Не удалось запустить службу журнал событий windows ошибка 4201

• Remove From My Forums

Answers

• I figured it out.

  I didn’t have the Permissions or the Auditing set correctly.

  • Marked as answer by
    Nick FV
    Wednesday, June 10, 2009 5:04 AM

All replies

• I forgot to mention that in trying to delete some .jpg files in the WindowsWeb directory I wound up taking ownership of the subfolders in order to successfully delete them.

  I can’t think of anything else that could have resulted in that Event Log/WMI error.   All I have installed is Win 7 x64, the regular Windows Updates and some other recommended updates (drivers for my VGA, NIC, HID, TV tuner…I think that’s it).  All were done via the Windows Update program.

  I don’t think it was any of the many settings that I made via the MMC/Local Computer Policy.  Most of the changes were for Internet Explorer.  Made some minor settings for Windows Explorer, Windows Installer, Windows Messenger, etc…

  Any advice would be greatly appreciated.

• I figured it out.

  I didn’t have the Permissions or the Auditing set correctly.

  • Marked as answer by
    Nick FV
    Wednesday, June 10, 2009 5:04 AM

• Can you clarify what exactly you did to solve this? Where did you not have Permissions and Auditing set correctly? How did you set them?

  I’m having the same problem. Thanks in advance.

• Ya, I’m having the same thing happen. Just started after running the final release of Win 7 now for about 6 weeks. I had also changed permissions to get some things to work so that could be it. Could you give some direction on what you did to rectify?

• I know this is an old thread but it took me weeks to find my solution to starting the EventLog service with the same error message, here goes:

  The renaming or deleting or changing the permissions of RtBackup  did not fix this error for me,, after many weeks of testing and poking I found my solution , and I hope it helps others who haven’t found a fix
  yet.

  • Open the Registry and Navigate to:

  HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlWMIAutoLogger

  • Under this key are 3 EventLog- keys, each one has a DWORD(32) value called LogFileMode, if these aren’t set correctly it causes the EventLog to fail to start with the 4201 Error. Here are the correct settings for each key…

  EventLog-ApplicationLogFileMode — value should be 11000180 (Hex)
  EventLog-SecurityLogFileMode — value should be 100001c0 (Hex)
  EventLog-SystemLogFileMode — value should be 10000180 (Hex)

  Now reboot the PC and see if the eventlog service now starts

  Good Luck

• Could you explain a little further how you solved it ?

  Because I am experiencing the same error message.

  ---

  Luis Olías.

• This post just saved my day!

  Thank you.

• I had the same issue on my Windows 10 machine. Tried to rename RtBackup
  folder but always failed with error saying another program is using file in the folder.

  I checked the registry key [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlWMIAutologgerEventLog-System], unlike the [EventLog-Application] and [Eventlog-Security], there was no registry values under [EventLog-System] root path.

  So I exported the key values from another Windows 10 machine and imported it, then after reboot.Ta-Dah!!! 

  Here the registry values I used to fix the problem. It might not work for you so make sure you back up original registry key before importing it.

  Windows Registry Editor Version 5.00

  [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlWMIAutologgerEventLog-System]
  «Start»=dword:00000001
  «BufferSize»=dword:00000040
  «MinimumBuffers»=dword:00000000
  «MaximumBuffers»=dword:00000010
  «FlushTimer»=dword:00000001
  «Age»=dword:00000001
  «LogFileMode»=dword:10000180
  «ClockType»=dword:00000002
  «Guid»=»{fa5ae656-8e4a-ac95-0980-4eb8342436d8}»
  «OwningChannel»=»System»
  «Status»=dword:00000000

  — Frank Tao

• One of the possible SOLUTIONs, and the most simple is:

  hlmSYSTEMCurrentControlSetControlWMIAutologgerEventLog-ApplicationStart   0 -> 1.

  hlmSYSTEMCurrentControlSetControlWMIAutologgerEventLog-SecurityStart   0 -> 1.
  

  hlmSYSTEMCurrentControlSetControlWMIAutologgerEventLog-SystemStart   0 -> 1.

  You can provoke this error and solve it by changing Start 0 <-> 1 as many times as you like.

  tip   —    EventLog-SecurityStart   —   is not required like other two, and without it eventViewer will be partially enabled. Event viewer will work, but will report that component   EventLog-Security  
  can not be recognized by wmi 4201.

  The CAUSE   —   After looking Performance Monitor, i have noticed that some events are being recorded realtime. [Data Collector SetsEvent Trace Sessions]. Why would I want these events to be recorded and my computer slowed down ? So
  i have disabled them, and that has changed the above Start values.

  other things   —   that rtBackup folder is just buffer for realTime events that are being collected. If you look at Performance Monitor data can be collected in 4 different modes: [file,  realTime,  file and realTime, buffered].
  Event trace sessions:  EventLog-Application, EventLog-System are realTime.

  • Edited by
    Marko279
    Saturday, December 7, 2019 4:45 PM
  • Proposed as answer by
    Marko279
    Saturday, December 7, 2019 4:55 PM

• Remove From My Forums

Answers

• I figured it out.

