Event ID 1002: The program … version … stopped interacting with Windows and was closed

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

The program … version … stopped interacting with Windows and was closed.

Event 1002

Application Hang

Application log

Error

An application stopped responding and was closed (by the user or Windows).

What to check: Repeated hangs in the same program point to its add-ins, network paths or antivirus scanning.

Related: 1000

Message and fields (as Event Viewer shows them)

The program … version … stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

The system was unable to convert a saved dump to a minidump.

Event 1002

WER-SystemErrorReporting

System log

Information

Message and fields (as Event Viewer shows them)

The system was unable to convert a saved dump to a minidump.

The shell stopped unexpectedly and … was restarted.

Event 1002

Winlogon

System log

Information

Message and fields (as Event Viewer shows them)

The shell stopped unexpectedly and … was restarted.

The DNS server being queried for interface … has changed to …, client PID

Event 1002

DNS-Client

System log

Information

Message and fields (as Event Viewer shows them)

The DNS server being queried for interface … has changed to …, client PID …

Diagnostic warning event on a Controller on device(Port

Event 1002

StorPort

System log

Warning

Message and fields (as Event Viewer shows them)

Diagnostic warning event on a Controller on device(Port = …).                    
Adapter Guid: …                    
Miniport driver name: …                    
SubsystemId: …                    
ControllerId: …                    
TransportType: …                    
TransportAddress: …                    
ProductId: …                    
Firmware revision: …                    
Description: …

The processing of Group Policy failed because of a system allocation failure.

Event 1002

GroupPolicy

System log

Error

Message and fields (as Event Viewer shows them)

The processing of Group Policy failed because of a system allocation failure. Please ensure the computer is not running low on resources (memory, available disk space). Group Policy processing will be attempted at the next refresh cycle.

The Windows Resource Exhaustion Detector stopped.

Event 1002

Resource-Exhaustion-Detector

System log

Information

Message and fields (as Event Viewer shows them)

The Windows Resource Exhaustion Detector stopped.

… scan has been stopped before completion.

Event 1002

Windows Defender

Windows Defender/Operational log

Warning

Message and fields (as Event Viewer shows them)

… scan has been stopped before completion.
 	Scan ID: …
 	Scan Type: …
 	Scan Parameters: …
  	User: …\…
 	Stop Reason: …

RKF failure - SRV2 failed to get acknowledgement from Resume Key filter for persistent handle request.

Event 1002

SMBServer

SMBServer/Operational log

Error

Message and fields (as Event Viewer shows them)

RKF failure - SRV2 failed to get acknowledgement from Resume Key filter for persistent handle request.