Frequent Win 10 service failure! Why?

Heedtheadvice

Your further comments (both of you) are appreciated.

Further as a note to one of the above comments: I schedule backups (they do not start automatically at boot) and wait for satisfactory completion before shutting down.

Event logs: -  a bit verbose below but it does seem to point in one direction!

Only one critical Kernel Power record way back last December and has been rebooted several times since then error "The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly."

(my comments in italics below)

During previous closedown

Application log Error "Windows cannot unload your registry file. The memory used by the registry has not been freed. This problem is often caused by services running as a user account. Try configuring services to run in either the LocalService or NetworkService account. "....that seems possibly linked?

Close to that time in System log Event 10010 Dcom "The server Windows.Internal.Shell.ConsentUx.Details.ConsentUxService did not register with DCOM within the required timeout."....a red herring?

On Booting today when Profile message occurred there were several Events:

"Unable to start a DCOM Server: Microsoft.Windows.Cortana_1.12.3.18362_neutral_neutral_cw5n1h2txyewy!CortanaUI.AppXynb3eakad12451rv00qxextfnce9sxb8.mca as Unavailable/Unavailable. The error:
"2147942667"
Happened while starting this command:
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca"...........We do not use Cortana 17 of those Errors

then

id 7043 Service Control Manager "The Check Point Endpoint EFR service did not shut down properly after receiving a preshutdown control." ....Zone Alarm Extreme Security

Then another Dcom "The server {D63B10C5-BB46-4990-A94F-E40B9D520160} did not register with DCOM within the required timeout."

then Error 7011 Service control manager

"A timeout (30000 milliseconds) was reached while waiting for a transaction response from the CPEFR service." ...Zone Alarm again

This repeated (in between a Dcom for Bing.weather) five times.....Why do those happen? but again maybe not linked to Registry Profile issue?

That tends to point a finger!! Followed immediately by

Information:   "The access history in hive \??\C:\Users\{username Mrs Heedtheadvice}\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat was cleared updating 1273 keys and creating 89 modified pages.".............so there is the action on the Registry, no?

Summing up

There do seem to be several CPEFR errors prior to the Registry mods by windows but I wonder why they only sometimes cause problems (I am assuming they have the same causal reason over the recent similar profile problems but logging on just now (personally nor Mrs H) there are three repeats of the same  Error but no Profile problem!..?

Can you help further? Apart from abandoning Zone Alarm (which I am not inclined to do) is the only solution to back to check point for their ZA support?

TIA

CoastingHatbox

I was going to try and break your message down into individual quotes, but alas that is easier said than done.

The registry unload is actually, IME, fairly common and usually inconsequential. However, doesn't mean that it is always inconsequential and could be related.

The DCOM stuff can be ignored.

If I had to make a wager, that Check Point Endpoint EFR service looks very suspicious. I think EFR is 'Endpoint Forensic Recorder' so no doubt that will be collecting information which includes the registry. I'd personally uninstall ZoneAlarm for a couple of weeks and see if the problem comes back. You can always reinstall it if that proves not to be the case. Defender is a more than good enough alternative.

Heedtheadvice

Thanks. Yes sorry not very well laid out!

Thank you for helping. I think I should be able to take it from here!.....but I might be back