# Unable to start event viewer/event log service on vista



## aabb (Apr 17, 2009)

Hi all,

i tried loading the eventvwr.msc file from system32 folder directly as well as from the administrator tools, but i get:

"event log service is unavailable. verify that the service is running."

so i try to start the event log service, from the services.msc program;
whenever i try to start windows event log from services i get the message:

"Windows could not start the windows event log service on local computer.
Error 3: The system cannot find the path specified."

how can i specify the path?
or
how can i resolve the problem?

any help would be appreciated please---thanks


----------



## aabb (Apr 17, 2009)

By the way the OS is a Vista Home Prem without SP1. and i have searched this problem extensively, finding no solutions.

If anyone has any advice it would be greatly appreciated.


----------



## usasma (Apr 11, 2009)

Is the SVCHOST.EXE file located in the C:\Windows\System32 folder?
What are the properties of the Windows Event Log service (in services.msc)?

Is this the Path to the executable?: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

What's listed on the dependencies tab?


----------



## aabb (Apr 17, 2009)

_Is the SVCHOST.EXE file located in the C:\Windows\System32 folder?_
----> yes (non capitalised -it doesnt make a diff does it?)

_What are the properties of the Windows Event Log service (in services.msc)?_
--->there are no start parameters, Log On tab greyed out....is there anything else you would like to know?

_Is this the Path to the executable?: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted_
----> yes C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

_What's listed on the dependencies tab? 
_
--->No dependancies. ie the service does not depend on anything
--->sys components: messenger sharing foldeers USN Journal Reader service, Task Scheduler & Windows Event Collector all depend on this service.


----------------
ps. i would like to express an introductory thank you for your attention to my post.


----------



## usasma (Apr 11, 2009)

Caps don't matter in "most" filenames - I was just using that for emphasis.

Have you scanned for viruses? If not, you may be able to get some more expert help over in the malware forums: http://www.techsupportforum.com/f50/

Beyond that, are there any other errors in the System log of Event Viewer? (eventvwr.msc) - BTW you can access a whole bunch of the tools by using compmgmt.msc

Here's one suggested fix that I found:


> How to take ownership:
> 
> Open folder C:\Windows\System32
> Rightclick folder "LogFiles" - open Properties
> ...


Good luck!


----------



## aabb (Apr 17, 2009)

i have avg internet security - no viruses, spyware etc.

how would i know if there are any errors within the event viewer apart from the ones i named in my initial post? i have already made an sc config scan (i think thats what its called) on command prompt - returning with no errors.

doesnt make a diff if i try accessing event viewer from the compmgmt.msc.

ive seen that fix b4, as far as i can remember it was not for the specific error i have. i tried it anyway - it does not take effect, ie the replace owner tick box is unticked after you restart.

Any other advice from yourself OR ANYBODY ELSE is much appreciated.


----------



## aabb (Apr 17, 2009)

Help anyone?

i need to start the event viewer in order for some applications to work.

as far as i know the Event Log Service is quite important.

In general isnt it quite simple to find a specified path to be executed

also isnt there a common soloution for "error 3" in Windows.

any advice is appreciated.


----------



## joeten (Dec 4, 2008)

hi try here http://www.vistax64.com/general-dis...able-event-viewer-tutorial-already-tried.html post 4


----------



## jenae (Jun 17, 2008)

Hi, go to start run and type regedit navigate to:-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog]

```
"Start"=dword:00000002
```
That is what you should have for event viewer to open.

Now go to start all programs accessories and right click on the command prompt select "run as administrator" at the prompt type:- set..... press enter. Your environment variables will show, under "Path" you should have:-
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem

If things are different post back and we will tell you how to fix.


----------



## aabb (Apr 17, 2009)

firstly thank you for your responses.

joeten, post 4 on that link seems relatively complicated, so i think i'll try it when i have more time and i'll post a reply for you when i do attempt to try it.

jenae, i navigated to your named location on the Regedit program.

i get a table list.

under name: start

under type: REG_DWORD

under Data: 0x00000002 (2).

the path was:
PATH=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;

...BUT, however the path continued to list paths of programs from C:\Program Files\, such as quicktime and other programs i have installed on my system.

is this correct or do you think these other programs are causing any conflict.

thanks for your time, kind regards


----------



## jenae (Jun 17, 2008)

Hi,go to control panel system and select "advanced system settings" then "advanced" select environmental variables delete all under path other then PATH=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;
This is all that should be set for "Path".


