Indeed, removing the Intel driver and reinstalling OEM from HP appears to have alieviated the issue. It has not crashed in an hour. Posting it here in the case anyone else sees this or maybe Norton support can learn from it. BIG THANKS to SA for you continued support in helping me track down the problem. You should work in support!
I am running this same version on multiple PCs without the problem so I think it is likely NOT. I have been running insiders for years and only one hit a problem with Norton. In any case... BTW- I have two of the same model HP desktops running and this is the only one having the issue. However, I did key into something you said and am testing the hypothesis. I was running Intel ARC control for my video driver. It does apparently modifly the OEM video driver. That is the only difference between the two systems showing the error. I have uninstalled, and for the moment at least it seems to not have crashed again. I will update back here tomorrow if that resolved the issue (so others will know the problem) Thanks again SA for your help. Better than Norton support ;-)
Windows build is 25295.1000 just happens to be an insider build. That is more likely than not the reason for your Werfault issue. Norton does not support that its products will perform correctly on BETA OS builds.
This a new HP system running 12 gen cpu. I have scanned multiple times and no issue. I have upgraded to the latest version of norton, 22.23.11.12, exact windows build is 25295.1000 . Note I am running this version on multiple other systems with no problem. All OEM drivers are up to date.
Also the key to what is going on appears to be the exception code: Exception code: 0xc0000374. This is caused by heap corruption. What is heap corruption which is a known issue with Windows 11. Make sure ALL your OEM drivers are up to date.
Here is my update with my Windows 11 Home 22H2 machine: NO WERFAULT issues at boot-time.
Before updating the system: Windows is Home 22H2 build 22621.1105 / Norton 360 was version 22.22.11.12
Updated Norton 360 first. There was 1 patch available, which brought the version to 22.23.1.21 with the patch install and reboot. After reboot there were no more updates or patches available. This is the latest N360 version that was presented.
Windows Update run #1 : Installed KB5022404 / KB4023057 / 1 Intel and 2 HP chipset driver updates. Rebooted and the Windows build remained at 22621.1105
Windows Update run #2 : Installed KB5022360 and rebooted. Windows build changed to 22621.1194
Windows Update run #3 : No more update were available, performed a final reboot for good measure.
Performed a manual quicks scan which completed without any issues.
Checked N360 history for any log entries I may not have seen, there aren't any issues recorded.
Checked System Event Viewer logs: NOTHING is logged there
** Throughout the entire process there were no notifications presented or otherwise that are related to WerFault.exe or ntdll.dll
Stumped as I am at the present time, please confirm that you have scanned your system to ensure there isn't any funny business going on under the hood. I also have to ask whether you are running W11 on unsupported hardware as well.
Pardon me for being redundant but what is your exact BUILD in Windows 11? Personally I am behind with updating my Windows 11 machine due to other pressing things going on so I cannot say yeah or neigh as to whether my current builds of Windows and Norton do not have the same issue. I will check this evening for you so we have a comparison.
Have you scanned the computer with other software to ensure you have a clean image?
Since you have removed Norton, did you do so using the R&R tool and doing a "removal only" scenario and a reboot? Then manually search for ALL folders in Windows related to Norton and manually remove them. There will be some left. Restart.
To only remove your Norton device security product, click Advanced Options and then click Remove Only. Pay close attention to step # 5 in the Norton article.
If you are downloading Norton from your account you SHOULD be able to get the latest version of 22.23.1.21. There will be more than one patch, I would restart as each patch is installed before going to the next one. That will complete the patch installation properly vice a reboot when you arrive at the latest version. Lets see if that latest Norton version release corrects this or doesn't.
NOTE that I tried to unload ntdll.dll and replace on several other computers that are working fine with same level of software. Same error at noted above. regsvr32 does not work with windows 11 the way you noted. I also tried in safe mode. Same results.
I am not convinced the module is the problem, rather as you see in the details the norton .exe is causing the crash. See details. I will also note that I completely uninstalled norton.. ran for for a few hours and not a single error in the event logs. I reinstalled Norton and the error has resumed as has the crashing.
Thank you for the suggestions. I had run sfc and dism a month of so ago, with no problems reported. Will do so again. Thank you for the pointer. I will let you know how it goes.
I don't believe Norton is the cause of the crashing but is the after effect of it, ntdll.dll is the faulting module. Have you ran system file checker, sfc/ scannow, to have the OS detect and replace any bad files? Has DISM been performed to check the health of/repair the OS?
Unfortunately I do no think this is a solution for me. I only have a single account used on this system, which is a microsoft live account. This account is the admin account and I do not log in with local account. Any other ideas? I know I need to call support just have not had time to spend hours with them on the phone with no results. It took me almost an hour with support logged on to my system to convince them it was even crashing.. even though it does so right in front of their eyes like 60 seconds after service is restarted. They then said they would raise to level 2 support. I received 2 missed calls over the weekend and they closed our the ticket as unable to reach me. As a former software developer and someone who manages teams of engineers it is sad to see this lack of support. I was hoping this forum was monitored by support.. but apparently not. Again, I appreciate your suggestions.. happy to try other things. It is odd. I disableed windows error reporting and it crashed with nothing listed in the norton history log. Still showed the repeated crashed in MS event viewer. I re-enable error reporting and it started crashing again imediately after the werfault.exe error stating " Unauthorized access blocked" The access is to NortonSecurity.exe. The service does sometimes restart but then crashes again minutes later. It finally stops trying to restart after a half dozen crashed.
Log off ALL APPLICATIONS that are running, IF, there are other users with "local" non-admin accounts logged into the machine also log them off, then log out of Windows and perform a system restart.
Log back in under an admin account that uses a Microsoft account and its credentials. I've seen local admin accounts that do not use MS account logins cause issues that are similar. Log in once with MS credentials and see if there are any local permission issues causing ntdll.dll to crash when the service manager attempts to restart that service and its drivers.
Hi. Yes I am see exactly the problem I posted in the thread being referenced. werfault.ext gets blocked access in the nortorn history log, then norton crashes. Happens every 60 seconds or so.. most times nortorn will not restart on it's own. I posted a thread with lots of snapshots of my problem here -> https://community.norton.com/en/forums/norton-360-constantly-crashing-every-60-seconds-after-blocking-access-werfaultexe#comment-8539113
There are a LOT of crashing events related to norton in the event log (applications). Is that what you are looking for.
Here is another with more details
Log Name: Application
Source: Windows Error Reporting
Date: 1/24/2023 7:23:13 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: Robs-HP-Touch
Description:
Fault bucket 2279045703742407642, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0
These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_NortonSecurity.e_a33d3bd7995d0342e4cc944770c9e1544a1135_ef37af20_122a0059-a9ef-4b66-8505-50603445a279
Hello Stepnup. Have you looked into the system event viewer for any information there regarding werfault.exe being blocked? The information there will be in greater detail and possibly reveal fault bucket info and additional error codes. To access Event Viewer select the keyboard shortcut Win+R, type eventvwr.msc and press the ENTER key. Please take a screenshot of anything you can find in event viewer for us to review. Follow this guide to post screenshots:
Optionally you can disable Windows error reporting in system services then do a restart to see if the issue persists. Werfault.exe is nothing more than Windows error reporting so the error more likely than not is within the windows file system.