Process randomly exits

[KevR]

Hi Gianpaolo,

(I don't normally address forum posts directly to developers but you're so quick to answer queries in here I'll make an exception. Obviously if any other users have a similar problem, or can suggest a possible cause, I welcome any and all clues!)

I'm running Wallpaper Slideshow Pro on a two-monitor Windows 11 system. The primary monitor has a fixed wallpaper and the secondary monitor shows random images from a single folder containing subfolders of images, on a 20 second rotation.

For the last few months I've had an issue whereby Wallpaper Slideshow Pro's process randomly and silently exits in the background. Because Windows continues to show the old constructed wallpaper, sometimes it took me a while to notice that this had happened, especially if there was a fullscreen window on the secondary monitor.

Anecdotally the crashes seems to occur more frequently shortly after the PC resumes from sleep, or when unlocking from the lock screen. But this may just be confirmation bias, because these are the times I'm most likely to remember to look for it happening. (But also see the bit about the Screen Saver near the end of this post).

To try to catch it in the act, I enabled logging in both Wallpaper Slideshow Pro itself and in the Windows Security Log, and used a macro program (SignalRGB, if it's significant) to send an alert when the wallpaperss64.exe process exited.

I've reproduced part of the log below, showing the last six wallpaper changes prior to the crash, and I can't see any difference between the first five changes and the one just before the crash occured. The only noticeable differences between any of them are the ExifUser Comment line (sometimes this is parsed as ASCII, sometimes a jpeg comment, sometimes null) and the output from ResizeBmp_gdiplus, but I would expect these to be different for each file for obvious reasons.

