- 10016 — DistributedCOM permission errorMicrosoft has published guidance saying these can be safely ignored, and that editing the registry and DCOM permissions to silence them — which is what almost every search result instructs — risks breaking the component instead. It is the most-searched harmless event in Windows.
- Safe to ignore
- 41 — Kernel-Power: the system rebooted without cleanly shutting downThis is a symptom with no cause attached, which is why it frustrates people: it says the machine stopped abruptly and nothing more. Power supply, overheating, failing RAM and a hard freeze all produce exactly this. Look for a 1001 BugCheck immediately before it — if there is one, the crash was a blue screen and has a stop code to work with.
- Check it
- 6008 — The previous system shutdown was unexpectedUseful only for its timestamp. Match it against what was running, and against 41 and 1001 in the same window.
- Context
- 1001 — BugCheck — a blue screen occurredThe one worth acting on. It carries the stop code, which names a cause where 41 does not. Take the code from here rather than from a photograph of the screen.
- Act on it
- 1000 — Application errorThe faulting module is what matters, not the application. A crash inside a graphics or audio driver DLL points at the driver rather than at the program that happened to call it.
- Context
- 7000 — A service failed to startCheck the service name and its dependencies. Frequent after an uninstall that left a service registered with its binary removed.
- Check it
- 7034 — A service terminated unexpectedlyA rising count on the same service is worth pursuing. A single occurrence around a reboot usually is not.
- Check it
- 51 — A paging error occurred on a diskTake this seriously and check the drive health. Paging errors frequently precede a drive failure by weeks, and they appear long before anything is visibly wrong.
- Act on it
- 153 — The IO operation was retriedOccasional retries happen on healthy systems. A pattern of them, especially alongside 51, points at the drive or its cable.
- Check it
- 2004 — Resource exhaustion detectedThe process list in the event is the useful part. It names what was consuming memory at the moment it ran out, which is otherwise very hard to reconstruct afterwards.
- Check it
- 4625 — An account failed to log onVolume is what matters. A handful is normal; hundreds from one source on a machine reachable from the internet is not.
- Context
- 129 — Reset to device issuedA serious storage signal, frequently a failing drive, a cable, or a controller driver problem. Back up before investigating.
- Act on it