Cannot start windows event log service on Windows 7. Error 4201.__

Anonymous
2009-11-15T05:12:47+00:00

Cannot start the Windows Event Log service on Local Computer.  Error 4201: The instance name passed was not recognized as valid by a WMI data provider.

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2009-11-15T15:54:26+00:00

Hi Ramesh,

That did the trick.  For the record:

  1. Used msconfig to switch to safe mode boot
  2. Booted to safe mode
  3. ran cmd.exe as an administrator
  4. typed "cd C:\Windows\System32\LogFiles\WMI"
  5. typed "rename RtBackup RtBackup2"
  6. Used msconfig to switch to normal boot mode
  7. Reboot and found event viewer working

Thank you! 

Rung

Was this answer helpful?

40+ people found this answer helpful.
0 comments
Answer accepted by question author
Ramesh 181.7K Reputation points Volunteer Moderator
2009-11-15T06:53:44+00:00

Hi rung_windows7,

Renaming or deleting the following folder seems to work for some users:

C:\Windows\System32\LogFiles\WMI\RtBackup

REF: Event log error 4201 - ERROR_WMI_INSTANCE_NOT_FOUND (a helluva great thread)

Ramesh Srinivasan, Microsoft MVP [Windows Desktop Experience]

Was this answer helpful?

3 people found this answer helpful.
0 comments

60 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ramesh 181.7K Reputation points Volunteer Moderator
    2012-06-06T14:30:17+00:00

    The fix was a little tougher in my case.   I tried all the fixes above, but eventually had to:

    1. Boot in Safe Mode.
    2. Open Windows Explorer.
    3. Go to .\WMI folder.
    4. Right click, "Properties, Security".
    5. Added myself as a user.  (Note: I was already an Admin, so I don't know why this was necessary).
    6. Turned on all rights and saved it.
    7. Ran .\System32\cmd.exe as Administrator.
    8. Removed attributes from *.etl files, as shown in other posts above.
    9. Back in Windows Explorer, I was finally able to rename the RtBackup to RtBackup2.

    What a pain.

     

    I reset the SafeMode using msconfig, and rebooted.

     

    Now SQL Server Agent works, my Maintenance Plans work, and all due to this fix.

    Thanks for the update, johnbaerg. Hope this additional information helps others.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2012-06-06T12:35:48+00:00

    I cannot believe how many problems are solved with this fix.   Thanks so much Ramesh.

    My SQL Server Agent wouldn't start.   I tracked it down to the Event Log service not starting, which led me to your post.

    The fix was a little tougher in my case.   I tried all the fixes above, but eventually had to:

    1. Boot in Safe Mode.
    2. Open Windows Explorer.
    3. Go to .\WMI folder.
    4. Right click, "Properties, Security".
    5. Added myself as a user.  (Note: I was already an Admin, so I don't know why this was necessary).
    6. Turned on all rights and saved it.
    7. Ran .\System32\cmd.exe as Administrator.
    8. Removed attributes from *.etl files, as shown in other posts above.
    9. Back in Windows Explorer, I was finally able to rename the RtBackup to RtBackup2.

    What a pain.

    I reset the SafeMode using msconfig, and rebooted.

    Now SQL Server Agent works, my Maintenance Plans work, and all due to this fix.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2012-05-09T07:52:14+00:00

    I know this is an old thread, but this seems to be the only place that talks about this error. I was finally able to rename/delete the directory only after using Unlocker. Before that, anything I tried resulted in "Access is denied". The directory keeps coming back and the Event Log Service WILL NOT START! There are programs I need to install that will not install until the service starts. I've tried all the answers here in safe mode and out of safe mode to no avail. Any other suggestions? greatly appreciated

    Was this answer helpful?

    0 comments