From: rscohen on

This event occurs just after a network card attempts to wake or has
recovered from an interruption. You may see Information events that
relate to the NIC vendor as well as Userenv errors. I recommend turning
off all power management features either in the bios or user power
settings to determine if the errors go away. If this only occurs during
a reboot/cold boot then the NIC is probably not ready for connectivity
(hence the connections to COMSVCS.DLL). To validate this use a wire
sniffing tool to remotely watch the suspect computer. Once the sniffing
tool has recorded the connection by the suspect computer you can compare
the times and see that the event 4356 came a second or two before the
sniffing tool recorded the connection.

rscohen's Profile:
View this thread: