Windows 10 Pro
Version: 1607 14939.693

The previous system shutdown at 12:02:30 on ‎01/‎03/‎2017 was unexpected.

The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Keywords: 0x8000400000000002

You have a usb hard drive pluged in?

>>3 Yes a USB Stick and the other time a 2TB USB 3 drive.

Warning 02/03/2017 19:55:58 Wininit 11 None
Event ID: 11
Task Category: None
Level: Warning
Description: Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.

Found that mbamchameleon is spamming Event Viewer with 100s of hits per hour so I uninstalled malwarebyte for the time being.

Right I think I found something here:

Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 02/03/2017 20:31:19
Event ID: 10016
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: DESKTOP
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Open Regedit as Administrator
Navigate to HKEY_CLASSES_ROOT > APPID > {F72671A9-012C-4725-9D2F-2A4D32D65169}
Right-click on it and select "Permissions..."
In the “Permissions for {F7267. . . “ dialog, click the "Advanced" button
At the top, look for "Owner" and click the "Change" link near "TrustedInstaller" Note the current owner is “TrustedInstaller”
In the Select User or Group dialog box type "Administrators" and click the "Check Names" link (it converts the name to the correct format)
Select "Administrators" in the list and check the "Allow" checkbox for "Full Control"
Click the “OK” button to return to the Regedit dialog
Navigate to HKEY_CLASSES_ROOT > CLSID > {8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
Repeat steps 3 through 9 to change ownership of the CLSID from System to Administrators
After completing the above steps you (as an Administrator) now have the ability to edit the permissions for these two keys
Open Component Services (Start-search for, or run “dcomcnfg”)
Browse to Console Root > Component Services > Computers > My Computer > DCOM Config
Find "{F72671A9-012C-4725-9D2F-2A4D32D65169}" from the Application Name list – near the bottom, right-click on it and select "Properties"
Navigate to the "Security" tab and click the "Edit" button in the "Launch and Activation Permissions" section. If the Edit button is grayed out, then review/redo steps 1 – 11.
In the “Launch and Activation Permission” dialog add the missing user, System.
Click the "Add" button
Type in "SYSTEM", the User that does not have “Local Activation” permissions as per the Event ID 10016 Description from Event Viewer. Next click the "Check Names" button
Click the "OK" button to return to the "Launch and Activation Permission" dialogue
Select "SYSTEM" from the "Group or user names" list, and click to place a check in the "Local Activation"/"Allow" check box
Click the "OK" button
Back in the "Security" tab, click "OK", then close the Component Services tool
Back in Regedit rework the previous steps to revert ownership of the APPID, {F72671A9-012C-4725-9D2F-2A4D32D65169} , to TrustedInstaller, and the CLSID, {8D8F4F83-3594-4F07-8369-FC3C3CAE4919}, to System
You will be required to type "NT SERVICE\TrustedInstaller" (without quotes) in the dialogue box mentioned above at step 6, and click the "OK" button
Close all windows and exit Regedit
Reboot