Внимание, долгое и дотошное описание проблемы!!!
Сразу скажу, я пересмотрел всё что только возможно, в гугле и яндексе. Ситуация такова: служба «Журнал событий Windows» в Windows 10 (Корпоративная версия) напрочь не хочет запускаться. При запуске вручную через «Панель управления» -> «Администрирование» -> «Службы» видим следующее:
Дело в том, что в «Управление компьютером» есть «Просмотр событий», использующий, как мне стало понятно, службу «Журнал событий Windows». Выводится при обращении к просмотру событий следующее:
Это и логично, служба не запускается же. Я начал копать вглубь, нашёл разную информацию. Далее напишу, что я сделал:
- Разблокировал учётку встроенного админа через командную строку с помощью команды net user администратор /active:yes. После этого всё оставшееся творил именно в ней, ибо полномочия её нужны.
- Проверил зависимости службы «Журнал событий Windows», всё от чего зависит эта служба или от кого она сама зависит — работает из автоматического запуска. Вот эти службы:
Да и в принципе, все службы, которым указан автоматический запуск — все они запускаются, кроме службы журнала!
- Открыл папку C:\Windows\System32\winevt, о которой пишут в многих инструкциях по решению моей проблемы, добавил как для этой папки, так и для подпапки Logs в правах пользователя LOCAL SERVICE, который якобы работает со службой журналов, вот подтверждение:
Тут же я как для winevt, так и для подпапки Logs добавил группу пользователей «Все», и дал ей полный доступ, на всякий случай. Даже для C:\Windows\Logs и C:\Windows\System32\LogFiles я добавил LOCAL SERVICE в полный доступ, а также по возможности группу «Все».
- Проверил на существование файл C:\Windows\System 32\services.exe, он на месте. Не думаю, что в нём проблема, ибо тогда, я уверен, другие критические службы не запустились.
- Встречал и бредовый, как мне кажется, совет сбросить таблицы маршрутизации через командную строку с помощью команд route -f и net winsock reset. После перезагружал компьютер.
- Обновлял драйвера через Iobit Driver Booster и DriverPack Solution Online (скачивание самых актуальных дров).
- Лазил в обновление Windows, ничего дельного там не было, ибо и так обновляюсь периодически, и галочки все установил заранее, чтобы качалось всё, что может быть:
- Сменил владельца всех вышеописанных папок с «Система» на группу «Администраторы» по совету Василия — не получилось.
Итог моим мучений — бессоная ночь и отсутствие результата! Проблема всё так же акутальна!
P.S.: Всё это было затеяно по причине установки на компьютер Microsoft Office 2007, который явно указал на проблему полномочий записи по пути HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog, а там ещё и подпапки почти все не открываются с одинаковым вердиктом:
После я уже пробовал Microsoft Office 2016, тоже ставиться не хочет. Даже дошёл до того, что скачал portable версии офиса в отчаянии, так он мне заявил, что services.exe выдаёт ошибку 0x0000007e (довольно общая ошибка, но учитывая, что ранее я узнал о запуске службы журнала с её помощью, думаю, что портативный офис так же лезет к журналу Windows.
Фух, дочитали? 
Что же, прошу помочь, подсказать, может я что-то не так сделал?? Я уже не знаю что ещё предпринять, хоть реально брать и сносить десятку, ставить Windows 7…
UPD: Отдельно задумался, можно ли ветку реестра HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog восстановить/сбросить по умолчанию? Типа, состояние настроек службы как у свежеустановленной операционной системы. Есть какие-то методы на крайний случай?
The Event Viewer is a Windows snap-in tool that allows you to view and analyze system event logs and check errors in Windows 10/11. However, you might encounter the Event Viewer not working problem. You can follow the instructions shared by MiniTool Solutions to resolve the problem.
Do you know what is the Event Viewer? The Event Viewer is used to check event logs. It divides logs into five sections, including Applications, Security, Setup, System, and Forwarded Events. You can check the detailed information on a specific log by using Event Viewer. Besides, it allows you to find and filter logs according to Date and Time, Task Category, Source, and other filter criteria. Then, let’s move on to fix the Event Viewer not working problem.
How to Fix Event Viewer Not Working
Method 1: Restart the Windows Event Viewer Service
Sometimes, the Windows Event Viewer stops working due to small bugs. You can restart it to fix the temporary issue.
Step 1: Press Win + R to open the Run window.
Step 2: Type services.msc into the text box and hit Enter to open the Services window.
Step 3: Scroll down to find and right-click on the Windows Event Log service, then choose Restart from the context menu.
After this, you can close the Services window and try to reopen Event Viewer to see whether the problem is fixed.
Method 2: Install Windows Update
Some of you find the Event Viewer not working after the Windows update. Maybe this is because you are performing a bad update.
Step 1: Press Win + I to open Windows Settings.
Step 2: Choose Update & Security > Windows Update.
Step 3: Click on Check for updates on the right pane.
If any new updates are available shown on the screen, you can click on Download & install to obtain the latest version.
Method 3: Run System File Checker
Running Windows tools relies on numerous system files. Any corrupted or missing system files can lead to various issues. Therefore, you can run the sfc /scannow command to scan and fix the problematic system file.
Step 1: Press Win + S and type Command Prompt into the search box.
Step 2: Choose Run as administrator from the right pane.
Step 3: Type sfc /scannow and hit Enter to execute this command.
This process will repair problems with system files. When the process is finished, you can check whether the Event Viewer not working problem is resolved.
Method 4: Run the CHKDSK Command
Apart from the system files, you should also ensure that your storage device is performing well. In some cases, the application fails to work due to a corrupted drive. You can perform the CHKDSK command to check and repair errors on your drive.
Step 1: Press Win + R to open the Run window.
Step 2: Type cmd into the text box and press Shift + Ctrl + Enter to run Command Prompt as administrator.
Step 3: Type CHKDSK x: /r and hit Enter. You should replace x with the drive letter of the system drive, usually C:.
This command will not only correct the logical errors on the target drive but also check the bad sectors on it. You need to restart your computer and relaunch the Event Viewer to see if it works normally.
Tips:
If you discover the vital files get lost after running the CHKDSK command, you are suggested to recover them quickly. MiniTool Power Data Recovery is an ideal choice for you. This free file recovery software allows you to recover deleted files under various situations, including mistaken deletion, formatting, virus attack, operating system crash, etc. You can try the free edition first to recover up to 1GB of files for free, then get more advanced editions if needed on this page.
MiniTool Power Data Recovery FreeClick to Download100%Clean & Safe
Method 5: Check Windows Memory
The other possible reason for Windows Event Viewer not working is the problem with your system memory. Fortunately, Windows is equipped with a repair tool, Windows Memory Diagnostic. You can check potential errors on your computer’s RAM by following the next steps.
Step 1: Press Win + S and type Windows Memory Diagnostic into the search box.
Step 2: Hit Enter to open the Windows Memory Diagnostic window.
Step 3: Choose Restart now and check for problems (recommended) in the popup window.
It will repair the Windows memory issues during your computer reboot.
Bottom Line
The Event Viewer not working will make you incapable of checking the system errors, monitoring crucial events, and other operations to manage your computer. You can try the methods in this post to resolve the problem effectively. Hope one of them can help you timely.
Event Viewer snap-in in Windows helps you to trace down activities on your system and thus can help you to improve system performance. You can directly open Event Viewer from WinX menu or search for it using Windows Search/Cortana.
This article talks addresses common issue where Event Viewer snap-in is not working. By not working, we mean either of following points:
- Event Viewer not showing all events
- Event Viewer not showing new events
- Event Viewer not showing custom events
- You can’t create custom events
If you’re facing either of above mentioned symptoms with Event Viewer, it’s time to troubleshoot the issue. Here’s how:
Page Contents
FIX: Event Viewer Not Working In Windows 10
FIX 1 – General Suggestions
1. Run System File Checker scan or run DISM command-line tool to repair system files corruption.
2. Boot into Safe Mode and check if problem persists there.
3. If issue persists in Safe Mode, try clean boot.
4. Open Services snap-in by running services.msc command. Make sure Windows Event Log service is Running and set to Startup Type as Automatic. Additionally, ensure that Windows Event Collector service is set to Manual Startup Type.
FIX 2 – Using PowerShell
If you’re using recently released Windows 10 Version 1903 and then installed KB4503293, the update may break ability to create custom events. As soon as you click Custom Views, you’ll receive MMC has detected an error in snap-in and will unload it error. The issue is not only limited to V1903 but also affects other versions of Windows 10 and even Windows 8.1/7. Microsoft is aware of this problem and has acknowledged that issue is due to Windows Updates released on June 11, 2019.
