This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Cannot start the Windows Event Log service on Local Computer. Error 4201: The instance name passed was not recognized as valid by a WMI data provider.
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
Hi Ramesh,
That did the trick. For the record:
Thank you!
Rung
Hi rung_windows7,
Renaming or deleting the following folder seems to work for some users:
C:\Windows\System32\LogFiles\WMI\RtBackup
REF: Event log error 4201 - ERROR_WMI_INSTANCE_NOT_FOUND (a helluva great thread)
Ramesh Srinivasan, Microsoft MVP [Windows Desktop Experience]
Hello Guys. In some cases like mine, deleting or renaming the RTBackup Folder does not help. I recently read in another german forum (http://www.waldbauer.com/vb/showthread.php?p=7259#post7259), that the problem might persist due the fact of missing registry keys. The solution in this case was importing the missing keys from another machine running eventlog well.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WmiAcpi] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WmiApRpl] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wmiApSrv] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI]
He wrote, that he is unsure which key exactly resolved the eventlog error but maybe someone can go deeper into PROVIDER / GUID namespaces to find out.
Maybe this helps.
Hi ThomasBrunnthaler,
I truly appreciated finding your post this morning, I was using up the last little bit of patience I had on this! I was discouraged reading all of these posts saying this fix worked and thought it HAD to be ME doing something wrong! I am certainly no expert, not even really good at techIE-type stuff, but I am not dumb either, and have enough knowledge to follow simple instructions to type something on a command line or change security attributes for a folder FOR CRYING OUT LOUD! OK, enough about my frustrations; My question for you is this - If you would be so kind as to take the time to help me that is - How do I import the missing registry keys back into the registry? I think I know how, but I know how delicate the registry is, and the damage and headaches a single mistake can cause, so I want to be absolutely sure I do this correctly! Would you mind lending me hand with some step-by-step instructions? I cannot BEGIN to tell how much I would appreciate the help!! Maybe I can, idk, give u something in return?? Something like maybe a movie you want (I own about a billion, most in digital form) or music, a paid smartphone app, something like that?? LOL! I'm telling you, help with fixing this issue would seriously make my day; I NEED it to work like ASAP; I'd be in your debt!!! Thank you so very much!!!
The easy way to fix this problem is to boot the windows dvd and use the repair my computer option. You must remove the hidden attribute, then you can rename it to whatever you like.
The problem was caused by a recent MS update KB2529073, KB2732487, or KB98201`8, don't know which one is responsible. Any program that depends on the windows event log service is affected, like diskkeeper and norton ghost 15.
Hello Guys. In some cases like mine, deleting or renaming the RTBackup Folder does not help. I recently read in another german forum (http://www.waldbauer.com/vb/showthread.php?p=7259#post7259), that the problem might persist due the fact of missing registry keys. The solution in this case was importing the missing keys from another machine running eventlog well.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WmiAcpi] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WmiApRpl] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wmiApSrv] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI]
He wrote, that he is unsure which key exactly resolved the eventlog error but maybe someone can go deeper into PROVIDER / GUID namespaces to find out.
Maybe this helps.
