Share via

50 errors in event logs on each boot (Esent ID 413 & 488)

Question

Sunday, August 2, 2015 8:43 AM | 4 votes

Hi,

I have 50errors in Event Logs after each boot. It is always the same:

Esent 413: SettingSyncHost (7892) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Erreur -1032.

Esent 488: SettingSyncHost (7892) An attempt to create the file "C:\Windows\system32\edbtmp.log " failed with system error 5 (0x00000005) : "Access denied". The create file operation will fail with error -1032 (0xfffffbf8).

IMAGE: http://i.imgur.com/SSzhyPj.png (I can't post links)

Any idea ? I'm on Windows 10 (clean install). No other problem.

All replies (59)

Tuesday, August 4, 2015 8:34 AM ✅Answered | 12 votes

Hi Alexandre_Br,

According to the error messages, it seems that the present acls of the drive have been corrupted.
We could try to check the "security" properties of the C drive and ensure the "system", "administrators" has the read and write permissions.

If the issue persists, we could try to take the following steps to reset the acls.

  1. Download the Subinacl tool here.
    SubInACL (SubInACL.exe)
    http://www.microsoft.com/en-us/download/confirmation.aspx?id=23510
  2. Save the following the script as a .bat file and run it as administrator. Please replace the tool path with the location you have saved the tool to.
    @echo off
    title Resetting ACLs...
    cd /d "%ProgramFiles%\Windows Resource Kits\Tools"
    echo.
    echo Resetting ACLs...
    echo (this may take several minutes to complete)
    echo.
    echo ==========================================================================
    echo.
    echo System Drive...
    subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
    echo.
    echo.
    echo Windows Directory...
    subinacl /subdirectories %windir%\.* /grant=administrators=f /grant=system=f
    echo.
    echo.
    echo ==========================================================================
    echo.
    echo FINISHED.
    echo.
    echo Press any key to exit . . .
    pause >NUL

Best regards

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].

Thursday, August 13, 2015 6:51 AM ✅Answered | 9 votes

Back to the original errors; I went looking for "C:\Users\xxxx\AppData\Local\Microsoft\Windows\SettingSync\metastore\  and it wasn't there (used view hidden protected files).  It was, however, at "c:\windows\logs\SettingSync\.  It appears that SettingSyncHost does not have permission to write there but it doesn't look there anyway. Why should it? It's doing logs after all.

I copied the \logs\SettingSync\ folder, which was empty, to "C:\Users\xxxx\AppData\Local\Microsoft\Windows\.  No other changes or permission fiddling.  After a restart and 5 hours of doing stuff, Esent 413/488 haven't come back.  

Sunday, August 2, 2015 10:10 AM

Is the OS drive encrypted?

Have you tried clearing the log files?

Since all the errors point to a permission or space issue I would look at the HD and the permissions on it

Wanikiya and Dyami--Team Zigzag

Sunday, August 2, 2015 10:18 AM

I use a basic installation of Windows 10. I don't think anything is encrypted.

How can I help you? Want more information?

I clear the event log with a Powershell command:

wevtutil el | Foreach-Object {wevtutil cl "$_"}

Sunday, August 2, 2015 8:55 PM

Exactly the same issue here. Clean Win10 Home install.

Sunday, August 2, 2015 9:32 PM | 1 vote

I'm having the same problem on my Surface Pro 3 after doing a Win 8.1 Pro to Windows 10 Pro upgrade -- looking for a solution ....

Sunday, August 2, 2015 11:12 PM

Same issue here on Windows 10 Pro, tried a complete clean install after noticing it... errors still occurring after the reformat. 

Tuesday, August 4, 2015 3:36 AM | 1 vote

Started getting same errors today. No clue. :(

Tuesday, August 4, 2015 10:49 PM | 1 vote

No luck - I get 'subinacl' is not recognized as an internal or external command, operable program or batch file.

Wednesday, August 5, 2015 11:06 AM

Same error here. Upgraded from 8.1 few days ago. since today i got this errors.

the scrip/batch file wont work. it shows the same errormessages like kcollier2010 wrote.

would be great if anybody has a solution for this. i cant find anything else about this error in the www..

Wednesday, August 5, 2015 7:09 PM | 4 votes

Hi, I got the same and gave the script a try. The script works. However, I changed the path of the tools into "C:\Program Files (x86)\Windows Resource Kits\Tools", where it installs. And run the script as Admnistrator.

