Jim Guckin

Question:

I have a Windows Server 2008 64Bit Standard and I am having problems getting the Event Viewer to display on the server.   When I click on the Event Viewer, I get the following Error Message – Event Log Service is unavailable. Verify that the service is running. I went into the Windows services and tried to start “Windows Event Log” service and then get the following error:  Error Message – Windows could not start the Windows Event log service on (Server Name). Error 4201: The Instance name passed was not recognized as valid by a WMI data provider. Any idea on how to fix it?

Jeffrey Gaston
Corpus Christi, TX

Answer:

This problem can be caused by a permissions issue to the: C:\Windows\System32\LogFiles\WMI\RtBackup directory. The SYSTEM group needs full control permissions for the directory.  Here are some steps on how to fix the problem.

1. Start Windows in Safe mode.
2. Open the “C:\Windows\System32\LogFiles\WMI” folder.
3. Right-click on the RtBackup folder and choose Properties.
4. Click the Security tab, and click the Edit button.
5. Click Add, type SYSTEM and click OK button.
6. On the “Full control” Permission select “Allow”.
7. Click OK, and then click “Yes” button when asked for confirmation
8. Restart Windows (in Normal mode), and verify if the Windows Event Service has started.