SOLVED Errors in Event Viewer: EapHost, Event ID 2002

[gollux]

My computer seemed to be running more slowly after the Creators update, so I went into the error viewer and found a ton of errors with the source "EapHost, Event ID 2002." From Googling around, I found that this error can be caused by leftover keys from Cisco software, so I went ahead and deleted two of the keys referred to in the error logs, and the errors associated with those keys stopped popping up. However, there's a third error that keeps popping up:

Skipping: Eap method DLL path validation failed. Error: typeId=21, authorId=311, vendorId=0, vendorType=0

The trouble is that this doesn't give me enough information to figure out which key I need to delete. It refers me to a node in the registry called WLANProfileCreationUXAuth. There are six subfolders under that one, and some of them contain keys that I can't delete. (Stupidly, I tried, but the system wouldn't let me.) None of them refer to Cisco, as far as I can see.

What I'm wondering is this: how can I figure out which of the specific keys I need to delete?

 

[Regedit32]

Hi and Welcome to the Forum gollux.

To get to the bottom of this I think we need to start from the beginning.

You mention leftover keys from Cisco Software and the spoke about deleting a couple of Registry keys.

So my question to you is, Did you in fact, uninstall Cisco programs such as:

• Cisco LEAP
• Cisco PEAP Module
• Cisco EAP-FAST modules

Could you confirm which of the above three you uninstalled, or whether you uninstalled something else pertaining to Cisco Software?
​

You also said, a third error that keeps popping up:

• Skipping: Eap method DLL path validation failed. Error: typeId=21, authorId=311, vendorId=0, vendorType=0

I'm assuming you mean, this error is appearing in your Event Viewer under the auspices of Event ID 2002, but it would be helpful if you could confirm that for me.

If my assumption is correct, are you able to post the complete Error message, and its details?

In terms of what you have provided so far the typeId=21 would be referring to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EapHost\Methods\311\21​

21 is the sub-key of the authorId=311

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EapHost\Methods\311​

As all of this ultimately boils down to WPA-2 (i.e. Wi-Fi Protected Access - 2, a Network Security technology) I guess I need to ask the obvious too, Are you actually having any notable issues with your Wi-Fi connections that warrant the editing your Registry in the first place.

Myself, and others in the Forum are happy to help you as best we can, but it would be helpful to get the ' full picture ' per se, before we start talking about what keys or sub-keys and / or their Values we start tampering with.


Regards,

Regedit32

 

[gollux]

Hi Regedit32,

Thanks very much for your help with this. To answer your questions:

1) I did not knowingly install any Cisco programs. (Other uses around the net have reported these registry keys without knowingly installing Cisco software.)

2) Yes, the error that keeps popping up appears in the Event viewer under Event ID 2002.

3) I have copied the detailed message from Event Viewer below.

4) I have not noticed any problems with wifi connections. However, I wondered whether this error message might be related to my system's slow responsiveness. (I don't know much about it, so I may hvae the wrong end of the stick, but if Windows is repeatedly writing this error I thought it might slow things down.)

5) I have traced the registry key in question to the branch you refer to. The problem is that there are six further notes under that branch, and the message doesn't seem to indicate which one is the cause.

-

- System

- Provider

[ Name] Microsoft-Windows-EapHost
[ Guid] {6EB8DB94-FE96-443F-A366-5FE0CEE7FB1C}

EventID 2002

Version 0

Level 2

Task 2

Opcode 0

Keywords 0x8000000000000001

- TimeCreated

[ SystemTime] 2017-06-04T19:56:04.663799200Z

EventRecordID 9398

Correlation

- Execution

[ ProcessID] 7352
[ ThreadID] 10144

Channel Application

Computer flippity-flop

- Security

[ UserID] S-1-5-18


- EventData

Key Name Eap method DLL path
TypeId 21
AuthorId 311
VendorId 0
VendorType 0

 

[Regedit32]

1) I did not knowingly install any Cisco programs.

I asked if you uninstalled not installed

In terms of knowingly installing drivers though, the Cisco drivers and modules can be bundled into several installations; for example, if your computer has Realtek PCIe Drivers installed there is a good chance you inherited one or more Cisco modules.

Speaking of that, if you've updated drivers recently, it is plausible they may need to be installed in compatibility mode if your computer is getting on in years.

My guess is something installed to do with Network is conflicting with C:\Windows\System32\eapsvc.dll which is what that GUID {6EB8DB94-FE96-443F-A366-5FE0CEE7FB1C} in your error message alludes to.


If you have a restore point that's Date & Time come before you started deleting keys in your Registry, I'd suggest using that, then go to your Device Manager and take a look at the drivers being used for your Network Adapters.


The error log in the Event Viewer, is just that, a log, and ought not cause any significant System troubles, but the error itself could cause symptomatic issues with Wi-Fi or LAN networking. Symptoms you might experience would be a hanging browser session or a total crash of the browser itself. If that happened, note time and go check your Event Viewer to see whether 2002 pops up at same time - because then you could be pretty confident the real issue is with the Network Adapters clashing with Microsoft's EAP Host.

 

[gollux]

Hi Regedit32,

Thanks again for your help, and apologies for my slow response.

I don't have a restore point available from before the error messages began appearing. I had considered reinstalling the operating system, but your comment about the error log in Event Viewer suggests that may be unnecessary. I had thought that constantly writing errors to the log could slow my system, but your response suggests that it's safe to ignore the errors.

In any case, for the moment I'll have a look at my network adapters.

Thanks!

Gollux

 

[afclark82]

Hi RegEdit32. I am having the same errors pop up and they cause a crash of my hard drive. Everything freezes and I need to restart the computer before I can do anything. Any suggestions?

 

[Personwithaproblem]

Where's the solution to this? I don't see it and yet the post says solved. I have the same problem and don't have any wifi on my comp, nor do I have a restore point before the issue began.

 

[ubuysa]

EAPHost is a Windows module, see https://docs.microsoft.com/en-us/windows/win32/eaphost/about-eap-host. The Extensible Authentication Protocol handles networking authentication. Since EAP is 'extensible' it's not unusual for third-party products to include EAP modules, such as the CISCO modules you mention - these can potentially be licensed and installed by non-CISCO networking products as well.

If you are still having problems I would suggest that you uninstall all third-party networking tools or add-ons that you may have installed and that you also uninstall your network adapter driver and reinstall it (via Windows Update). Ideally you want to try to get back to a vanilla (ie. clean) networking environment.