Elapsed Time: 00 00:04:16

Done:   122101, Modified   122101, Failed        0, Syntax errors        0
Last Done  : C:\WINDOWS\*************************

==========================================================================

FINISHED.

Press any key to exit . . .

Thursday, August 6, 2015 5:23 PM

Need to install it first, run subinacl.msi, allow the install, then run the batch file as administrator.

Thursday, August 6, 2015 6:34 PM

After installing the cumulative update for x64 system on my Surface Pro 3 yesterday, and doing a cold restart due to drained battery today, I get these exact messages whenever I try to start the email app. It comes up, freezes, then gets killed, and for each such try it leaves those two events.

Why would the email app want to store its log-files in C:\Windows\System32? There are lots of better places for this.

I can create and delete files and folders in C:\Windows\System32 from en elevated command prompt, but surely the email app does not have to be run as administrator? It worked fine yesterday.

The SSD has 415 GB free.

This is on a Surface Pro 3, running W10x64 Pro (upgraded from W8.1). Without email, the Surface is pretty useless to me...

Thursday, August 6, 2015 6:52 PM | 1 vote

Nope this command line magic did not work for me. Running the script gave loads of errors (see below), and the email app still does the same thing, opens, freezes, then closes down, and leaves the two events referred to above.

Resetting ACLs...
(this may take several minutes to complete)

==========================================================================

System Drive...
LookupAccountName : C:\Program Files (x86)\Windows Resource Kits\Tools:administr
ators 1337 The security ID structure is invalid.

Current object C:\Program Files (x86)\Windows Resource Kits\Tools will not be pr
ocessed

Elapsed Time: 00 00:00:00
Done:        0, Modified        0, Failed        0, Syntax errors        1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume
nts - C:\Program Files (x86)\Windows Resource Kits\Tools

Windows Directory...
LookupAccountName : C:\WINDOWS\.*:administrators 1337 The security ID structure
 is invalid.

Current object C:\WINDOWS\.* will not be processed

Elapsed Time: 00 00:00:00
Done:        0, Modified        0, Failed        0, Syntax errors        1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume
nts - C:\WINDOWS\.*

==========================================================================

FINISHED.

Press any key to exit . . .

Friday, August 7, 2015 7:25 PM

I have the same problem. I don't know if it's related but I was trying to sync my mail app (which is really slow to sync -- when it syncs). I don't know if it related...

On the other hand, if the error specifies a file that is "access denied" like "C:\Windows\system32\edbtmp.log", just create an empty file on your desktop with the name of the problematic file ("edbtmp.log" in my example) then move this empty file in the problematic folder ("C:\Windows\System32" in my example). The security of this file will allow edition.

This empty file will overwrited and maybe the problem will be fixed.

I hope this will help.

Sebastien

Saturday, August 8, 2015 9:12 AM | 2 votes

Same problem here. Errors started after cumulative update. I also tried clean install, but errors started again.

Every my boot my event viewer comes 15-30 ESENT errors ID:s 488 and 413.

SettingSyncHost (3868) An attempt to create the file "C:\Windows\system32\edbtmp.log" failed with system error 5 (0x00000005): "Käyttö estetty. ".  The create file operation will fail with error -1032 (0xfffffbf8

.........................

SettingSyncHost (3868) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.

e: Now i installed subinacl script and runned @ admistrator and errors where gone!

Thank you! MaipoXu!

e2: Never mind, errors came back again. :(

Sunday, August 9, 2015 3:15 PM | 1 vote

Same problem here.

At any reboot.

Cound'nt be possible to be linked to a corrupt admin account ?

Even if no admin account was created ?

What about creating a brand new one ?

JP

Jean-Philippe going to W10

Sunday, August 9, 2015 4:06 PM

Just replying as a "me too".  I haven't seen any issues because of this error.

Monday, August 10, 2015 1:26 AM

Same problem, it didn't work for me too. Same errors as OppfinnarJocke.

Monday, August 10, 2015 7:09 PM

Same here.

rgds Sven

Monday, August 10, 2015 7:56 PM

Same here. With a clean install of W10 Pro.

Tuesday, August 11, 2015 3:09 AM

I've favorited this thread in hopes a solution is found. tried using the windows sdk programs to debug but, no success. On top of these errors I'm also having some service and device load error. Also using a clean install on a fresh SSD.

Anyone seeing freezing of Netflix or YouTube?