Code: Select all

11/08/2025 19:15:04 : ChangeWallpaper: Enter (1), -1 0
11/08/2025 19:15:04 : ChooseWallpaperForMon: mon 0, Display Filter=4
11/08/2025 19:15:04 : ChooseImageFile: monitor 0 single image REDACTED.jpg
11/08/2025 19:15:04 : ChooseWallpaperForMon: REDACTED.jpg (pos=200)
11/08/2025 19:15:04 : ChooseWallpaperForMon: mon 1, Display Filter=0
11/08/2025 19:15:04 : WeightedRandom: 5228, total=6253
11/08/2025 19:15:04 : ChooseNewImage: idx=5228 (Size=6253), 6051, file: REDACTED.JPG
11/08/2025 19:15:04 : ChooseWallpaperForMon: REDACTED.JPG (pos=203)
11/08/2025 19:15:04 : BuildWallpaper: Enter
11/08/2025 19:15:04 : BuildWallpaper Size =(2560,2160)
11/08/2025 19:15:04 : BuildWallpaper: 0, REDACTED.jpg  : 5fe6a8
11/08/2025 19:15:04 : ReadExifData: time= 0ms
11/08/2025 19:15:04 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,2560-1080), 0 0
11/08/2025 19:15:04 : ResizeBmp_gdiplus: Old Size=2560,1080 New Size=2560,1080 Stretch=0
11/08/2025 19:15:04 : ShowFilename: scale=100, dpi=96, WorkRc=(0,0)
11/08/2025 19:15:04 : BuildWallpaper: 1, REDACTED.JPG  : 5fe6a8
11/08/2025 19:15:04 : Exif UserComment, maybe it's jpeg comment
11/08/2025 19:15:04 : ReadExifData: time= 0ms
11/08/2025 19:15:04 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,1920-1080), 0 0
11/08/2025 19:15:04 : ResizeBmp_gdiplus: Old Size=1166,1754 New Size=1920,1080 Stretch=1
11/08/2025 19:15:04 : ResizeBmp_gdiplus: Size Adjusted: (718,1080)
11/08/2025 19:15:04 : ShowFilename: scale=100, dpi=96, WorkRc=(326,-1080)
11/08/2025 19:15:04 : BuildWallpaper: Build Time: 0.28s
11/08/2025 19:15:04 : BuildWallpaper: Save Time: 0.03s
11/08/2025 19:15:04 : SetWallpaper: bUseActiveDesk = 0 (0 0 0)
11/08/2025 19:15:05 : OnWinIniChange (1,0)
11/08/2025 19:15:06 : SetWallpaper: Wallpaper changed to C:\Users\REDACTED\AppData\Roaming\WallpaperSSPro\Wallpaper.bmp
11/08/2025 19:15:06 : BuildWallpaper: SetWallpaper Time: 1.38s
11/08/2025 19:15:06 : BuildWallpaper: Exit
11/08/2025 19:15:06 : ChangeWallpaper: Exit
11/08/2025 19:15:26 : ChangeWallpaper: Enter (1), -1 0
11/08/2025 19:15:26 : ChooseWallpaperForMon: mon 0, Display Filter=4
11/08/2025 19:15:26 : ChooseImageFile: monitor 0 single image REDACTED.jpg
11/08/2025 19:15:26 : ChooseWallpaperForMon: REDACTED.jpg (pos=200)
11/08/2025 19:15:26 : ChooseWallpaperForMon: mon 1, Display Filter=0
11/08/2025 19:15:26 : WeightedRandom: 774, total=6252
11/08/2025 19:15:26 : ChooseNewImage: idx=774 (Size=6252), 892, file: REDACTED.jpg
11/08/2025 19:15:26 : ChooseWallpaperForMon: REDACTED.jpg (pos=203)
11/08/2025 19:15:26 : BuildWallpaper: Enter
11/08/2025 19:15:26 : BuildWallpaper Size =(2560,2160)
11/08/2025 19:15:26 : BuildWallpaper: 0, REDACTED.jpg  : 5fe6a8
11/08/2025 19:15:26 : ReadExifData: time= 0ms
11/08/2025 19:15:26 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,2560-1080), 0 0
11/08/2025 19:15:26 : ResizeBmp_gdiplus: Old Size=2560,1080 New Size=2560,1080 Stretch=0
11/08/2025 19:15:26 : ShowFilename: scale=100, dpi=96, WorkRc=(0,0)
11/08/2025 19:15:26 : BuildWallpaper: 1, REDACTED.jpg  : 5fe6a8
11/08/2025 19:15:26 : Exif UserComment, charset ASCII or undefined, len=125
11/08/2025 19:15:26 : ReadExifData: time= 0ms
11/08/2025 19:15:26 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,1920-1080), 0 0
11/08/2025 19:15:26 : ResizeBmp_gdiplus: Old Size=1232,1919 New Size=1920,1080 Stretch=1
11/08/2025 19:15:26 : ResizeBmp_gdiplus: Size Adjusted: (693,1080)
11/08/2025 19:15:26 : ShowFilename: scale=100, dpi=96, WorkRc=(326,-1080)
11/08/2025 19:15:26 : BuildWallpaper: Build Time: 0.36s
11/08/2025 19:15:26 : BuildWallpaper: Save Time: 0.03s
11/08/2025 19:15:26 : SetWallpaper: bUseActiveDesk = 0 (0 0 0)
11/08/2025 19:15:28 : OnWinIniChange (1,0)
11/08/2025 19:15:28 : SetWallpaper: Wallpaper changed to C:\Users\REDACTED\AppData\Roaming\WallpaperSSPro\Wallpaper.bmp
11/08/2025 19:15:28 : BuildWallpaper: SetWallpaper Time: 1.48s
11/08/2025 19:15:28 : BuildWallpaper: Exit
