Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 256 Source: PlugPlayManager

Timed out sending notification of device interface change to window of "<application name>"
From a newsgroup post: "Go into Device Manager -> Ide/atapi controllers. For Primary and Secondary contollers, go to the Advanced Settings tab and for any non-existent devices, change Device Type from Auto to None. Reboot after changing both controllers".

See "JSI Tip 2418" for additional information about this event.
This problem ate me alive for several days. In my case, EventID 256 came after installing W2K SP4 and prevented logon for as much as 30 seconds, also entering 30 warnings in the Application log. The cause of the problem was the SoundBlaster PCI 128 drivers. To fix the problem I rolled back the drivers to the version released on January 5, 2001. If you think you might have the same problem go to the Creative website and download the drivers that were released on January 5, 2001.
See ME842644 for a hotfix applicable to Microsoft Windows 2000.

As per Microsoft: "A window was registered for Plug and Play device event notification, but it did not respond to the notification within 30 seconds. While Windows was waiting for the device to respond, Plug and Play stopped responding, which caused performance problems". See MSW2KDB for more details.

From a newsgroup post: "After I installed ME835732, my computer was hanging at the log-on screen for almost a full minute. This warning started to appear in my event log. Try the following to fix the problem. Go into Device Manager, double-click the 'Secondary IDE Channel -> Advanced Settings', and if Device 0 shows that the 'Current Transfer Mode' is 'Not Available' then change the Device Type to 'None' and  the 'Transfer Mode' to 'PIO Only'. For some reason the ME835732 security patch causes multiple 'Time-Outs' to the 'Plug and Play Manager'. Other users have changed the settings on Device 1 also of the Secondary IDE Channel with apparent success".
This event is typically caused by applications that by design want to be notified when a new device is connected to the system. For example, some graphic-processing applications might want to know when a scanner is attached to the system so they can offer the option to import an image from the scanner. Such applications, register with the Plug and Play Manager (a Windows subsystem) saying basically that "when you detect this type of hardware, let me know". When the hardware is connected (or disconnected), the Plug and Play Manager sends a notification, expecting an answer to confirm that the notification is received. Since the application might be busy, the P&PM waits for up to 30 seconds for the application to respond. After that, it stops waiting and records this event.
Since at boot time, the plug&play is really busy, an application's (could be a service) failure to confirm the notification may cause a (frustrating) delay during the computer startup (the 30 seconds multiplied by the number of applications that do not respond).

So what may cause the applications to behave like this (i.e. not responding)? There could be several reasons:
- software bugs (in the application or in the Plug and Play Manager itself)
- overloaded system - the computer may be too busy for the application to have a chance to respond within the 30 seconds waiting time
- improper detection of the device (caused by faulty hardware or faulty drivers) - may have many unexpected effects on both the Plug and Play Manager and the notified applications

Installing the latest fixes for Windows itself, the applications and the hardware may fix some of the problems. However, in some conditions it has been reported that the latest fixes (ME835732) themselves caused this! This would be explained only if changes introduced by the latest "fix" affected some other components.
I did the following to get rid of those event log entries:
- deactivated IPSEC
- removed Nortel Vital Agent
- reinstalled the Intel Application Accelerator (e.g. IDE device driver) and manually set the transfer mode to (in my case) UDMA 5.
Check ME835732, ME262129, and ME841382 for more information.

Info from Help and Support Centre from XP:
A window was registered for Plug and Play device event notification, but it did not respond to the notification within 30 seconds. While Windows was waiting for the device to respond, Plug and Play stopped responding, which caused performance problems.
User action: If performance problems are associated with this event, close any programs that are running at the same time.
We started to receive this warning after RISing a box. The original box used to create the RIS did not have any errors in its event log. According to Microsoft, the warning means that "an application that registered to receive Plug and Play device interface notification did not respond within 30 seconds of receiving a notification event" according to ME262129.
Right click on the My computer icon, Management, System info, Componant, Device with problem then you have the driver which may cause the problem. Just erase it on the Hardware management tab. Boot up win2k, let plug&play detect the modification, reinstall the driver with the problem (may ask win2k CD), Boot again.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.