So if you come to this article because you can’t create custom events, you can use the PowerShell based workaround provided by Microsoft. The company is currently working on patch and will release it via upcoming Windows Update so that it will be automatically fixed for affected users.
UPDATE (28/06/2019): The issue is resolved with KB4501375 released on June 27, 2019 for Windows 10 Version 1903. If you’re on any other operating system, make sure you’ve installed latest updates.
Drop us a comment, if you’re still facing issue with Event Viewer!
RELATED ARTICLES
Quick Answer
- The Windows Event Viewer Tool performs a similar function to a class monitor or moderator, who keeps a log of every activity and reports on it.
- The first method is to press the Windows key and search for the Event Viewer app to access it.
- The quickest method to restore the event viewer tool is to restart the Event Log service inside the Services tab.
The Windows Event Viewer Tool performs a similar function to a class monitor or moderator, who keeps a log of every activity and reports on it. It logs all system activities and errors to help spot under hood issues with your system. However, if you can’t access it or are facing issues while using it, this explainer will help you troubleshoot the same. Let’s look at various methods to fix the Event Viewer not working issue on Windows 11/10. Additionally, you can learn to fix the File Explorer app on Windows.
Windows Event Viewer: What is it and How to Access it?
The Event Viewer app is an administrative Windows tool that keeps track of all events, errors, and essential information related to your system in the form of logs. This helps track crucial changes and issues in your Windows 11/10 machine, thus helping to troubleshoot them conveniently. Here are the three ways you can access this Windows Event Viewer on your system using various techniques.
1. The first method is to press the Windows key and search for the Event Viewer app to access it.
2. Another way to access is by pressing the Windows key + X and then clicking the Event Viewer option to open it.
3. Lastly, you can also open the Run Window using the Windows + R hotkey and type eventvwr.msc to open it.
Methods to Fix Event Viewer Not Working on Windows 11/10
If you’re unable to access or facing issues while running the Windows Event Viewer app, you can troubleshoot it using the following methods.
Restart the Windows Event Log Service
The quickest method to restore the event viewer tool is to restart the Event Log service inside the Services tab. Follow these steps for a quick fix:
1. Open the Run window by pressing the Windows key + R hotkey and type services.msc to open the Services tab.
2. Locate the Windows Event Log service in the list and right-click on it to pick the Restart option.
That’s it. Once restarted, the Windows Event Log service shall fix the Event Viewer not working issue on your system.
Fix Event Viewer Not Working by Reviewing Log Security Settings
Sometimes missing security privileges might become a barrier for the Event Viewer app to work. You must verify that the Logs folder has all the required permissions to resolve the issue. Here’s how you can check the same:
1. Open the Run Window and hit the enter key after copying the following path:
C:\Windows\System32\winevt
2. Next, right-click on the Logs folder to access its properties.
3. Switch to the Security tab and click on the SYSTEM username to edit its properties via the Edit button.
4. Finally, ensure that the SYSTEM username has all the permissions enabled.
Verify Event Log Viewer using Windows Registry
Like the services tab, you can fix the event viewer not working issue on Windows 11/10 using the Windows Registry tool. Here’s how:
1. Press the Windows key and search for the Registry Editor tool and run it as Administrator.
2. Copy-paste the following path in the search field and hit the enter key:
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog
3. Locate Start and double-click to configure its value.
4. Set the value to 1 and press the OK button to save the changes.
That’s it. Launch the Event Viewer tool to check if the issue has been fixed.
Use System File Checker to Fix Event Viewer Not Working
An incomplete/corrupted system update might sometimes prevent you from accessing the Event Viewer tool. Don’t worry; you can repair your system’s corrupted files using the System File Checker utility. Follow our easy steps to Scan and fix Corrupted System Files to resolve them quickly.
Fix the Event Viewer Tool with the Check Disk Utility
The Check Disk Utility is another nifty Windows tool to conveniently repair corrupted system files causing an issue with the Event Viewer app. Here’s how you can use it to your advantage:
1. Open Command Prompt with admin privileges on your Windows 11/10 system.
2. Next, type ‘chkdsk‘ in the command line window and hit the enter key to run the Check Disk utility tool.
Check Disk will scan all hard drives on your system to find errors and will ask you to repair them with commands in case of errors.