11/08/2025 19:15:28 : ChangeWallpaper: Exit
11/08/2025 19:15:48 : ChangeWallpaper: Enter (1), -1 0
11/08/2025 19:15:48 : ChooseWallpaperForMon: mon 0, Display Filter=4
11/08/2025 19:15:48 : ChooseImageFile: monitor 0 single image REDACTED.jpg
11/08/2025 19:15:48 : ChooseWallpaperForMon: REDACTED.jpg (pos=200)
11/08/2025 19:15:48 : ChooseWallpaperForMon: mon 1, Display Filter=0
11/08/2025 19:15:48 : WeightedRandom: 3850, total=6251
11/08/2025 19:15:48 : ChooseNewImage: idx=3850 (Size=6251), 4458, file: REDACTED.JPG
11/08/2025 19:15:48 : ChooseWallpaperForMon: REDACTED.JPG (pos=203)
11/08/2025 19:15:48 : BuildWallpaper: Enter
11/08/2025 19:15:48 : BuildWallpaper Size =(2560,2160)
11/08/2025 19:15:48 : BuildWallpaper: 0, REDACTED.jpg  : 5fe6a8
11/08/2025 19:15:48 : ReadExifData: time= 0ms
11/08/2025 19:15:48 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,2560-1080), 0 0
11/08/2025 19:15:48 : ResizeBmp_gdiplus: Old Size=2560,1080 New Size=2560,1080 Stretch=0
11/08/2025 19:15:48 : ShowFilename: scale=100, dpi=96, WorkRc=(0,0)
11/08/2025 19:15:48 : BuildWallpaper: 1, REDACTED.JPG  : 5fe6a8
11/08/2025 19:15:48 : ReadExifData: time= 0ms
11/08/2025 19:15:48 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,1920-1080), 0 0
11/08/2025 19:15:48 : ResizeBmp_gdiplus: Old Size=3264,1953 New Size=1920,1080 Stretch=1
11/08/2025 19:15:48 : ResizeBmp_gdiplus: Size Adjusted: (1805,1080)
11/08/2025 19:15:48 : ShowFilename: scale=100, dpi=96, WorkRc=(326,-1080)
11/08/2025 19:15:48 : BuildWallpaper: Build Time: 0.42s
11/08/2025 19:15:48 : BuildWallpaper: Save Time: 0.03s
11/08/2025 19:15:48 : SetWallpaper: bUseActiveDesk = 0 (0 0 0)
11/08/2025 19:15:50 : OnWinIniChange (1,0)
11/08/2025 19:15:50 : SetWallpaper: Wallpaper changed to C:\Users\REDACTED\AppData\Roaming\WallpaperSSPro\Wallpaper.bmp
11/08/2025 19:15:50 : BuildWallpaper: SetWallpaper Time: 1.47s
11/08/2025 19:15:50 : BuildWallpaper: Exit
11/08/2025 19:15:50 : ChangeWallpaper: Exit
11/08/2025 19:16:10 : ChangeWallpaper: Enter (1), -1 0
11/08/2025 19:16:10 : ChooseWallpaperForMon: mon 0, Display Filter=4
11/08/2025 19:16:10 : ChooseImageFile: monitor 0 single image REDACTED.jpg
11/08/2025 19:16:10 : ChooseWallpaperForMon: REDACTED.jpg (pos=200)
11/08/2025 19:16:10 : ChooseWallpaperForMon: mon 1, Display Filter=0
11/08/2025 19:16:10 : WeightedRandom: 4256, total=6250
11/08/2025 19:16:10 : ChooseNewImage: idx=4256 (Size=6250), 4928, file: REDACTED.JPG
11/08/2025 19:16:10 : ChooseWallpaperForMon: REDACTED.JPG (pos=203)
11/08/2025 19:16:10 : BuildWallpaper: Enter
11/08/2025 19:16:10 : BuildWallpaper Size =(2560,2160)
11/08/2025 19:16:10 : BuildWallpaper: 0, REDACTED.jpg  : 5fe6a8
11/08/2025 19:16:10 : ReadExifData: time= 0ms
11/08/2025 19:16:10 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,2560-1080), 0 0
11/08/2025 19:16:10 : ResizeBmp_gdiplus: Old Size=2560,1080 New Size=2560,1080 Stretch=0
11/08/2025 19:16:10 : ShowFilename: scale=100, dpi=96, WorkRc=(0,0)
11/08/2025 19:16:10 : BuildWallpaper: 1, REDACTED.JPG  : 5fe6a8
11/08/2025 19:16:10 : Exif UserComment, maybe it's jpeg comment
11/08/2025 19:16:10 : ReadExifData: time= 0ms
11/08/2025 19:16:10 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,1920-1080), 0 0
11/08/2025 19:16:10 : ResizeBmp_gdiplus: Old Size=3008,2000 New Size=1920,1080 Stretch=1
11/08/2025 19:16:10 : ResizeBmp_gdiplus: Size Adjusted: (1624,1080)
11/08/2025 19:16:10 : ShowFilename: scale=100, dpi=96, WorkRc=(326,-1080)
11/08/2025 19:16:10 : BuildWallpaper: Build Time: 0.45s
11/08/2025 19:16:10 : BuildWallpaper: Save Time: 0.03s
11/08/2025 19:16:10 : SetWallpaper: bUseActiveDesk = 0 (0 0 0)
11/08/2025 19:16:12 : OnWinIniChange (1,0)
11/08/2025 19:16:12 : SetWallpaper: Wallpaper changed to C:\Users\REDACTED\AppData\Roaming\WallpaperSSPro\Wallpaper.bmp
11/08/2025 19:16:12 : BuildWallpaper: SetWallpaper Time: 1.34s
11/08/2025 19:16:12 : BuildWallpaper: Exit
11/08/2025 19:16:12 : ChangeWallpaper: Exit