----------



## aabb (Apr 17, 2009)

Hi,

i have edited the path to what you said however - no difference

i.e. i still get the same error messages as before.

is there another solution?

Kind regards...


----------



## joeten (Dec 4, 2008)

hi aabb sorry i have been having a little health problem so could not get back to you however your in very good hands with jeanae and usama so work with them iam sure they will be a great help to you


----------



## jenae (Jun 17, 2008)

Hi, event service has no dependencies it does however require Task scheduler and Windows Event Collector.So please check that they are running and set to automatic. Reboot to take effect. What version of Vista do you have I might be able to give you the reg mods (large file) which is why I didn't get you to post yours.BTW to get admin priv go to control panel administrative tools and right click on services select "run as administrator"

Joeten sorry to see you not well, get well soon young fellow. It's Anzac day here today so a big hello to all Vets.


----------



## aabb (Apr 17, 2009)

Hi, sorry i didnt reply earlier joeten, sorry to hear that your not well hope you get well soon, wish you best of health.

@jenae

hi, jenae both task scheduler and windows event collector are already automatic and have already started... but task scheduler is logged on as Local System, while the latter is logged on as Network Service. i have tried starting services.msc with and without admin priv - doesnt make a diff in terms of what i have done up to now. to answer your Q i have Vista H.Prem.thnx

take care


----------



## jenae (Jun 17, 2008)

Hi, start a command prompt with admin priv (run as administrator) at the prompt type:-


```
net localgroup Administrators /add networkservice
press enter then type:
net localgroup Administrators /add localservice
press enter then type:
exit
press enter and restart your computer
```
Then see how you go with services.


----------



## aabb (Apr 17, 2009)

btw:

on services it does say task scheduler has started but when I loaded the task scheduler myself I got some errors:

When I clicked on display all running tasks

I got a message that there was an error in a snap-in and task scheduler will unload it


then this error came up:

*“Unhandled exception in managed code snap-in

Type 'Microsoft.Windows.ManagementUI.CombinedControls.CrimsonException' in assembly 'MIGUIControls, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' is not marked as serializable.

Exception type:

System.Runtime.Serialization.SerializationException

Exception stack trace:

at Microsoft.ManagementConsole.Internal.IMessageClient.ProcessRequest(Request request)
at Microsoft.ManagementConsole.Executive.RequestStatus.BeginRequest(IMessageClient messageClient, RequestInfo requestInfo)
at Microsoft.ManagementConsole.Executive.SnapInRequestOperation.ProcessRequest()
at Microsoft.ManagementConsole.Executive.Operation.OnThreadTransfer(SimpleOperationCallback callback)”*

then I got the task scheduler window with a red x, stop sign;

*“The snap-in performed a non-valid operation and has been unloaded…”*


Also when I loaded the task scheduler program there were no tasks to display. Then I got the message:

*“Task scheduler service is not available. Task scheduler will attempt to reconnect to it.

Task status: reading data failed”
*

just thought this info might be relevent. oh and i did try the command lines...unfortunatley with no success.

take care


----------



## jenae (Jun 17, 2008)

Hi, Ramesh and I wish to see the same thing (ms Forums) 
This is a current default Vista reg entry for EventViewer. Once unzipped, open by right clicking and select "edit" it will open in notepad, do the same for your reg entry and compare or post a zipped version of yours for us.


View attachment 48230


----------



## aabb (Apr 17, 2009)

hi, there is a difference, you can see for yourself.

take care


----------



## jenae (Jun 17, 2008)

Hi, I did not find anything that would cause a problem with your reg entry. MS do not seem to have a definitive response to this one even the 4201 error seems to have a variety of answers, I would send my reg file to Ramesh (knows his stuff) might be something I missed. Have you another account if so boot to it and see if the problem exists there. Also try the default true admin account open a command prompt "run as administrator" and at the prompt type:-


```
Net user administrator /active:yes
```
Press enter Reboot to take effect you will get an option to boot to ADMIN select this, then see if event service is running if so we have a corrupt profile to deal with.. can fix this. 

