the PC.
No error messages or pop-up windows when the portable drive is connected?
Are you aware of any new application installations or updates of any nature?
Do other USB devices work on the PC? Or do you get the "bingly bong noise" again?
Windows 10? Try the built-in troubleshooters:
"WIN" + "I" > Update & security > Troubleshoot
Likewise open Device Manager and go to "Universal Serial Bus Controllers". Look for any problems there by checking the listed devices and their properties as applicable.
However, it is highly recommended that you copy your photos on the portable hard drive to another file location, verify their accessibility, and that the photo's are indeed viewable. Just in case...
That said, the problem is most likely with the PC.
No error messages or pop-up windows when the portable drive is connected?
Are you aware of any new application installations or updates of any nature?
Do other USB devices work on the PC? Or do you get the "bingly bong noise" again?
Windows 10? Try the built-in troubleshooters:
"WIN" + "I" > Update & security > Troubleshoot
Likewise open Device Manager and go to "Universal Serial Bus Controllers". Look for any problems there by checking the listed devices and their properties as applicable.
Hi Ralston, plugged the hd into another pc and transferred some pics and all is fine. Other USB devices work ok except for one other portable hard drive which is doing the same thing but without the bingly bong noise. All trouble shooters said everything is OK and all drivers are up to date. Opened device manager and couldn't see any problems, then pugged in the HD, very odd, the list of devices vanished for a couple of seconds as soon as the bingly bong noise happened, then came back but disappeared again as soon as the noise sounded and continued to appear and disappear every time the noise happened.
seagate_surfer
Admirable
- Mar 31, 2017
- 1,787
- 20
- 6,565
- Oct 11, 2014
- 39,502
- 4,425
- 146,290
Been thinking about the "bingly-bong" sound.
If that is the sound that you normal hear when successfully connecting or disconnecting USB devices then I would suspect a connection problem.
Intermittent: sometimes connects, sometimes does not, or may just flip back and forth while connected.
Also try gently wiggling and twisting/jiggling the cables, ports, and plugs involved. If you discover that your actions can cause the sound and lose or gain device connectivity then the problem is with the connectivity.
Just methodically continue swapping devices, cables, and ports around. Do the wiggling and twisting with each setup. Hopefully the specific cause for the lost connectivity will become apparent.
If that is the sound that you normal hear when successfully connecting or disconnecting USB devices then I would suspect a connection problem.
Intermittent: sometimes connects, sometimes does not, or may just flip back and forth while connected.
Also try gently wiggling and twisting/jiggling the cables, ports, and plugs involved. If you discover that your actions can cause the sound and lose or gain device connectivity then the problem is with the connectivity.
Just methodically continue swapping devices, cables, and ports around. Do the wiggling and twisting with each setup. Hopefully the specific cause for the lost connectivity will become apparent.
Tried it in different USB ports on the PC, same result continual bingly beep noise, tried jiggling it, no effect, tried it on another PC connects first time downloads and transfers perfectly. If it was the cable it wouldn't connect to the other PC and other USB devices work on the ports on my PC so what the Hell is the problem, driving me nuts. PS it's a toshiba
- Oct 11, 2014
- 39,502
- 4,425
- 146,290
You have eliminated the cable as the source of the problem.
And if the portable drive is connecting and working on other computers then the portable drive is okay.
That leaves your PC as the culprit.
Did you try running the Windows 10 troubleshooters?
And, although somewhat more involved, you can reinstall the USB controller drivers via Device Manager.
Sort of narrowing down to either a software/driver problem or perhaps a hardware/motherboard problem.
Another tool that you can use is Event Viewer. That is more involved but the Event Viewer logs may be capturing some error code or warning that takes place just before or at the time of the connection failure(s) and the "bingly-bong".
Here is a link from within this forum to introduce you to Event Viewer:
http://www.tomshardware.com/faq/id-3128616/windows-event-viewer.html
Suggest that you take a look at the link, and then the logs to see what the logs may be capturing.
Just explore the logs at first and get a sense of the organization and the data the logs contain. Do be aware that some logs will say they are empty but what is really happening is that data is being gathered up for presentation.
And also be aware that right-clicking any given log entry will provide additional information.
No need to immediately react or do anything beyond the logs at this time.
The goal is to find the problem. Doing so can and does take time and effort.
And if the portable drive is connecting and working on other computers then the portable drive is okay.
That leaves your PC as the culprit.
Did you try running the Windows 10 troubleshooters?
And, although somewhat more involved, you can reinstall the USB controller drivers via Device Manager.
Sort of narrowing down to either a software/driver problem or perhaps a hardware/motherboard problem.
Another tool that you can use is Event Viewer. That is more involved but the Event Viewer logs may be capturing some error code or warning that takes place just before or at the time of the connection failure(s) and the "bingly-bong".
Here is a link from within this forum to introduce you to Event Viewer:
http://www.tomshardware.com/faq/id-3128616/windows-event-viewer.html
Suggest that you take a look at the link, and then the logs to see what the logs may be capturing.
Just explore the logs at first and get a sense of the organization and the data the logs contain. Do be aware that some logs will say they are empty but what is really happening is that data is being gathered up for presentation.
And also be aware that right-clicking any given log entry will provide additional information.
No need to immediately react or do anything beyond the logs at this time.
The goal is to find the problem. Doing so can and does take time and effort.
OK, managed to open event viewer and had a look round, had 120 errors in the last week, interesting. Then it told me that it had failed to install the latest windows update at a date and time that hasn't actually arrived yet, wierd. I've got various error codes, 60, 610, 360, 5, 8303, 134, 63, 6005, 6006, 11 and on and on. Where do we go from here? J.
- Oct 11, 2014
- 39,502
- 4,425
- 146,290
What was that date and time? How far into the future?
And identifying specific update(s) that failed may prove useful.
No information/idea per se (full disclosure) as to what the incorrect date and time may mean.
Someone may recognize a known problem of some other sort associated with that particular time and date.
However, not at all uncommon for all sorts of strange errors when system dates and times get out of sync or are otherwise corrupted.
Verify your time zone, that a.m. and p.m. are not reversed etc..
Is your system's current date and time correct? What time source is being used - maybe the time is provided by some application on your system?
As to where to go next - couple of suggestions:
First, clear the Event Viewer logs.
Second, make a couple of attempts to read the portable drive.
Third, check the error codes again looking for any code numbers that closely correspond to the time of your attempts. Those will be the error codes to address first.
Very much down to just methodically troubleshooting. Identifying the source of the problem remains the focus.
The good news is that you are learning and all the more likely to note something amiss. Please feel free to post or ask questions.
Again someone else may spot something astray.
And identifying specific update(s) that failed may prove useful.
No information/idea per se (full disclosure) as to what the incorrect date and time may mean.
Someone may recognize a known problem of some other sort associated with that particular time and date.
However, not at all uncommon for all sorts of strange errors when system dates and times get out of sync or are otherwise corrupted.
Verify your time zone, that a.m. and p.m. are not reversed etc..
Is your system's current date and time correct? What time source is being used - maybe the time is provided by some application on your system?
As to where to go next - couple of suggestions:
First, clear the Event Viewer logs.
Second, make a couple of attempts to read the portable drive.
Third, check the error codes again looking for any code numbers that closely correspond to the time of your attempts. Those will be the error codes to address first.
Very much down to just methodically troubleshooting. Identifying the source of the problem remains the focus.
The good news is that you are learning and all the more likely to note something amiss. Please feel free to post or ask questions.
Again someone else may spot something astray.
- Oct 11, 2014
- 39,502
- 4,425
- 146,290
Hope this works, when I plugged the drive in this time it showed up in devices for a couple of seconds then disappeared, I managed to take a screen shot and also took one of the event viewer security settings, don't know if this is any use, J.
https://imgur.com/zoFRBj3 https://imgur.com/7I8Yj2Q
https://imgur.com/zoFRBj3 https://imgur.com/7I8Yj2Q
- Oct 11, 2014
- 39,502
- 4,425
- 146,290
I googled "4672" etc.
