Phantom mac address triggered upon Windows 10 boot with Event Log Service enabled

JDubbedNJDubbedN Member, Beta Tester Posts: 11
Name Dropper First Comment Photogenic
edited March 1 in Fingbox
My Fingbox is notifying me of a new mac address that joins my network every time I reboot my Windows 10 computer and it only happens when the Windows Event Log service is started. And the mac address goes offline shortly after it comes online. If I disable the Windows 10 Event Log service and reboot I no longer receive the random mac address. I can replicate this problem every time.

I noticed the problem when I upgraded my Windows 10 computer from version 1809 to 1903. And the problem continued to happen with Windows 1909. It would appear that in the way that the Windows 10 Event Log service works, my Fingbox is seeing this randomly generated mac address. And I am not sure why. And to get even more weird this only happens on a hardwire connection. It does not happen on a wireless connection, which would have made more sense since at one point in time Windows 10 had the mac access randomization feature but only for wireless. But the problem happens only on a wired ethernet connection. And if I install another NIC it happens on that NIC too. I have other Windows 10 machines on my network that does not seem to cause this issue. I've done the following...

1. Repair installed the OS
2. Performed DISM /Online /Cleanup-Image /RestoreHealth
3. sfc /scannow
4. Compared the random mac address with the mac address's of my NIC and they never match
5. Tried a different NIC
6. Tested a wireless USB adapter and the problem doesn't happen on wireless. Only hardwired.
7. If I disable the Windows 10 Event Log service the problem goes away. But as soon as I add it back the problem comes back.
8. I can disable the NIC, reboot, and then re-enable the NIC while on the desktop and the problem doesn't happen. So it would appear the problem is triggered only once during boot.

The only thing I have not tried is a complete OS reinstall but it would takes weeks for me to re-personalize my computer and put everything back the way it was. And since this is more of a nuisance and not a serious issue an OS reinstall is not necessary.

Any suggestions?

Answers

  • MarcMarc Moderator, Beta Tester Posts: 1,370
    100 Answers 1000 Comments 500 Likes 100 Awesomes
    ✭✭✭✭✭✭
    Hey @JDubbedN , lets see if one of the forum folks can help out.  @Robin, @Pixelpopper, @rootedor @Ciaran , care to take a stab at this?
    Thats Daphnee, she's a good dog...
  • PixelpopperPixelpopper Moderator Posts: 129
    100 Comments 25 Likes First Anniversary Member of the Month
    ✭✭✭

    @Robin & @Ciaran - this really needs to go to tech support as @JDubbedN

    has done pretty much everything he can do. There’s obviously a spurious condition being detected but why is a matter for tech support.

  • CiaranCiaran Administrator Posts: 855
    500 Comments 25 Answers 100 Likes 25 Agrees
    admin
    Hi @JDubbedN, we will send you a private message to further troubleshoot, as we will need more information off of you (e.g. e-mail, MAC, network conditions etc.) Thanks
    Ciaran (Admin at Fing)
    Getting Started? Please refer to Community guidelines & Community User Guides("Helping Hand"). HAPPY POSTING!!!
    Pixelpopper
  • PixelpopperPixelpopper Moderator Posts: 129
    100 Comments 25 Likes First Anniversary Member of the Month
    ✭✭✭

    Hi @Ciaran i received a PM was I copied in or did it go to the wrong person?

  • CiaranCiaran Administrator Posts: 855
    500 Comments 25 Answers 100 Likes 25 Agrees
    admin
    Nope, disregard, I initially sent the message to you. I have now deleted that and sent a seperate message to @JDubbedN. Thanks for confirming, always best to check these things :smile:
    Ciaran (Admin at Fing)
    Getting Started? Please refer to Community guidelines & Community User Guides("Helping Hand"). HAPPY POSTING!!!
  • JDubbedNJDubbedN Member, Beta Tester Posts: 11
    Name Dropper First Comment Photogenic
    @Ciaran I have not received your PM. Could you please resend?
  • JDubbedNJDubbedN Member, Beta Tester Posts: 11
    Name Dropper First Comment Photogenic

    @Ciaran I still have not received a direct message from you asking additional details that are needed for further diagnosing. Please resend.

  • CiaranCiaran Administrator Posts: 855
    500 Comments 25 Answers 100 Likes 25 Agrees
    admin
    Hi @JDubbedN, a private mail was sent to the e-mail address associated with this account on the 5th March. 3 further reminder e-mails were also sent. As there was no response, the support ticket auto closed. I have now re-opened the ticket and sent it again. Can you please check you e-mail account to confirm that you have received these? (if not please check your spam queue in case it has gone in there) Thanks
    Ciaran (Admin at Fing)
    Getting Started? Please refer to Community guidelines & Community User Guides("Helping Hand"). HAPPY POSTING!!!
Sign In or Register to comment.