You might try this resets services to default copy and paste all below into notepad then save as PremiumServ.bat save to desktop right click select "run as administrator" Reboot to take effect (If ADMIN works do not bother with this) post back, I may be slow in response I am away this week.


```
REM  SpeedyVista.com DEFAULT Vista Home Premium Services  
sc boot ok

REM Application Experience
sc config AeLookupSvc start= auto

REM Application Information
sc config Appinfo start= demand

REM Application Layer Gateway Service
sc config ALG start= demand

REM Background Intelligent Transfer Service
sc config BITS start= delayed-auto

REM Base Filtering System
sc config BFE start= auto

REM Certificate Propagation
sc config CertPropSvc start= demand

REM CNG Key Isolation
sc config KeyIso start= demand

REM COM+ Event System
sc config EventSystem start= demand

REM COM+ System Application
sc config COMSysApp start= demand

REM Computer Browser
sc config Browser start= auto

REM Cryptographic Services
sc config CryptSvc start= auto

REM Desktop Window Manager Session Manager
sc config UxSms start= auto

REM DFS Replication
sc config DFSR start= demand

REM DHCP Client
sc config Dhcp start= auto

REM Diagnostic Policy Service
sc config DPS start= auto

REM Diagnostic Service Host
sc config WdiServiceHost start= demand

REM Diagnostic System Host
sc config WdiSystemHost start= demand

REM Distributed Link Tracking Client
sc config TrkWks start= auto

REM Distributed Transaction Coordinator
sc config MSDTC start= demand

REM DNS Client
sc config Dnscache start= auto

REM Extensible Authentication Protocol
sc config EapHost start= demand

REM Function Discovery Provider Host
sc config fdPHost start= demand

REM Function Discovery Resource Publication
sc config FDResPub start= demand

REM Health Key and Certificate Management
sc config hkmsvc start= demand

REM Human Interface Device Access
sc config hidserv start= demand

REM IKE and AuthIP Ipsec Keying Modules
sc config IKEEXT start= auto

REM Interactive Services Detection
sc config UI0Detect start= demand

REM Internet Connection Sharing (ICS)
sc config SharedAccess start= disabled

REM IP Helper
sc config iphlpsvc start= auto

REM IPsec Policy Agent
sc config PolicyAgent start= auto

REM KtmRm for Distributed Transaction Coordinator
sc config KtmRm start= delayed-auto

REM Link-Layer Topology Discovery Mapper
sc config lltdsvc start= demand

REM Microsoft .NET Framework NGEN
sc config clr_optimization_v2.0.50727_32 start= demand

REM Microsoft iSCSI Initiator Service
sc config MSiSCSI start= demand

REM Microsoft Software Shadow Copy Provider
sc config swprv start= demand

REM Multimedia Class Scheduler
sc config MMCSS start= auto

REM Net.Tcp Port Sharing Service
sc config NetTcpPortSharing start= disabled

REM Netlogon
sc config NetLogon start= demand

REM Network Access Protection Agent
sc config napagent start= demand

REM Network Connections
sc config Netman start= demand

REM Network List Service
sc config netprofm start= auto

REM Network Location Awareness
sc config NlaSvc start= auto

REM Network Store Interface Service
sc config nsi start= auto

REM Parental Controls
sc config WPCSvc start= demand

REM Peer Name Resolution Protocol
sc config PNRPsvc start= demand

REM Peer Networking Grouping
sc config p2psvc start= demand

REM Peer Networking Identity Manager
sc config p2pimsvc start= demand

REM Performance Logs & Alerts
sc config pla start= demand

REM PnP-X IP Bus Enumerator
sc config IPBusEnum start= demand

REM PNRP Machine Name Publication Service
sc config PNRPAutoReg start= demand

REM Portable Device Enumerator Service
sc config WPDBusEnum start= auto

REM Print Spooler
sc config Spooler start= auto

REM Problem Reports and Solutions Control Panel Support
sc config wercplsupport start= demand

REM Program Compatibility Assistant Service
sc config PcaSvc start= auto

REM Protected Storage
sc config ProtectedStorage start= demand

REM Quality Windows Audio Video Experience
sc config QWAVE start= demand