Found many links including a few within this Forum.
Here is a somewhat lengthy explanation of what is involved:
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672
Then I came across the following link that made it all the more interesting/complicated:
https://www.cyberark.com/threat-research-blog/detecting-pass-the-hash-with-windows-event-viewer/
See Figure 1.
Check your system to see who or what may be logging on...
I am not one to necessarily think "virus" as the possible reason for any given problem. But I am not one to exclude possibilities either...
Run some AV/malware scans on your system and the portable hard drive.
Also check your Event Viewer logs for some of the other error codes related to "4672".
E.g. 4624.
Trying to narrow things down seems to be going the opposite direction.
Anything at all may prove useful and helpful so feel free to post and ask.
Again someone else may recognize the problem and offer a matching solution. Fine with me.
Found many links including a few within this Forum.
Here is a somewhat lengthy explanation of what is involved:
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672
Then I came across the following link that made it all the more interesting/complicated:
https://www.cyberark.com/threat-research-blog/detecting-pass-the-hash-with-windows-event-viewer/
See Figure 1.
Check your system to see who or what may be logging on...
I am not one to necessarily think "virus" as the possible reason for any given problem. But I am not one to exclude possibilities either...
Run some AV/malware scans on your system and the portable hard drive.
Also check your Event Viewer logs for some of the other error codes related to "4672".
E.g. 4624.
Trying to narrow things down seems to be going the opposite direction.
Anything at all may prove useful and helpful so feel free to post and ask.
Again someone else may recognize the problem and offer a matching solution. Fine with me.
I have no idea what all this means but I copied from the Events viewer, J.
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 15-Apr-18 1:09:04 PM
Event ID: 4624
Task Category: Logon
Level: Information
Keywords: Audit Success
User: N/A
Computer: Jerry-PC
Description:
An account was successfully logged on.
Subject:
Security ID: SYSTEM
Account Name: JERRY-PC$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Logon Information:
Logon Type: 5
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x38c
Process Name: C:\Windows\System32\services.exe
Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The impersonation level field indicates the extent to which a process in the logon session can impersonate.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4624</EventID>
<Version>2</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2018-04-15T12:09:04.877281100Z" />
<EventRecordID>23045</EventRecordID>
<Correlation ActivityID="{16E81579-D41B-0001-0216-E8161BD4D301}" />
<Execution ProcessID="916" ThreadID="76" />
<Channel>Security</Channel>
<Computer>Jerry-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">JERRY-PC$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TargetUserSid">S-1-5-18</Data>
<Data Name="TargetUserName">SYSTEM</Data>
<Data Name="TargetDomainName">NT AUTHORITY</Data>
<Data Name="TargetLogonId">0x3e7</Data>
<Data Name="LogonType">5</Data>
<Data Name="LogonProcessName">Advapi </Data>
<Data Name="AuthenticationPackageName">Negotiate</Data>
<Data Name="WorkstationName">-</Data>
<Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x38c</Data>
<Data Name="ProcessName">C:\Windows\System32\services.exe</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
<Data Name="ImpersonationLevel">%%1833</Data>
<Data Name="RestrictedAdminMode">-</Data>
<Data Name="TargetOutboundUserName">-</Data>
<Data Name="TargetOutboundDomainName">-</Data>
<Data Name="VirtualAccount">%%1843</Data>
<Data Name="TargetLinkedLogonId">0x0</Data>
<Data Name="ElevatedToken">%%1842</Data>
</EventData>
</Event>
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 15-Apr-18 1:09:04 PM
Event ID: 4624
Task Category: Logon
Level: Information
Keywords: Audit Success
User: N/A
Computer: Jerry-PC
Description:
An account was successfully logged on.