Tuesday, August 11, 2015 4:18 AM

I know this sounds strange - where do you live?

There's a bug in Win 10 that is evident when the time zone is non-integer, that is 9hr30mins, etc. It causes multiple errors in tasks on the scheduler.

Try changing your location to somewhere close by that has an even number of hours.

Cheers

Peter

PeterStapleton

Tuesday, August 11, 2015 2:29 PM

Me too. This only started less than 48hrs ago and looking at the logs, it appears there were two or three error messages before these ones relating to the same issue:

SettingSyncHost (7620) {AC35D6FF-5FD2-41B8-9DAC-DDD05CC2B118}: An attempt to open the file "C:\Users\xxxx\AppData\Local\Microsoft\Windows\SettingSync\metastore\edb.log" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ".  The open file operation will fail with error -1032 (0xfffffbf8).

So it looks like the edb.log is supposed to be here but it's failing, so it's trying to create a temporary version in C:\Windows\System32\edbtmp.log but that is failing too.

I've not noticed any issues though (so far).

Tuesday, August 11, 2015 2:29 PM

I know this sounds strange - where do you live?

There's a bug in Win 10 that is evident when the time zone is non-integer, that is 9hr30mins, etc. It causes multiple errors in tasks on the scheduler.

Try changing your location to somewhere close by that has an even number of hours.

Cheers

Peter

PeterStapleton

I'm from the east coast of the united states so I wont experience this bug. -5:00 and still having many error events showing up during initial start-up.

Wednesday, August 12, 2015 12:50 AM

same here... surface pro 3. Upgrade windows 8 to 10...

Wednesday, August 12, 2015 8:01 PM | 1 vote

I get the above problem but have progressed a little.

SubInAcl.msi needs to be installed

subinacl.exe is in %ProgramFiles(x86)%... need this line in the batch file ...

cd /d "%ProgramFiles(x86)%\Windows Resource Kits\Tools"

I ran the batch file ... it completed successfully with ~6M or ~0.6M changes but had zero effect.

I navigated to C:\Users\xxxx\AppData\Local\Microsoft\Windows\SettingSync\metastore ... there is a edb.log file ... there were also loads of other historical ones ... I renamed this file to the next log file sequence number (using hex).

Now I no longer get the event log errors about the edb.log file.

But I still cannot send emails in Outlook 2013 ... not good !

Note that I can test the email account settings perfectly ... and I get those emails when I send/receive ... but ones I've written are not sent.

Need a fix asap please Microsoft

Thursday, August 13, 2015 10:13 AM

DWW1505's solution of copying the SettingSync folder from C:\Windows\ to you AppData folder worked for me.

Thursday, August 13, 2015 10:28 AM

I will occasionally get those errors showing up - but it only happens after some other event here - with me its usually shutdown improperly.   I will go to settings for accounts  / sync and turn off sync and restart the computer  & then everything re-syncs nicely it seems when I finally remember to re-enable it.

Monday, August 17, 2015 9:47 PM

I am getting many of them on a NEW pc which came with Windows 10 already installed.  Doesn't sound good for Windows 10!  Really gripes me.

Friday, August 21, 2015 7:21 PM

Yes! This worked for me to, thanks a lot!

Just to be a bit clearer... in C:\Users\xxx\AppData\Local\Microsoft\Windows, I created a folder "logs", and inside that folder I then created a folder "SettingSync".

Now the email app works both for reading and sending emails, and it seems way snappier than before. Joy :-)

And thanks again DWW1505

Saturday, August 22, 2015 9:57 AM

Hi,

After upgrading from W8.1 to W10, found twice the same task in process scheduler, one named idle maintenance the other routine maintenance. I disabled one of those, now everything is correct.

BR,

- gg

Saturday, August 22, 2015 7:07 PM

I tried creating the two folders.   It unfortunately didnt stop the errors.  Mine aren't mail related.  The task category is logging/recovery and general.

Tuesday, August 25, 2015 4:48 PM

I had the same problem but with a different logfile (noted below). So from an Administrator account I...

  1. Copied a "good" empty (0K) file from a /windows/log/???/ directory to the desktop (plenty to choose from)
  2. Renamed it to the expected filename
  3. Moved the newly renamed logfile to the directory where the system was looking for it
  4. Clicked "yes" to administrator permissions
  5. Rebooted
  6. All the errors have disappeared since the reboot.