11/08/2025 19:16:32 : ChangeWallpaper: Enter (1), -1 0
11/08/2025 19:16:32 : ChooseWallpaperForMon: mon 0, Display Filter=4
11/08/2025 19:16:32 : ChooseImageFile: monitor 0 single image REDACTED.jpg
11/08/2025 19:16:32 : ChooseWallpaperForMon: REDACTED.jpg (pos=200)
11/08/2025 19:16:32 : ChooseWallpaperForMon: mon 1, Display Filter=0
11/08/2025 19:16:32 : WeightedRandom: 1182, total=6249
11/08/2025 19:16:32 : ChooseNewImage: idx=1182 (Size=6249), 1356, file: REDACTED.JPG
11/08/2025 19:16:32 : ChooseWallpaperForMon: REDACTED.JPG (pos=203)
11/08/2025 19:16:32 : BuildWallpaper: Enter
11/08/2025 19:16:32 : BuildWallpaper Size =(2560,2160)
11/08/2025 19:16:32 : BuildWallpaper: 0, REDACTED.jpg  : 5fe6a8
11/08/2025 19:16:32 : ReadExifData: time= 0ms
11/08/2025 19:16:32 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,2560-1080), 0 0
11/08/2025 19:16:32 : ResizeBmp_gdiplus: Old Size=2560,1080 New Size=2560,1080 Stretch=0
11/08/2025 19:16:32 : ShowFilename: scale=100, dpi=96, WorkRc=(0,0)
11/08/2025 19:16:32 : BuildWallpaper: 1, REDACTED.JPG  : 5fe6a8
11/08/2025 19:16:32 : Exif UserComment, charset ASCII or undefined, len=125
11/08/2025 19:16:32 : ReadExifData: time= 0ms
11/08/2025 19:16:32 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,1920-1080), 0 0
11/08/2025 19:16:32 : ResizeBmp_gdiplus: Old Size=1984,1312 New Size=1920,1080 Stretch=1
11/08/2025 19:16:32 : ResizeBmp_gdiplus: Size Adjusted: (1633,1080)
11/08/2025 19:16:32 : ShowFilename: scale=100, dpi=96, WorkRc=(326,-1080)
11/08/2025 19:16:32 : BuildWallpaper: Build Time: 0.36s
11/08/2025 19:16:32 : BuildWallpaper: Save Time: 0.03s
11/08/2025 19:16:32 : SetWallpaper: bUseActiveDesk = 0 (0 0 0)
11/08/2025 19:16:34 : OnWinIniChange (1,0)
11/08/2025 19:16:34 : SetWallpaper: Wallpaper changed to C:\Users\REDACTED\AppData\Roaming\WallpaperSSPro\Wallpaper.bmp
11/08/2025 19:16:34 : BuildWallpaper: SetWallpaper Time: 1.38s
11/08/2025 19:16:34 : BuildWallpaper: Exit
11/08/2025 19:16:34 : ChangeWallpaper: Exit
11/08/2025 19:16:54 : ChangeWallpaper: Enter (1), -1 0
11/08/2025 19:16:54 : ChooseWallpaperForMon: mon 0, Display Filter=4
11/08/2025 19:16:54 : ChooseImageFile: monitor 0 single image REDACTED.jpg
11/08/2025 19:16:54 : ChooseWallpaperForMon: REDACTED.jpg (pos=200)
11/08/2025 19:16:54 : ChooseWallpaperForMon: mon 1, Display Filter=0
11/08/2025 19:16:54 : WeightedRandom: 2312, total=6248
11/08/2025 19:16:54 : ChooseNewImage: idx=2312 (Size=6248), 2671, file: REDACTED.JPG
11/08/2025 19:16:54 : ChooseWallpaperForMon: REDACTED.JPG (pos=203)
11/08/2025 19:16:54 : BuildWallpaper: Enter
11/08/2025 19:16:54 : BuildWallpaper Size =(2560,2160)
11/08/2025 19:16:54 : BuildWallpaper: 0, REDACTED.jpg  : 5fe6a8
11/08/2025 19:16:54 : ReadExifData: time= 0ms
11/08/2025 19:16:54 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,2560-1080), 0 0
11/08/2025 19:16:54 : ResizeBmp_gdiplus: Old Size=2560,1080 New Size=2560,1080 Stretch=0
11/08/2025 19:16:54 : ShowFilename: scale=100, dpi=96, WorkRc=(0,0)
11/08/2025 19:16:54 : BuildWallpaper: 1, REDACTED.JPG  : 5fe6a8
11/08/2025 19:16:54 : Exif UserComment, maybe it's jpeg comment
11/08/2025 19:16:54 : ReadExifData: time= 15ms
11/08/2025 19:16:54 : PrepareNewImage: Frame Type=0, Size= 16,16 (0-0,1920-1080), 0 0
11/08/2025 19:16:54 : ResizeBmp_gdiplus: Old Size=3008,2000 New Size=1920,1080 Stretch=1
11/08/2025 19:16:54 : ResizeBmp_gdiplus: Size Adjusted: (1624,1080)
11/08/2025 19:16:54 : ShowFilename: scale=100, dpi=96, WorkRc=(326,-1080)
11/08/2025 19:16:54 : BuildWallpaper: Build Time: 0.38s
11/08/2025 19:16:54 : BuildWallpaper: Save Time: 0.03s
11/08/2025 19:16:54 : SetWallpaper: bUseActiveDesk = 0 (0 0 0)
11/08/2025 19:16:56 : OnWinIniChange (1,0)
11/08/2025 19:16:56 : SetWallpaper: Wallpaper changed to C:\Users\REDACTED\AppData\Roaming\WallpaperSSPro\Wallpaper.bmp
11/08/2025 19:16:56 : BuildWallpaper: SetWallpaper Time: 1.38s
11/08/2025 19:16:56 : BuildWallpaper: Exit
11/08/2025 19:16:56 : ChangeWallpaper: Exit

