Cannot start windows event log service on Windows 7. Error 4201.__

Anonymous
2009-11-15T05:12:47+00:00

Cannot start the Windows Event Log service on Local Computer.  Error 4201: The instance name passed was not recognized as valid by a WMI data provider.

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2009-11-15T15:54:26+00:00

Hi Ramesh,

That did the trick.  For the record:

  1. Used msconfig to switch to safe mode boot
  2. Booted to safe mode
  3. ran cmd.exe as an administrator
  4. typed "cd C:\Windows\System32\LogFiles\WMI"
  5. typed "rename RtBackup RtBackup2"
  6. Used msconfig to switch to normal boot mode
  7. Reboot and found event viewer working

Thank you! 

Rung

Was this answer helpful?

40+ people found this answer helpful.
0 comments
Answer accepted by question author
Ramesh 181.7K Reputation points Volunteer Moderator
2009-11-15T06:53:44+00:00

Hi rung_windows7,

Renaming or deleting the following folder seems to work for some users:

C:\Windows\System32\LogFiles\WMI\RtBackup

REF: Event log error 4201 - ERROR_WMI_INSTANCE_NOT_FOUND (a helluva great thread)

Ramesh Srinivasan, Microsoft MVP [Windows Desktop Experience]

Was this answer helpful?

3 people found this answer helpful.
0 comments

60 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Ramesh 181.7K Reputation points Volunteer Moderator
    2009-11-15T15:56:32+00:00

    Hi Ramesh,

    That did the trick.  For the record:

    1. Used msconfig to switch to safe mode boot
    2. Booted to safe mode
    3. ran cmd.exe as an administrator
    4. typed "cd C:\Windows\System32\LogFiles\WMI"
    5. typed "rename RtBackup RtBackup2"
    6. Used msconfig to switch to normal boot mode
    7. Reboot and found event viewer working

    Thank you! 

    Rung

    Excellent! Thanks for the update, Rung :-)

    Ramesh Srinivasan, Microsoft MVP [Windows Desktop Experience]

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2010-02-14T07:02:58+00:00

    Unbelivable I worked on this problem all day today and deleting the above file describe fixed my problem.

    How anyone fiigured out how to do this is simply amazing

    Thanks Ramesh

    Bill

    Was this answer helpful?

    0 comments
  3. Anonymous
    2010-05-27T18:52:27+00:00

    Hi Ramesh,

    That did the trick.  For the record:

    1. Used msconfig to switch to safe mode boot
    2. Booted to safe mode
    3. ran cmd.exe as an administrator
    4. typed "cd C:\Windows\System32\LogFiles\WMI"
    5. typed "rename RtBackup RtBackup2"
    6. Used msconfig to switch to normal boot mode
    7. Reboot and found event viewer working

    Thank you! 

    Rung

    Excellent! Thanks for the update, Rung :-)

    Ramesh Srinivasan, Microsoft MVP [Windows Desktop Experience]

    I would like to try this, however when I am started in Minimal Safe Mode I am not allowed to change the name of the folder.

    From the command line prompt I get back "Access is denied."

    If I browse in to the directory the folder shows locked and when I try to rename it I get the message

    "The action can't be completed because the folder or file in it is open in another program. Close the folder or file and try again."

    With buttons of "Try Again" and "Cancel".

    I tried again a couple of times and I get the same message.

    I did close the cmd window before attempting the browse method.

    I am the only user of the PC and used the only password to get in that I have ever put in the PC.

    Running Windows 7 Home Premium on this Toshiba Satellite A505.

    Any further suggestions?

    Thanks for reading.

    Was this answer helpful?

    0 comments