The missing file in this case was: "C:\WINDOWS\system32\edbtmp.log"

There is obviously an error in the coding that places the logfile in this unusual place. This fix is simply a work-around until MS fixes the software to look for the logfile in a more appropriate place such as /windows/logs/...

Hope this helps someone else...

Thursday, August 27, 2015 11:37 PM

You will get more errors though after creating that file, like not having permission to move it.  And even if did get moved, failure to create it yet again.

Definitely a new os bug.

Sunday, August 30, 2015 4:11 AM

I found the solution, at least for myself, by turning off windows sync setting.

1. open setting.

2 click account.

3. select sync your setting and turn off sync setting.

After i restart my PC, event id 413, 454, 488, 490 disappear.

Monday, September 7, 2015 7:39 AM

Hi Alexandre_Br,

According to the error messages, it seems that the present acls of the drive have been corrupted.
We could try to check the "security" properties of the C drive and ensure the "system", "administrators" has the read and write permissions.

If the issue persists, we could try to take the following steps to reset the acls.

  1. Download the Subinacl tool here.
    SubInACL (SubInACL.exe)
    http://www.microsoft.com/en-us/download/confirmation.aspx?id=23510
  2. Save the following the script as a .bat file and run it as administrator. Please replace the tool path with the location you have saved the tool to.
    @echo off
    title Resetting ACLs...
    cd /d "%ProgramFiles%\Windows Resource Kits\Tools"
    echo.
    echo Resetting ACLs...
    echo (this may take several minutes to complete)
    echo.
    echo ==========================================================================
    echo.
    echo System Drive...
    subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
    echo.
    echo.
    echo Windows Directory...
    subinacl /subdirectories %windir%\.* /grant=administrators=f /grant=system=f
    echo.
    echo.
    echo ==========================================================================
    echo.
    echo FINISHED.
    echo.
    echo Press any key to exit . . .
    pause >NUL

Best regards

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].

Does not help...

rgds Sven

Monday, September 7, 2015 10:22 AM

I found the solution, at least for myself, by turning off windows sync setting.

1. open setting.

2 click account.

3. select sync your setting and turn off sync setting.

After i restart my PC, event id 413, 454, 488, 490 disappear.

You tried to perform: manual maintenance system?

Windows 8.1 Pro 32-Bit Media Center ASUS P5G41T-M LE Ram 4GB

Saturday, September 19, 2015 7:22 PM

I've been getting these also for weeks around the same time I noticed my weather, calendar, and mail live tiles stopped working. I noticed the SettingSync folder was missing even when exposing hidden files/folders or using attrib so I tried the above. The folder didn't appear. When I tried creating it manually it asked me to merge it with the existing folder of the same name. Still doesn't appear and the errors continue. Used subacl to reset permissions to no effect. Any suggestions?

Thursday, September 24, 2015 2:07 PM

The .bat file errors out becuase its pointing to the wrong directory! You should probably know that though.

Wednesday, September 30, 2015 7:44 PM

I got the same error.

guess i'll just add to all the other bugs

hopefully Microsoft will fix all these bug I getting tired of trying to fix a fix.

wish Microsoft would put out a list of bug that there working on, it would save me lots of time

Rob 

Robfly

Saturday, October 3, 2015 6:10 PM | 2 votes

None of the provided solutions so far worked for me until I found this on another forum:

go to:

C:\user\USERNAME%\Local\Microsoft\Windows\SettingSync

Right click folder properties, it will have the read only button checked. Uncheck that and click apply. have it change it to all subfolders.

Then in the properties window click on the Security tab. then click edit user permissions. a new window will pop up click add. in the next windows type "all application packages". Grant full permissions to "all application packages"

48 hours later, no ESENT errors still.

Saturday, October 3, 2015 9:35 PM | 1 vote

It seems that the application package assumes that the "%LOCALAPPDATA%\Local\Microsoft\Windows\SettingSync" folder exists and then atempts to CHDIR into that directory, but does not check if it returns an error.  So its the current working dir is still "%SYSTEMROOT%\System32". However the application package is not permitted to create the log file there.

But as this is visibly a temporary log file, I even wonder why it wants to place that file in a subfolder of the resident "%LOCALAPPDATA%\Local\Microsoft" instead of just within the user's "%TEMP%\Microsoft"

If that storage folder also does not exist, it should create it (and if it cannot, it should log the event for that missing folder or unwritable folder..