(Process exited 11/08/2025 19:17:01 : Exit Status 0x1 according to Windows Event Viewer)

The only clue might be in the timing, but I don't know enough about what's going on in the background to know if it's significant:

Each block of log entries begins 20 seconds after the end of previous one, which correlates with the 20 second change time, while the Windows Event Viewer shows the crash occurring five seconds after the last log entry. To me this suggests it's related to some sort of unlogged housekeeping at the end of the last change, rather than something going wrong at the start of the next one. But I don't know enough about the internal workings for that to be anything other than a guess.

The only other thing that I thought might be significant is that I'm running another couple of SignalRGB macros that use another third-party tool (github.com/DavisNT/SetScrTimeout) to control the screensaver timeout value depending on whether or not the workstation is locked. When the workstation is locked the timeout is changed to 1 second, and when it's unlocked it's changed to 86400 seconds, effectively ensuring that the screensaver only activates when the machine is locked.

Since Wallpaper Slideshow Pro itself has some hooks into the screensaver functionality to allow for changes from within the Notification icon, I have temporarily disabled the Display Screen Saver related items option under Interface in case this was causing a conflict. This seems like a long shot, but I can't be certain this problem didn't start when I introduced those macros. I'll keep an eye on things, but I suspect this will not make any difference.

I can work around these crashes by changing the action of the process exit detection macro from "alert me" to "re-start the wallpaperss64.exe process" but that feels like a kludge. I'd much rather know why this is happening in the first place.

Is there enough information here to work out what might be happening, or will I need to dig deeper? Is there a more verbose logging option I can enable, or might whatever is happening be outside of the control of Wallpaper Slideshow Pro?

Thanks.

