I have encountered an error on windows server 2012 recently.
Session "NT Kernel Logger" failed to start with the following error: 0xc0000022
More Details:
LogName: Microsoft-Windows-Kernel-EventTracing/Admin
Event ID: 2
Level: error
OpCode: start
If you look into the Event properties details, you will find the associated ProcessID and ThreadID:
If the event is relatively current, the Process ID should still be registered by the offending process. Open task manager and go to processes tab and list processes by PID.
Now you can find out which process causes this event.
for more info please refer to this link
User contributions licensed under CC BY-SA 3.0