Subject:
Security ID: SYSTEM
Account Name: JERRY-PC$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Logon Information:
Logon Type: 5
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x38c
Process Name: C:\Windows\System32\services.exe
Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The impersonation level field indicates the extent to which a process in the logon session can impersonate.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4624</EventID>
<Version>2</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2018-04-15T12:09:04.877281100Z" />
<EventRecordID>23045</EventRecordID>
<Correlation ActivityID="{16E81579-D41B-0001-0216-E8161BD4D301}" />
<Execution ProcessID="916" ThreadID="76" />
<Channel>Security</Channel>
<Computer>Jerry-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">JERRY-PC$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TargetUserSid">S-1-5-18</Data>
<Data Name="TargetUserName">SYSTEM</Data>
<Data Name="TargetDomainName">NT AUTHORITY</Data>
<Data Name="TargetLogonId">0x3e7</Data>
<Data Name="LogonType">5</Data>
<Data Name="LogonProcessName">Advapi </Data>
<Data Name="AuthenticationPackageName">Negotiate</Data>
<Data Name="WorkstationName">-</Data>
<Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x38c</Data>
<Data Name="ProcessName">C:\Windows\System32\services.exe</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
<Data Name="ImpersonationLevel">%%1833</Data>
<Data Name="RestrictedAdminMode">-</Data>
<Data Name="TargetOutboundUserName">-</Data>
<Data Name="TargetOutboundDomainName">-</Data>
<Data Name="VirtualAccount">%%1843</Data>
<Data Name="TargetLinkedLogonId">0x0</Data>
<Data Name="ElevatedToken">%%1842</Data>
</EventData>
</Event>
Source: Microsoft-Windows-Security-Auditing
Date: 15-Apr-18 1:09:04 PM
Event ID: 4624
Task Category: Logon
Level: Information
Keywords: Audit Success
User: N/A
Computer: Jerry-PC
Description:
An account was successfully logged on.
Subject:
Security ID: SYSTEM
Account Name: JERRY-PC$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Logon Information:
Logon Type: 5
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x38c
Process Name: C:\Windows\System32\services.exe
Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The impersonation level field indicates the extent to which a process in the logon session can impersonate.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4624</EventID>
<Version>2</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2018-04-15T12:09:04.877281100Z" />
<EventRecordID>23045</EventRecordID>
<Correlation ActivityID="{16E81579-D41B-0001-0216-E8161BD4D301}" />
<Execution ProcessID="916" ThreadID="76" />
<Channel>Security</Channel>
<Computer>Jerry-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">JERRY-PC$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TargetUserSid">S-1-5-18</Data>
<Data Name="TargetUserName">SYSTEM</Data>
<Data Name="TargetDomainName">NT AUTHORITY</Data>
<Data Name="TargetLogonId">0x3e7</Data>
<Data Name="LogonType">5</Data>
<Data Name="LogonProcessName">Advapi </Data>
<Data Name="AuthenticationPackageName">Negotiate</Data>
<Data Name="WorkstationName">-</Data>
<Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x38c</Data>
<Data Name="ProcessName">C:\Windows\System32\services.exe</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
<Data Name="ImpersonationLevel">%%1833</Data>
<Data Name="RestrictedAdminMode">-</Data>
<Data Name="TargetOutboundUserName">-</Data>
<Data Name="TargetOutboundDomainName">-</Data>
<Data Name="VirtualAccount">%%1843</Data>
<Data Name="TargetLinkedLogonId">0x0</Data>
<Data Name="ElevatedToken">%%1842</Data>
</EventData>
</Event>
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 15-Apr-18 1:09:04 PM
Event ID: 4624
Task Category: Logon
Level: Information
Keywords: Audit Success
User: N/A
Computer: Jerry-PC
Description:
An account was successfully logged on.
