Cannot start windows event log service on Windows 7. Error 4201.__

Anonymous
2009-11-15T05:12:47+00:00

Cannot start the Windows Event Log service on Local Computer.  Error 4201: The instance name passed was not recognized as valid by a WMI data provider.

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2009-11-15T15:54:26+00:00

Hi Ramesh,

That did the trick.  For the record:

  1. Used msconfig to switch to safe mode boot
  2. Booted to safe mode
  3. ran cmd.exe as an administrator
  4. typed "cd C:\Windows\System32\LogFiles\WMI"
  5. typed "rename RtBackup RtBackup2"
  6. Used msconfig to switch to normal boot mode
  7. Reboot and found event viewer working

Thank you! 

Rung

Was this answer helpful?

40+ people found this answer helpful.
0 comments
Answer accepted by question author
Ramesh 181.7K Reputation points Volunteer Moderator
2009-11-15T06:53:44+00:00

Hi rung_windows7,

Renaming or deleting the following folder seems to work for some users:

C:\Windows\System32\LogFiles\WMI\RtBackup

REF: Event log error 4201 - ERROR_WMI_INSTANCE_NOT_FOUND (a helluva great thread)

Ramesh Srinivasan, Microsoft MVP [Windows Desktop Experience]

Was this answer helpful?

3 people found this answer helpful.
0 comments

60 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2012-04-02T18:21:24+00:00

    I tried various fixes that just wouldn't work from various sources... creating .cmd files from .txt files, reboot in safe mode, ... for months. The whole issue starts when you try to beat the Microsoft UAC system. If you take control of your folders you loose control of this RtBackup folder and Windows may or may not let you make changes at that point. Just follow the directions below and it should fix it.

    Here's the simple answer that worked for me:

    1. Navigate to C:\Windows\System32\LogFiles\WMI\RtBackup
    2. Right-click on RtBackup and select Properties > Security
    3. In the list of “Group or user names” is “SYSTEM” listed?
    4. If not, click Edit > Add . . . and type in “SYSTEM” in the dialog box and click OK.
    5. Restart your computer
    1. Yes, SYSTEM is always there. And I've never tried to beat UAC. I've also never seen this problem affect VPN *and* Event Viewer, just VPN. So go figure. The only solution for me is deleting the contents of RtBackup in safe mode.

    I'd like to know the real cause and also see MS put out a hotfix.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2012-04-25T13:44:23+00:00

    Gentlemen,

    First, I want to thank everyone for sharing your knowledge and expertise with the rest of us.

    I had the very same issue with Windows server 2008 and was not able to rename the RtBackup folder. After trying all I could to follow on the suggestions here, and kept getting Access denied, I tried something else and it worked. From Windows Safe Mode, under the Administrator account, I took ownership of the WMI directory. That game me access to RtBackup. At this point Windows still won't allow you to rename it, but you can delete the contents, which I did. Rebooted the server and, BOOM DagGammit, it worked.

    One more thing I would like to add is that what original issue was that CiscoWorks LMS 4.o just quit working. Of course, one of the first things to do is to check the Event viewer which was not available. By rectifying the Event Viewer issue, it also fixed the Cisco LMS problem. Not sure what the correlation is, but I am determined to find out. If anyone knows why, I would appreciate if you could share your thoughts.

    Thanks!

    Sam

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  3. Anonymous
    2012-05-09T07:52:14+00:00

    I know this is an old thread, but this seems to be the only place that talks about this error. I was finally able to rename/delete the directory only after using Unlocker. Before that, anything I tried resulted in "Access is denied". The directory keeps coming back and the Event Log Service WILL NOT START! There are programs I need to install that will not install until the service starts. I've tried all the answers here in safe mode and out of safe mode to no avail. Any other suggestions? greatly appreciated

    Was this answer helpful?

    0 comments