  I didn’t have the Permissions or the Auditing set correctly.

  • Marked as answer by
    Nick FV
    Wednesday, June 10, 2009 5:04 AM

All replies

• I forgot to mention that in trying to delete some .jpg files in the WindowsWeb directory I wound up taking ownership of the subfolders in order to successfully delete them.

  I can’t think of anything else that could have resulted in that Event Log/WMI error.   All I have installed is Win 7 x64, the regular Windows Updates and some other recommended updates (drivers for my VGA, NIC, HID, TV tuner…I think that’s it).  All were done via the Windows Update program.

  I don’t think it was any of the many settings that I made via the MMC/Local Computer Policy.  Most of the changes were for Internet Explorer.  Made some minor settings for Windows Explorer, Windows Installer, Windows Messenger, etc…

  Any advice would be greatly appreciated.

• I figured it out.

  I didn’t have the Permissions or the Auditing set correctly.

  • Marked as answer by
    Nick FV
    Wednesday, June 10, 2009 5:04 AM

• Can you clarify what exactly you did to solve this? Where did you not have Permissions and Auditing set correctly? How did you set them?

  I’m having the same problem. Thanks in advance.

• Ya, I’m having the same thing happen. Just started after running the final release of Win 7 now for about 6 weeks. I had also changed permissions to get some things to work so that could be it. Could you give some direction on what you did to rectify?

• I know this is an old thread but it took me weeks to find my solution to starting the EventLog service with the same error message, here goes:

  The renaming or deleting or changing the permissions of RtBackup  did not fix this error for me,, after many weeks of testing and poking I found my solution , and I hope it helps others who haven’t found a fix
  yet.

  • Open the Registry and Navigate to:

  HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlWMIAutoLogger

  • Under this key are 3 EventLog- keys, each one has a DWORD(32) value called LogFileMode, if these aren’t set correctly it causes the EventLog to fail to start with the 4201 Error. Here are the correct settings for each key…

  EventLog-ApplicationLogFileMode — value should be 11000180 (Hex)
  EventLog-SecurityLogFileMode — value should be 100001c0 (Hex)
  EventLog-SystemLogFileMode — value should be 10000180 (Hex)

  Now reboot the PC and see if the eventlog service now starts

  Good Luck

• Could you explain a little further how you solved it ?

  Because I am experiencing the same error message.

  ---

  Luis Olías.

• This post just saved my day!

  Thank you.

• I had the same issue on my Windows 10 machine. Tried to rename RtBackup
  folder but always failed with error saying another program is using file in the folder.

  I checked the registry key [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlWMIAutologgerEventLog-System], unlike the [EventLog-Application] and [Eventlog-Security], there was no registry values under [EventLog-System] root path.

  So I exported the key values from another Windows 10 machine and imported it, then after reboot.Ta-Dah!!! 

  Here the registry values I used to fix the problem. It might not work for you so make sure you back up original registry key before importing it.

  Windows Registry Editor Version 5.00

  [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlWMIAutologgerEventLog-System]
  «Start»=dword:00000001
  «BufferSize»=dword:00000040
  «MinimumBuffers»=dword:00000000
  «MaximumBuffers»=dword:00000010
  «FlushTimer»=dword:00000001
  «Age»=dword:00000001
  «LogFileMode»=dword:10000180
  «ClockType»=dword:00000002
  «Guid»=»{fa5ae656-8e4a-ac95-0980-4eb8342436d8}»
  «OwningChannel»=»System»
  «Status»=dword:00000000

  — Frank Tao

• One of the possible SOLUTIONs, and the most simple is:

  hlmSYSTEMCurrentControlSetControlWMIAutologgerEventLog-ApplicationStart   0 -> 1.

  hlmSYSTEMCurrentControlSetControlWMIAutologgerEventLog-SecurityStart   0 -> 1.
  

  hlmSYSTEMCurrentControlSetControlWMIAutologgerEventLog-SystemStart   0 -> 1.

  You can provoke this error and solve it by changing Start 0 <-> 1 as many times as you like.

  tip   —    EventLog-SecurityStart   —   is not required like other two, and without it eventViewer will be partially enabled. Event viewer will work, but will report that component   EventLog-Security  
  can not be recognized by wmi 4201.

  The CAUSE   —   After looking Performance Monitor, i have noticed that some events are being recorded realtime. [Data Collector SetsEvent Trace Sessions]. Why would I want these events to be recorded and my computer slowed down ? So
  i have disabled them, and that has changed the above Start values.

  other things   —   that rtBackup folder is just buffer for realTime events that are being collected. If you look at Performance Monitor data can be collected in 4 different modes: [file,  realTime,  file and realTime, buffered].
  Event trace sessions:  EventLog-Application, EventLog-System are realTime.

  • Edited by
    Marko279
    Saturday, December 7, 2019 4:45 PM
  • Proposed as answer by
    Marko279
    Saturday, December 7, 2019 4:55 PM