Subject:
Security ID: SYSTEM
Account Name: JERRY-PC$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Logon Information:
Logon Type: 5
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x38c
Process Name: C:\Windows\System32\services.exe
Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The impersonation level field indicates the extent to which a process in the logon session can impersonate.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4624</EventID>
<Version>2</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2018-04-15T12:09:04.877281100Z" />
<EventRecordID>23045</EventRecordID>
<Correlation ActivityID="{16E81579-D41B-0001-0216-E8161BD4D301}" />
<Execution ProcessID="916" ThreadID="76" />
<Channel>Security</Channel>
<Computer>Jerry-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">JERRY-PC$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TargetUserSid">S-1-5-18</Data>
<Data Name="TargetUserName">SYSTEM</Data>
<Data Name="TargetDomainName">NT AUTHORITY</Data>
<Data Name="TargetLogonId">0x3e7</Data>
<Data Name="LogonType">5</Data>
<Data Name="LogonProcessName">Advapi </Data>
<Data Name="AuthenticationPackageName">Negotiate</Data>
<Data Name="WorkstationName">-</Data>
<Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x38c</Data>
<Data Name="ProcessName">C:\Windows\System32\services.exe</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
<Data Name="ImpersonationLevel">%%1833</Data>
<Data Name="RestrictedAdminMode">-</Data>
<Data Name="TargetOutboundUserName">-</Data>
<Data Name="TargetOutboundDomainName">-</Data>
<Data Name="VirtualAccount">%%1843</Data>
<Data Name="TargetLinkedLogonId">0x0</Data>
<Data Name="ElevatedToken">%%1842</Data>
</EventData>
</Event>
- Oct 11, 2014
- 39,502
- 4,425
- 146,290
Thanks.
Appears to be a "double paste" and not two differing log entries....
That said, nothing is jumping out per se. The log may be showing perfectly normal things.
Did some research and found the following link (recent) from within this Forum:
http://www.tomshardware.com/forum/id-3650613/system-hacker-street-logon-windows-logged.html
The link is important as my sense is that I have gone after the proverbial "red herring".
Do you hear the exact same "bingly bong" sound when you plug and unplug the portable hard drive into the other computers where the photos can be successfully accessed?
Will spare you more links but will ask if you can find any 4634 or 4647 Events.
To share: I am now looking into some possible glitch involving the disconnection of the portable hard drive from your computer: i.e., Jerry-PC.
Does anyone else use that computer (switched users) and/or may have just unplugged the portable hard drive...?
Appears to be a "double paste" and not two differing log entries....
That said, nothing is jumping out per se. The log may be showing perfectly normal things.
Did some research and found the following link (recent) from within this Forum:
http://www.tomshardware.com/forum/id-3650613/system-hacker-street-logon-windows-logged.html
The link is important as my sense is that I have gone after the proverbial "red herring".
Do you hear the exact same "bingly bong" sound when you plug and unplug the portable hard drive into the other computers where the photos can be successfully accessed?
Will spare you more links but will ask if you can find any 4634 or 4647 Events.
To share: I am now looking into some possible glitch involving the disconnection of the portable hard drive from your computer: i.e., Jerry-PC.
Does anyone else use that computer (switched users) and/or may have just unplugged the portable hard drive...?
Ok, so here we have logs for a 4634 and a 4647 event. While I'm here, I remembered that a couple of months ago I had a Win 10 update that for some reason "lost" the drive that had the Win 10 OS on it. I had to go into safe mode and look in settings and eventually found the drive which had been taken off the boot list, put it back on and all was ok. Then it did it again on the next update, so I corrected it again and it hasn't happened on the last couple of updates. I don't know if this might be linked to my current problem, J.
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 17-Apr-18 2:22:23 PM
Event ID: 4634
Task Category: Logoff
Level: Information
Keywords: Audit Success
User: N/A
Computer: Jerry-PC
Description:
An account was logged off.
