9

After not safely removing a flash drive a few years ago, I lost all of my data on a drive. Luckily I was able to find a data recovery program to restore the data, but it was a time consuming process. Since then I have always practiced safely removing drives, but occasionally get the error that the drive is still in use by a program. The problem has been happening much more frequently on my Win 10 PC the last few months.

The message that the drive is still in use comes up despite not having any applications open, so I started reading up on how to find out what background process is causing the problem. I read a little about the Systeminternals suite and downloaded it, found the logs for the error messages, and the process, which turned out to be the system. I then looked at the thread, and found what I think is the process associated with the problem.

As it turns out, it's the same thing every time I have the problem, regardless of which flash drive the problem occurs with:

"ntoskrnl.exe!SeAccessCheckWithHint+0x1c620"

I know ntoskrnl.exe is the kernel, but I'm trying to find out what the "!SeAccessCheckWithHint+0x1c620" means?

How can I go about finding more information as to what it is doing with my drives to prevent them from being safely ejected? (if the answer is a memory dump, which type, and how would I research the results of it)

How can fix the problem, aside from updates (I've done all of my Windows updates, and driver updates), and aside from restarting the computer each time this happens?

If the problem potentially related to the drive being indexed by the system, will I have to turn indexing off each time I plug the drive in or is there a way to make the system stop indexing all removable drives? Thank you,

JD21763
  • 91
  • 1
  • 2

3 Answers3

11

Task Scheduler:

\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic and \Microsoft\Windows\Defrag

run from background tasks Security and Maintenance - Automatic Maintenance

causes ntoskrnl.exe!SeAccessCheckWithHint+0x1c620

Try to disable defrag on this flash drive.

In my laptop i turned off the RunFullMemoryDiagnostic task because they were using 20% ​​cpu when idle.

chasm
  • 131
  • 1
  • 4
0

From late 2020 I had also been having the "ntoskrnl.exe !SeAccessCheckWith Hint+0x1c620" issue with multiple threads causing the System process to consume 5%-20% of the CPUs all day every day.

After the recent upgrade to Windows 10 21H2 the problem went away. But it came back as "ntoskrnl.exe !SeAccessCheckWith Hint+0x1c790" about 30 minutes later. Same bazillion threads constantly spawning and gobbling up CPU. Grrrrr!

I went back and tried all other suggestions I had tried before: disabling Windows Search service, disabling the Automatic Maintenance Tasks mentioned above, Dism /Online /Cleanup-Image /RestoreHealth etc. etc. Nothing changed.

Several days back I stumbled on a fix that works for me. The System process now hovers between 0%-3% CPU like it used to. All I did was put a CD into the DVD drive. Bizarre.

There was no methodical troubleshooting involved here, I was just tidying my desk and found an unlabelled CD and wondered what was on it. After inserting the CD I saw my Rainmeter CPU graph quickly drop to 1%.

I have had the LG DVD-RAM SATA multi-drive for a long time (since Vista days) and it works just fine although it isn't used very often these days. I have never set the DVD Region because I don't use the drive to play DVDs. My guess is that something changed in how autorun works in Windows 10 20H2, or, the drive has developed a problem sensing when no media is present.

I have been able to reproduce the error by ejecting the CD, opening File Explorer, a few minutes later the System process goes nuts. Put a CD in the drive and a few minutes later the System process idles as normal.

A data CD or audio CD works.

rixtech
  • 9
0

In my case, it turned out to be... corrupt system restore. Turned off and deleted all restore points before turning back on.

I discovered this by watching task manager launch windows system protection just before the SYSTEM CPU usage jump.

ntoskrnl.exe seaccesscheckwithhint+0x1c790 High System after 10 minutes

Next step would have been to delete the systemvolumeinformation folder from winpe.

Col32n
  • 1
  • 1