ESENT is bogous (in Windows 8/8.1 and 10...). Note that many metro apps are crashing at start, if they can't write some folder for syncing with tiles in the Start Menu, even if the tile is visible.

Windows Metro apps are making too many assumptions without actually checking them... This needs serious debugging and correction from Windows Updates or Apps Updates.

Saturday, October 3, 2015 9:58 PM | 1 vote

Note that you don't need the old tool "Subinacl" to do that. Windows 8/8.1/10 has the tool "ICACLS" builtin and preinstalled, though the syntax is a bit different

So:

subinacl /subdirectories %SystemDrive% /grant=Administrators=f /grant=System=f

Becomes:

ICACLS %SystemDrive% /grant Administrators**:f** /grant System**:f** /T

where

  • folder/file name comes first before options
  • "/subdirectories" becomes "/T"
  • "/grant=<user>=<acl>" becomes "/grant <user>:<acl>" (the 1st equal sign becomes a space, the 2nd equal sign becomes a colon)

In some cases, this won't work even from an administrator shell, if the folders or files are owned by System or by TrustedInstaller. You'll then first need to take ownership of the files/folders, giving them to Administrators using TAKEOWN.

Note also that "Administrators" is localized if you've not installed the English version of Windows (for example "Administrateurs" for the French installation) EVEN if the current user's MUI is set to US English in the Regional/Language control panel and even if you've copied this locale preference to the Login and System profile and even if you've used the Group Policy editor to rename the Adminsitrators account. The language taken is the one used at installation time to create the initial "Administrators" group (Group Policy Editor only allows you to rename the "Administator" account with the English singular, not the group with the English plural !) So adapt the scripts according to the system's default language and not according to your current MUI (or LUI).

Monday, October 5, 2015 1:35 AM

zrbite - still ESENT error free? would you mind sharing the url where you found this work-around? I really hope this gets around the user/profile issue. Like another poster said, had a hard time finding other info on the interweb about this issue and have been tinkering with this tablet for weeks.

System logs on this tablet (Dell Venue11vPro) appear to show some failures to migrate the user profile prior to the upgrade event, although no errors or issues were experienced during the upgrade. I made sure Dell had tested and supported upgrading before using the free upgrade tool - but it looks like the profile migration errors started in July - even if I didn't go through with the update, these errors were there thanks to Windows forcing these system changes whether users wanted them or not.

After reading this thread and some other research - don't think I'll roll back now. Doesn't seem to fix the issue for others. Dell has offered to put in a new motherboard with 8.1 and I think I'll take that route.

And lesson learned - never EVER jump on upgrades early - especially when they're offered free!

Thursday, October 8, 2015 3:31 PM

go to:

C:\user\USERNAME%\Local\Microsoft\Windows\SettingSync

I suddenly started receiving ESENT/event id 488 and such errors as of today, and found my way to this page (there's nothing else anywhere to help with this), and I don't seem to have that folder at all. In Windows 10, I have:

C:\Users\Username>\AppData\Local\Microsoft\Windows ... and absolutely nothing about SettingSync anywhere within.

There is, however, a completely empty C:\Windows\Logs\SettingSync folder.

I don't like random unfixable errors cropping up out of nowhere, with no available help anywhere on the internet. And yet this issue seems to have existed for months already now. Please fix it, Microsoft.

My first encounter with this error actually had my entire start menu lock up and become unresponsive, probably due to app syncing issues. I had to ctrl-alt-delete Task Manager to reach a way to properly Restart the PC.

Thursday, October 8, 2015 10:05 PM | 1 vote

Hi,

The script works and shows to you the main issue : 

LookupAccountName : C:\Program Files (x86)\Windows Resource Kits\Tools:administr
ators 1337 The security ID structure is invalid.

It means that "administrators" is not the right group. I guess that you have an non-english OS so try "administrators" in your own language.

For sample, in French, it should be "administrateurs" not "administrators".

Sunday, October 11, 2015 2:42 AM

Seems a long time ago I used to get the 413's

Current win10pro 10547 build    fwiw;

Thursday, October 15, 2015 6:26 PM

I understand that this is NOT the solution, but I followed your suggestion and after 3 days I can confirm that no more ESENT errors occurred. I'll stay tuned to this thread waiting for the solution. thanks

Friday, October 16, 2015 7:41 PM

Got the same issue here.  My system was upgraded from Win 8.1, and no other changes made. 