Subject:
Security ID: Window Manager\DWM-2
Account Name: DWM-2
Account Domain: Window Manager
Logon ID: 0x7C18F7
Logon Type: 2
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4634</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12545</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2018-04-17T13:22:23.782931600Z" />
<EventRecordID>23147</EventRecordID>
<Correlation />
<Execution ProcessID="916" ThreadID="4792" />
<Channel>Security</Channel>
<Computer>Jerry-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserSid">S-1-5-90-0-2</Data>
<Data Name="TargetUserName">DWM-2</Data>
<Data Name="TargetDomainName">Window Manager</Data>
<Data Name="TargetLogonId">0x7c18f7</Data>
<Data Name="LogonType">2</Data>
</EventData>
</Event>
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 15-Apr-18 4:40:30 PM
Event ID: 4647
Task Category: Logoff
Level: Information
Keywords: Audit Success
User: N/A
Computer: Jerry-PC
Description:
User initiated logoff:
Subject:
Security ID: Jerry-PC\Jerry
Account Name: Jerry
Account Domain: Jerry-PC
Logon ID: 0x7F8178
This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4647</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12545</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2018-04-15T15:40:30.539136500Z" />
<EventRecordID>23140</EventRecordID>
<Correlation ActivityID="{16E81579-D41B-0001-0216-E8161BD4D301}" />
<Execution ProcessID="916" ThreadID="8460" />
<Channel>Security</Channel>
<Computer>Jerry-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserSid">S-1-5-21-2564219100-2659057691-3357761269-1001</Data>
<Data Name="TargetUserName">Jerry</Data>
<Data Name="TargetDomainName">Jerry-PC</Data>
<Data Name="TargetLogonId">0x7f8178</Data>
</EventData>
</Event>
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 17-Apr-18 2:22:23 PM
Event ID: 4634
Task Category: Logoff
Level: Information
Keywords: Audit Success
User: N/A
Computer: Jerry-PC
Description:
An account was logged off.
Subject:
Security ID: Window Manager\DWM-2
Account Name: DWM-2
Account Domain: Window Manager
Logon ID: 0x7C18F7
Logon Type: 2
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4634</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12545</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2018-04-17T13:22:23.782931600Z" />
<EventRecordID>23147</EventRecordID>
<Correlation />
<Execution ProcessID="916" ThreadID="4792" />
<Channel>Security</Channel>
<Computer>Jerry-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserSid">S-1-5-90-0-2</Data>
<Data Name="TargetUserName">DWM-2</Data>
<Data Name="TargetDomainName">Window Manager</Data>
<Data Name="TargetLogonId">0x7c18f7</Data>
<Data Name="LogonType">2</Data>
</EventData>
</Event>
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 15-Apr-18 4:40:30 PM
Event ID: 4647
Task Category: Logoff
Level: Information
Keywords: Audit Success
User: N/A
Computer: Jerry-PC
Description:
User initiated logoff:
Subject:
Security ID: Jerry-PC\Jerry
Account Name: Jerry
Account Domain: Jerry-PC
Logon ID: 0x7F8178
This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4647</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12545</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2018-04-15T15:40:30.539136500Z" />
<EventRecordID>23140</EventRecordID>
<Correlation ActivityID="{16E81579-D41B-0001-0216-E8161BD4D301}" />
<Execution ProcessID="916" ThreadID="8460" />
<Channel>Security</Channel>
<Computer>Jerry-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserSid">S-1-5-21-2564219100-2659057691-3357761269-1001</Data>
<Data Name="TargetUserName">Jerry</Data>
<Data Name="TargetDomainName">Jerry-PC</Data>
<Data Name="TargetLogonId">0x7f8178</Data>
</EventData>
</Event>
- Oct 11, 2014
- 39,502
- 4,425
- 146,290
Thanks.
Here is the link that I have been using with respect to the Event ID's your system is presenting.
So far I have not found any paths or correlations that match the logon/logoff events with the failure to see the portable hard drive.
Do you have the Canvio? Model and size? All power via the USB cable - correct?
Now wondering, for lack of a better expression, about the USB power to the portable hard drive. Could be the power is not up to (or no longer to) the requirements of the Portable Hard Drive.