[gpb]

Hello, I am currently out of office so I can't give you a precise answer.
Anyway in the time between the two logs:

BuildWallpaper: Exit
ChangeWallpaper: Exit

WallpaperSS is idle, it processes timers and messages but does nothing meaningful.
It is rather weird it closes without writing anything in the log file since all exceptions have handlers that writes a log and in some cases write a crash dump. It's even more weird that it closes while it is doing nothing. This has never happened before.
Did you take a look at the event viewer ? In the system log all program crashes are recorded, if wallpaperss is crashed there is a log with the execption number and a few more info.

[KevR]

Thanks for the quick response.

I can't find any entries referencing Wallpaper Slideshow Pro in any of the Application, Setup or System logs. I used the Find function to look for WallpaperSS64.exe and also a manual look around the correct timestamp but there was nothing.

The only log to have entries is the Security log which I set up in GPEdit specifically for this purpose. Alas the default log size was far too small so it has erased anything useful from earlier today. I've now set the maximum size to a ridiculously high value in the hope of catching more than one event.

If I exit Wallpaper Slideshow Pro cleanly using the Exit menu option, it generates the following Security log entry:

Code: Select all

A process has exited.

Subject:
	Security ID:		REDACTED\REDACTED
	Account Name:		REDACTED
	Account Domain:		REDACTED
	Logon ID:		0xCDE78

Process Information:
	Process ID:	0x7c28
	Process Name:	C:\Program Files\WallpaperSSPro\WallpaperSS64.exe
	Exit Status:	0x0

From memory I am reasonably sure that the log entry generated by the crash was very similar, with the main difference being the Exit Status which was 0x1 for the crashed process. The Logon ID (which I believe changes on reboot) and the Process ID (which I'm guessing is dynamically allocated by Windows when the process is launched) were also different, but probably irrelevant.

I'm now starting to think it may be something on my system that is shutting down Wallpaper Slideshow Pro's process. For instance SignalRGB shuts down other processes to prevent other lighting and fan control programs from conflicting with it, but it uses a blacklist of specific .exe files so it's hard to imagine how it could get "confused" into closing WallpaperSS64.exe. And even if it did, it would close it immediately not several hours or days after it was launched.

I'll have a think about what else on the system might be closing other processes. Something on the security side maybe, but all I have is Windows Defender.

I'm stumped.

Are there specific circumstances under which Wallpaper Slideshow Pro would exit with an Exit Status of 0x1, or is that more of a general "something went wrong" code? Maybe clutching at straws here.

Thanks again for looking. It is an interesting one to say the least. I wish I could remember exactly when I started seeing it, because it might give me a clue as to where to start looking. But I'm forever making changes to this system, so if it is a third-party program causing it then there could be a long list of suspects.

[KevR]

Well this is embarrassing. Not for the first time, and probably not for the last.

After activating and parsing a whole bunch of new Event Viewer logs I found an errant Task Scheduler task created on April 24th that was running taskkill /f /im wallpaperss64.exe at 19:17 every day, and I just happened to be sitting here at exactly 19:17 today when it fired. That will certainly do it, and you'll notice that's the exact same time from the log I posted yesterday too.

What that task is doing there I'm not sure. I do have other instances of that TaskKill line dotted around the place, in scripts and macros and in Task Scheduler Library subfolders, back from when I was investigating solutions to an earlier problem. But those were all disabled after the ability to manually sort the monitor order was added, and I'd confirmed this through various debugging methods. What I wasn't expecting was to find another instance, hiding in plain sight in the main Task Scheduler root.

I can only assume I put it there during the same investigation and forgot about it. It doesn't have my usual picky formatting and capitalisation in the name or in the commands, so I'm guessing it was meant to be very temporary.

Why was it triggering "randomly"? I can only assume Windows caches the command when the machine is asleep and/or the lock screen is active, and performs the action at the next available opportunity. Coupled with me often not noticing that it had happened before I added all the debugging tools, and suddenly a fixed schedule appears "random" and loosely tied to wake or unlock events.

So it's yet another learning experience for me. It turns out parsing Windows logs is surprisingly more entertaining that I thought it might be (there are some PowerShell commands that are very powerful and much better than the GUI for this) and so it hasn't been a complete waste of time.

Still a bit shameful though.

Until my next embarrassing incident, thank you for helping to look for what turned out to be a PEBCAK. I'll leave this thread here as an amusement, or possibly a warning, to others.

[gpb]

It doesn't matter, these things happen