Event ID:12

Question

_{Tuesday, September 13, 2016 7:46 AM}

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          13/09/2016 08:28:42
Event ID:      12
Task Category: (1)
Level:         Information
Keywords:      (128)
User:          SYSTEM
Computer:      GeraldCornell
Description:
The operating system started at system time ‎2016‎-‎09‎-‎13T07:28:42.487749800Z.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>12</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000080</Keywords>
    <TimeCreated SystemTime="2016-09-13T07:28:42.715199700Z" />
    <EventRecordID>4650</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>GeraldCornell</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="MajorVersion">10</Data>
    <Data Name="MinorVersion">0</Data>
    <Data Name="BuildVersion">14393</Data>
    <Data Name="QfeVersion">103</Data>
    <Data Name="ServiceVersion">0</Data>
    <Data Name="BootMode">0</Data>
    <Data Name="StartTime">2016-09-13T07:28:42.487749800Z</Data>
  </EventData>
</Event>

Since the introduction of Windows 10 this Event now only seems to appear after a restart and not shutdown. Can others confirm this? Does anyone have an explanation for the change? Is a bug?

Within the report details the QFE version ceased to be recorded with the introduction of Windows 10 but was restored with the Anniversary Update. This looks like an undocumented bug that Microsoft fixed.

Similarly Event ID: 13 reports do not appear after a shutdown but do after a restart.

The Event ID 12 problem seems to be mirrored with the non-appearance of Event 100 Microsoft-Windows-Diagnostics-Performance/Operational report after a shut down

Hope this helps, Gerry

All replies (3)

_{Tuesday, September 13, 2016 7:25 PM ✅Answered}

On the machines I have checked all have 12 and 13 events as expected. So this would be related to fast start-up to me, http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html for info on seeing if it is available and perhaps turn it off for a test. A restart is not a fast start-up apparently, the Windows 8 guide stats shutting down from the Win+X does not do a fast start-up (I cannot test this do not have the option for fast start-up).

Check System Boot Time on systeminfo out of interest, that did get updated with a fast start-up in a post many months ago.

_{Saturday, September 17, 2016 6:58 AM}

I have disabled Fast StartUp on this computer and my tests have demonstrated what you say to be true. Now seeing Event ID: 12 and 13 reports. Thanks.

Fast StartUp must be enabled by default when Windows 7 is upgraded by default as this has happened without my knowledge on two computers.

I cannot find any reference to System Boot Time in the System information file. Have I misinterpreted what you say in your second paragraph?

Hope this helps, Gerry

_{Saturday, September 17, 2016 2:26 PM}

Sorry to be clear from a command prompt when I enter 'systeminfo' (without quotes) the output at the top is;

Host Name:                
OS Name:                   Microsoft Windows 10 Pro Insider Preview
OS Version:                10.0.14926 N/A Build 14926
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          Windows User
Registered Organization:
Product ID:               
Original Install Date:     ‎14/‎09/‎2016, 20:15:17
System Boot Time:          ‎17/‎09/‎2016, 15:09:21
System Manufacturer:       VMware, Inc.

There is more but that is top, so the tenth line for shows System Boot Time.