Friday, November 6, 2015 1:41 AM

MeipoXu's batch file appears to have worked for me.  I rebooted and checked Event Viewer and had no 488 or 413 errors.  Here's what I did.

Start with the post by MeipoXu.  Download the file he linked, named SubInACL.exe, at:
http://www.microsoft.com/en-us/download/confirmation.aspx?id=23510

When download finishes, run the file.  It will install "C:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe".

Now make a copy of the script MeipoXu put in his text.  Then edit it so that instead of "%ProgramFiles%" you have "%PROGRAMFILES(x86)%" in the referenced filepath.

Save and run the edited batch file as administrator.  Mine ran for a couple of minutes and finished by reporting lots of changes, zero errors.  I then rebooted.  If the errors were occuring on reboot, then it must be fixed, because there weren't any, although there were three "Information" entries by ESENT.

Monday, November 9, 2015 5:11 PM

Hi,

I see the script and solution, I tried to do the same but get this errors:

C:\Users\Torbjörn>es.bat

Resetting ACLs...
(this may take several minutes to complete)

==========================================================================

System Drive...
SeSecurityPrivilege : Åtkomst nekad.

WARNING :Unable to set SeSecurityPrivilege privilege. This privilege may be required.
LookupAccountName : C:\Program Files (x86)\Windows Resource Kits\Tools:administrators 1337 Detta säkerhets-ID har felaktig struktur.

Current object C:\Program Files (x86)\Windows Resource Kits\Tools will not be processed

Elapsed Time: 00 00:00:00
Done:        0, Modified        0, Failed        0, Syntax errors        1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking arguments - C:\Program Files (x86)\Windows Resource Kits\Tools

Windows Directory...
SeSecurityPrivilege : Åtkomst nekad.

WARNING :Unable to set SeSecurityPrivilege privilege. This privilege may be required.
LookupAccountName : C:\WINDOWS\.*:administrators 1337 Detta säkerhets-ID har felaktig struktur.

Current object C:\WINDOWS\.* will not be processed

Elapsed Time: 00 00:00:00
Done:        0, Modified        0, Failed        0, Syntax errors        1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking arguments - C:\WINDOWS\.*

==========================================================================

FINISHED.

Press any key to exit . . .

C:\Program Files (x86)\Windows Resource Kits\Tools>

Monday, November 9, 2015 6:09 PM

Hello,
despite having followed this guide does not solve the problem ...
Esent ID: 490, 455, 454, 488, 413.
Any other suggestions?
Hello

Windows 8.1 Pro 32-Bit Media Center ASUS P5G41T-M LE Ram 4GB

Monday, November 9, 2015 10:25 PM

Seems a long time ago I used to get the 413's

@ Mike

Any correlation with when you implemented your workaround for the other Event error symptom?   <eg>

http://answers.microsoft.com/en-us/windows/forum/windows8_1-performance/multiple-errors-in-event-viewer-eventid-131-from/e5054c3b-bc91-4beb-894f-4d0d9f0dd8ca?page=11

Robert Aldwinckle

Wednesday, November 25, 2015 5:29 AM

For the less tech savy people, I'm posting my edited code and step-by-step directions to make your lives easier!  

1)

Download the SubInAcl file and save to the desktop.  Open and find the "Tools" folder, copy and paste it directly on the C:/ so the path looks like "C:/Tools".  [This is assuming you have windows installed on the C drive like 99% of computers.  If not, save the SubInAcl on your windows drive and change the "C:/Tools" to the correct letter in the text below.]

2)

Copy the code below.  right click on your desktop, new, text document.  paste the code.  click "save as," name it "tool.bat" and change the file type to "all files," click save.

3)

select the .bat file, hold down "ctrl" and "shift" and hit enter to open directly as admin and watch it fix your computer!

hope it helps!

Copy everything under this line:

@echo off
 title Resetting ACLs...
 cd C:\Tools
 echo.
 echo Resetting ACLs...
 echo (this may take several minutes to complete)
 echo.
 echo ==========================================================================
 echo.
 echo System Drive...
 subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
 echo.
 echo.
 echo Windows Directory...
 subinacl /subdirectories %windir%\.* /grant=administrators=f /grant=system=f
 echo.
 echo.
 echo ==========================================================================
 echo.
 echo FINISHED.
 echo.
 echo Press any key to exit . . .
 pause >NUL

Sunday, November 29, 2015 8:07 AM

I have  *not* tried it out yet, but this solution, is it still working??