REM ReadyBoost
sc config EMDMgmt start= auto

REM Remote Access Auto Connection Manager
sc config RasAuto start= demand

REM Remote Access Connection Manager
sc config RasMan start= demand

REM Remote Procedure Call (RPC) Locator
sc config RpcLocator start= demand

REM Remote Registry
sc config RemoteRegistry start= demand

REM Routing and Remote Access
sc config RemoteAccess start= disabled

REM Secondary Logon
sc config seclogon start= auto

REM Security Accounts Manager
sc config SamSs start= auto

REM Security Center
sc config wscsvc start= delayed-auto

REM Server
sc config LanmanServer start= auto

REM Shell Hardware Detection
sc config ShellHWDetection start= auto

REM SL UI Notification Service
sc config SLUINotify start= demand

REM Smart Card
sc config SCardSvr start= demand

REM Smart Card Removal Policy
sc config SCPolicySvc start= demand

REM SNMP Trap
sc config SNMPTRAP start= demand

REM Software Licensing
sc config slsvc start= auto

REM SSDP Discovery
sc config SSDPSRV start= demand

REM Superfetch
sc config SysMain start= auto

REM System Event Notification Service
sc config SENS start= auto

REM Tablet PC Input Service
sc config TabletInputService start= auto

REM TCP/IP NetBIOS Helper
sc config lmhosts start= auto

REM Telephony
sc config TapiSrv start= demand

REM Terminal Services
sc config TermService start= auto

REM Terminal Services Configuration
sc config SessionEnv start= demand

REM Themes
sc config Themes start= auto

REM Thread Ordering Server
sc config THREADORDER start= demand

REM TPM Base Services
sc config TBS start= demand

REM UPnP Device Host
sc config upnphost start= demand

REM User Profile Service
sc config ProfSvc start= auto

REM Virtual Disk
sc config vds start= demand

REM Volume Shadow Copy
sc config VSS start= demand

REM WebClient
sc config WebClient start= auto

REM Windows Audio
sc config Audiosrv start= auto

REM Windows Audio Endpoint Builder
sc config AudioEndpointBuilder start= auto

REM Windows Backup
sc config SDRSVC start= demand

REM Windows CardSpace
sc config idsvc start= demand

REM Windows Color System
sc config WcsPlugInService start= demand

REM Windows Connect Now - Config Registrar
sc config wcncsvc start= demand

REM Windows Defender
sc config WinDefend start= auto

REM Windows Driver Foundation - User-mode Driver Framework
sc config wudfsvc start= demand

REM Windows Error Reporting Service
sc config WerSvc start= auto

REM Windows Event Collector
sc config Wecsvc start= demand

REM Windows Event Log
sc config Eventlog start= auto

REM Windows Firewall
sc config MpsSvc start= auto

REM Windows Image Acquisition (WIA)
sc config stisvc start= demand

REM Windows Installer
sc config msiserver start= demand

REM Windows Management Instrumentation
sc config Winmgmt start= auto

REM Windows Media Player Network Sharing Service
sc config WMPNetworkSvc start= demand

REM Windows Modules Installer
sc config TrustedInstaller start= demand

REM Windows Presentation Foundation Font Cache 3.0.0.0
sc config FontCache3.0.0.0 start= demand

REM Windows Remote Management (WS-Management)
sc config WinRM start= demand

REM Windows Search
sc config Wsearch start= auto

REM Windows Time
sc config W32Time start= auto

REM Windows Update
sc config wuauserv start= delayed-auto

REM WinHTTP Web Proxy Auto-Discovery Service
sc config WinHttpAutoProxySvc start= demand

REM Wired AutoConfig
sc config dot3svc start= demand

REM WLAN AutoConfig
sc config Wlansvc start= demand

REM WMI Performance Adapter
sc config wmiApSrv start= demand

REM Workstation
sc config LanmanWorkstation start= auto

REM  SpeedyVista.com DEFAULT Vista Home Premium Services
```


----------



## aabb (Apr 17, 2009)

hi,

tried admin login before - no difference.

i thnik i'd rather backup before i try any of the default services option.

at the moment i will need to find a good imaging (maybe iso) software with a high compression + an external drive with enough disk memory - not gona be quick to find...oh well.

take care


----------

