| Event Id | 1001 |
| Source | Winlogon |
| Description | NTFS - Autochk: file system check occurred on startup |
| Event Information | According to Microsoft : Explanation : Microsoft® Windows® encountered corrupted file-system metadata during the last Windows session, so Windows marked the file system as “dirty” (corrupt). Windows ran thechkdsk /fcommand during startup in an attempt to repair the corrupted file system metadata. Related Events Chkdsk: Event ID 26180 Chkdsk: Event ID 1066 Cause: The file system might have been marked as “dirty” (corrupt) for one of the following reasons: 1.I/O requests that were issued by the file system to the disk subsystem might not have been completed successfully. 2.The operating system was shut down incorrectly. If the volume is formatted with the FAT file system, an incorrect shutdown of Windows will always cause this event (Event ID 1001). FAT is not a journaling file system. In order to maintain metadata consistency, FAT requires the operating system to be shut down properly. An incorrect shutdown (for example, a power failure) forces Windows to run chkdskin order to ensure that the file-system metadata is consistent. If the volume is formatted with the NTFS file system, running chkdskis not normally necessary. NTFS is a journaling file system and does not usually require chkdskto ensure metadata consistency. However, NTFS depends upon the media to guarantee its write-through semantics. If the media does not accept write-through semantics, inconsistencies in the file-system metadata might occur when there is a sudden loss of power or a system failure. 3.The media (hard disk) might have developed bad sectors. Resolution : This message is provided to inform you that the chkdskcommand was run on the file system. No actions are required, but the corrupted disk might indicate other disk problems. You should do the following: 1.Review the application log and the system log in Event Viewer for additional errors. Event ID 1066 contains the detailed chkdsk log. You should review the chkdsklog to see what problems (if any) chkdsk found on the volume and what fixes (if any) were made. 2.Check related hardware and devices on the shared bus to ensure that the cables are connected and that the hardware and devices are properly terminated. 3.Avoid improper shutdowns. If the volume is formatted with the FAT file system, you can usually avoid Event ID 1001 by properly shutting down Windows. If Event ID 1001 occurs frequently for an NTFS volume (or for a FAT volume, despite proper shutdowns), it is likely that the disk has developed bad sectors. Runchkdsk /rto locate bad sectors on the hard disk. |
| Reference Links | Event ID 1001 frm source Winlogon |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.