Assume path should read:

C:\Users\UserName\AppData\Local\Microsoft\Windows\SettingSync

In the below I selected [Cancel]  and did not proceed as I wanted to know if it is still working.

Thank you!

Saturday, February 6, 2016 10:03 PM

What does this TECHNET-language mean: 2. Save the following the script as a .bat file and run it as administrator. Please replace the tool path with the location you have saved the tool to.

Is this proper English.?

Could anybody translate this technological language to proper English?

Tuesday, March 1, 2016 4:54 PM

The instruction is simple.

    1. Download from the link given.

    2. Install subinacl.msi

    3. Save the following script as .bat (batch) file. I changed %ProgramFiles% to Program Files (x86).

      @echo off
title Resetting ACLs...
cd /d "C:\Program Files (x86)\Windows Resource Kits\Tools"
echo. 
echo Resetting ACLs...
echo (this may take several minutes to complete)
echo. 
echo ==========================================================================
echo. 
echo System Drive...
subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
echo. 
echo. 
echo Windows Directory...
subinacl /subdirectories %windir%\*.* /grant=administrators=f /grant=system=f
echo. 
echo. 
echo ==========================================================================
echo. 
echo FINISHED.
echo. 
echo Press any key to exit . . .
pause >NUL

    4. Run the .bat file as Administrator. Right click --> Run as administrator.

    5. Wait until finish.

Friday, June 10, 2016 12:21 PM

As the error described, I come to conclusion that the SettingSyncHost tried to make a new log file on "C:\Windows\System32\edbtmp.log" (Esent 488), and the creation of that log is denied probably because that SettingSyncHost didn't have the rights to create a new file under System32 folder. Afterwards, Esent 413 comes because the log can't be written (no file).

  • Esent 488: SettingSyncHost (7892) An attempt to create the file "C:\Windows\system32\edbtmp.log " failed with system error 5 (0x00000005) : "Access denied". The create file operation will fail with error -1032 (0xfffffbf8).
  • Esent 413: SettingSyncHost (7892) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Erreur -1032.

Previously I've tried the answer proposed by:

  • MeipoXu using SubInACL.exe
  • DWW1505 by copying the empty folder of SettingSyncHost from "C:\Windows\Logs\SettingSync\ to "C:\Users\your username>\AppData\Local\Microsoft\Windows\SettingSync\

And the error still occurs, so I tried to do something myself which is to create a "edbtmp.log" file under "C:\Windows\System32\ by following steps:

  1. Open Command Prompt with Administrators access (Run as Administrators)
  2. Make sure you're on "C:\Windows\System32" or type: CD "C:\Windows\System32"
  3. Make a new "edbtmp.log" by typing: NUL > edbtmp.log
  4. Go to "C:\Windows\System32" folder and find that "edbtmp.log" file
  5. Grant full access of that file log for your Windows profile (for Users,  Administrators, <your username>)

Edit 1: Additional Error Occurs (Esent 486 followed by Esent 413)

After restarting and using it for few hours, new problem arises. As the file name suggest, "edbtmp.log" where "tmp" stands for "temporary", SettingSyncHost tried to move the log from "edbtmp.log" to "edb.log" on "C:\Windows\System32" (Esent 486).  Thus followed by Esent 413 as I explained above. Note: I no longer get Esent 488 problems. So I tried to make a new "edb.log" file by repeating step 1-5 above:

  1. Open Command Prompt with Administrators access (Run as Administrators)
  2. Make sure you're on "C:\Windows\System32" or type: CD "C:\Windows\System32"
  3. Make a new "edbtmp.log" by typing: NUL > edb.log
  4. Go to "C:\Windows\System32" folder and find that "edb.log" file
  5. Grant full access of that file log for your Windows profile (for Users,  Administrators, <your username>)
  • Esent 486: SettingSyncHost (3716) An attempt to move the file "C:\Windows\system32\edbtmp.log" to "C:\Windows\system32\edb.log" failed with system error 5 (0x00000005): "Access is denied. ".  The move file operation will fail with error -1032 (0xfffffbf8).

Edit 2: Feedback, rechecking my Event Viewer after few days (2 days in my case, I use my laptop 4-6 hours daily)

It has been 2 days since and I didn't get Esent 488 or Esent 486 or Esent 413 anymore.

Hope my solution could be a help for you guys. Thanks :)

Edit 3: It has been for more than 2 weeks and I'm no longer received any ESENT errors.