Windows Event ID 26 – Application Popup: System Process Terminated Unexpectedly

Start by examining the specific details of Event ID 26 to understand which process terminated and under what circumstances.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter for Event ID 26 by right-clicking the System log and selecting Filter Current Log
4. Enter 26 in the Event IDs field and click OK
5. Double-click the most recent Event ID 26 entry to view detailed information
6. Note the process name, PID, exit code, and timestamp from the event description
7. Use PowerShell to gather additional context about recent system events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=26} -MaxEvents 10 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

# Check for related critical events in the same timeframe
Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2,3} -MaxEvents 50 | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-24)} | Format-Table TimeCreated, Id, LevelDisplayName, ProviderName

Document the process name and any error codes for further investigation in subsequent methods.

Verify that critical system files are intact and Windows components are functioning correctly.

1. Open an elevated Command Prompt by pressing Win + X and selecting Windows Terminal (Admin)
2. Run System File Checker to scan for corrupted system files:

sfc /scannow

3. If SFC finds issues, run DISM to repair the Windows image:

DISM /Online /Cleanup-Image /RestoreHealth

4. Check Windows component health using PowerShell:

# Check Windows Update health
Get-WindowsUpdateLog

# Verify critical services are running
Get-Service | Where-Object {$_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'} | Format-Table Name, Status, StartType

# Check for pending reboots
if (Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired" -ErrorAction SilentlyContinue) {
    Write-Host "Pending reboot required for Windows Updates" -ForegroundColor Yellow
}

5. Review the CBS.log file for detailed information about system file repairs:

Get-Content C:\Windows\Logs\CBS\CBS.log | Select-String "error|corrupt|fail" | Select-Object -Last 20

Examine hardware stability and driver conflicts that could cause critical process termination.

1. Check system stability using Windows Memory Diagnostic:

mdsched.exe

Schedule a memory test for the next reboot and restart the system.

2. After the memory test, check results in Event Viewer under Windows Logs → System, filtering for Source: MemoryDiagnostics-Results
3. Examine recent driver installations and updates:

# Check for recently installed drivers
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-PnP'} -MaxEvents 50 | Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-7)} | Format-Table TimeCreated, Id, Message -Wrap

# List all installed drivers with dates
Get-WindowsDriver -Online | Sort-Object Date -Descending | Select-Object -First 20 | Format-Table ProviderName, ClassName, DriverVersion, Date

4. Check Device Manager for problematic devices:

# Get devices with problems
Get-PnpDevice | Where-Object {$_.Status -ne 'OK'} | Format-Table FriendlyName, Status, InstanceId

5. Review hardware error logs:

# Check for hardware errors
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Processor-Power','Microsoft-Windows-Kernel-General'} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Examine crash dumps and Windows Error Reporting data to identify the root cause of process termination.

1. Check if Windows Error Reporting has captured crash dumps:

# Check WER report locations
$WERPath = "$env:LOCALAPPDATA\Microsoft\Windows\WER\ReportQueue"
Get-ChildItem $WERPath -Recurse | Where-Object {$_.Name -like "*.dmp"} | Sort-Object LastWriteTime -Descending | Select-Object -First 10 | Format-Table Name, LastWriteTime, Length

2. Configure system to create full memory dumps for critical process failures:

# Enable full memory dumps (requires restart)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "CrashDumpEnabled" -Value 1
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "DumpFile" -Value "C:\Windows\MEMORY.DMP"

3. Check Windows Error Reporting settings and recent reports:

# View WER configuration
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting" | Format-List

# Check recent error reports
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Windows Error Reporting'} -MaxEvents 20 | Format-Table TimeCreated, Id, Message -Wrap

4. Use Process Monitor to capture real-time process activity:

Download and run Process Monitor (ProcMon) from Microsoft Sysinternals to capture detailed process and file system activity during the time when Event ID 26 occurs.

5. Enable advanced logging for the specific process that's terminating:

# Enable process tracking in audit policy
auditpol /set /subcategory:"Process Termination" /success:enable /failure:enable

# Check process termination events
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4689} -MaxEvents 20 | Format-Table TimeCreated, Message -Wrap

Implement comprehensive system recovery measures and establish monitoring to prevent future occurrences.

1. Create a system restore point before making changes:

# Create restore point
Checkpoint-Computer -Description "Before Event ID 26 Investigation" -RestorePointType "MODIFY_SETTINGS"

2. Reset Windows Error Reporting and related services:

# Stop and restart WER service
Stop-Service -Name "WerSvc" -Force
Start-Service -Name "WerSvc"

# Clear WER report queue
Remove-Item "$env:LOCALAPPDATA\Microsoft\Windows\WER\ReportQueue\*" -Recurse -Force -ErrorAction SilentlyContinue

# Reset Application Experience service
Restart-Service -Name "AeLookupSvc" -Force

3. Configure enhanced monitoring and alerting:

# Create scheduled task to monitor for Event ID 26
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Get-WinEvent -FilterHashtable @{LogName='System'; Id=26} -MaxEvents 1 | Out-File C:\Logs\Event26Alert.log -Append"
$Trigger = New-ScheduledTaskTrigger -AtStartup
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "Event26Monitor" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

4. Implement system hardening measures:

# Enable DEP for all programs
bcdedit /set nx AlwaysOn

# Configure automatic restart settings
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "AutoReboot" -Value 0

# Enable boot logging
bcdedit /set bootlog yes

5. Set up comprehensive logging and establish baseline monitoring:

# Increase system log size
Limit-EventLog -LogName System -MaximumSize 100MB -OverflowAction OverwriteAsNeeded

# Enable additional audit policies
auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable

# Create monitoring script
$MonitorScript = @"
Get-WinEvent -FilterHashtable @{LogName='System'; Id=26; StartTime=(Get-Date).AddHours(-1)} -ErrorAction SilentlyContinue | 
ForEach-Object {
    Send-MailMessage -To 'admin@company.com' -From 'server@company.com' -Subject 'Critical: Event ID 26 Detected' -Body `$_.Message -SmtpServer 'mail.company.com'
}
"@
$MonitorScript | Out-File C:\Scripts\Event26Monitor.ps1