The drive then appears and disappears from the system ("bingly-bing") and the various associated processes and services get logged in and out of the Event logs.
That is the track I am now on and will need to do some research and reading. Need to find some supportive details..
If at all possible try the Portable hard drive on Jerry-PC via a USB hub with its own power supply.
Here is the link that I have been using with respect to the Event ID's your system is presenting.
So far I have not found any paths or correlations that match the logon/logoff events with the failure to see the portable hard drive.
Do you have the Canvio? Model and size? All power via the USB cable - correct?
Now wondering, for lack of a better expression, about the USB power to the portable hard drive. Could be the power is not up to (or no longer to) the requirements of the Portable Hard Drive.
The drive then appears and disappears from the system ("bingly-bing") and the various associated processes and services get logged in and out of the Event logs.
That is the track I am now on and will need to do some research and reading. Need to find some supportive details..
If at all possible try the Portable hard drive on Jerry-PC via a USB hub with its own power supply.
Hi again, what is a Canvio? Just figured out that the bingly bong noise is the hard drive constantly trying to connect not as I first thought trying to connect then disconnecting. Just tried a couple of old game controllers in the same slot, one connected properly but the other connected then stopped responding, then wouldn't reconnect under the game controller tab but did reconnect to a different area where I could not access the properties tab. AS I've been typing this I've also been trying stuff, I swapped the drive for another USB connected peripheral, wireless headphones, and it was instantly recognised and connected, I moved the headphones to another slot and they still work. I think the problem lies with the media dashboard which was working well until a Win10 update so I'm assuming it;s too old to work with the latest edition of Win 10. I will invest in a more modern multi card reader with USB extentions and see what happens. J.
- Oct 11, 2014
- 39,502
- 4,425
- 146,290
Canvio is one of Toshiba's Portable Hard drive models.
You mentioned Toshiba in your response to the Seagate Representative....
I was just trying to narrow things down to determine if there is some problem common the Canvio model.
You mentioned Toshiba in your response to the Seagate Representative....
I was just trying to narrow things down to determine if there is some problem common the Canvio model.
- Oct 11, 2014
- 39,502
- 4,425
- 146,290
Sounds like a plan....
Not sure what else to suggest.
Just be methodical and take only one action at time. Keep notes so you can undo the last action if necessary.
Or discover some interim point or action should the portable hard drive start disappearing again and the OS starts singing about it.
Will share one late thought:
Right-click the small speaker icon usually found in the lower right screen corner.
From the drop down menu, select "Sounds" and then the Sounds tab within the Sound Window.
There will be a list of Program Events. Select one and then click the test button (with the green triangle).
Listen to the various sounds. May be helpful to match the "bingly bong" to a more specific event.
Likely to be duplicate sound but may help narrow things down just a little bit more.
Not sure what else to suggest.
Just be methodical and take only one action at time. Keep notes so you can undo the last action if necessary.
Or discover some interim point or action should the portable hard drive start disappearing again and the OS starts singing about it.
Will share one late thought:
Right-click the small speaker icon usually found in the lower right screen corner.
From the drop down menu, select "Sounds" and then the Sounds tab within the Sound Window.
There will be a list of Program Events. Select one and then click the test button (with the green triangle).
Listen to the various sounds. May be helpful to match the "bingly bong" to a more specific event.
Likely to be duplicate sound but may help narrow things down just a little bit more.
TRENDING THREADS
-
-
AMD Ryzen 9 9950X vs Intel Core Ultra 9 285K Faceoff — it isn't even close- Started by Admin
- Replies: 47
-
Discussion What's your favourite video game you've been playing?- Started by amdfangirl
- Replies: 4K
-
-
Question I have an old system in the basement that has really basic specs, but am planning to give it just a little uplift with an RTX 5060 ti 16gb- Started by Guy_who_thinks_hes_cool
- Replies: 8
-
Question A scared question but I have to ask ?
- Started by Guy_who_thinks_hes_cool
- Replies: 4
Facebook
Twitter
Instagram