Utilize Memory Diagnostic Tool to Fix Event Viewer Not Working
If you’re facing frequent lags or crashes while running the Event Viewer tool on your Windows machine, it might be due to an issue with the installed RAM. Luckily, Windows offers a built-in memory diagnostic tool to detect and report existing issues with your RAM. Follow these steps to fix the Event Viewer tool:
1. Press the Windows key and search for the Windows Memory Diagnostic tool and run it as administrator.
2. Next, click the ‘Restart Now‘ button to reboot your computer and detect existing RAM problems. Once fixed, you can use the Event Viewer tool without crashes or lags.
Boot your System in Safe Mode (Clean Boot)
Sometimes a recent app installation alters the system settings making it difficult for other apps to run. If you’ve recently started to face the event viewer not working issue on your device, you can boot into safe mode to check if other third-party apps are hindering it. Follow these easy steps to boot your Windows 11/10 system in safe mode.
Once inside safe mode, launch the Event Viewer tool to check if it is working correctly. If it does, you must remove the recently installed app to use the Event Viewer tool without errors.
Overwrite Old Log Files
If your device contains too many log files, your PC might be unable to create new logs for the Event Viewer app. In such a situation, you are most likely to face the event viewer not working issue on your Windows 11/10 machine. To get rid of it, you must provide overwriting privileges to different log categories in the event viewer app. Here’s how it can be done:
1. Launch the Event Viewer tool and expand ‘Application and Service Logs‘ from the left sidebar.
2. Next, right-click on an event category to access its properties.
3. Inside the properties window, make sure to toggle on the ‘Overwrite events as needed ‘ and press the Apply button to save changes.
Switch to a New User Account to fix the Event Viewer Issue
In certain instances, it is possible that the Event Viewer not working issue is only limited to your user account. You can verify the same by creating or switching to a different user account on your Windows machine. Here’s how:
1. Open the Control Panel app using Windows search.
2. Click on User Accounts.
3. Next, click on the User Accounts button and press the Manage Another Account option.
4. Now, click the Add a new user in the PC Settings link and follow the on-screen instructions to create a new user.
Once created, log into the new user account and run the Event Viewer tool to check if the issue has been resolved.
Make Space for New Logs by Clearing Old Log Files
As the heading states, clearing old log files can prove helpful in making room for new ones, which might eradicate existing issues with the Event viewer tool. Follow these steps for an easy fix:
1. Launch the Event Viewer tool and right-click on a log sub-category and then click the Clear Log option.
2. Repeat the step with each sub-category to remove all the old log files from Windows 11/10.
Bonus Tip: Update your Windows
If you still haven’t been able to fix the Event Viewer tool after trying all the above troubleshooting methods, you can update your Windows system as a last resort. For more details, follow our detailed explainer on ‘Check and Update Windows 11/10‘.
FAQs
Q: The Event Viewer Service has stopped unexpectedly on my device. How do I restart it?
A: You can restart the Event Viewer tool using the Services tab. Refer to the first method mentioned in this explainer to reboot the same.
Q: The event log service is unavailable. How do I fix it?
A: Perform a safe boot of your Windows machine to check if you can access the Event Viewer tool. Also, follow other troubleshooting methods to fix the unavailability issue.
Wrapping Up: Restore the Event Viewer App
So these are all the methods to fix the Event Viewer not working issue on your Windows 11/10 machine. If this guide has successfully helped you troubleshoot the issue, then share it with your friends who might be scratching their heads looking for a solution. Stay subscribed to GadgetsToUse and keep revisiting for more quality guides.
You might be interested in the following:
- Top 7 Ways to Fix Windows 11 Black Screen with Cursor Issue
- 3 Ways to Adjust Windows 11 Taskbar Size without Software
- 8 Ways to Disable Microsoft OneDrive in Windows 11
- 2 Ways to Recover Permanently Deleted Files on Windows 11/10
You can also follow us for instant tech news at Google News or for tips and tricks, smartphones & gadgets reviews, join GadgetsToUse Telegram Group or for the latest review videos subscribe GadgetsToUse Youtube Channel.
Was this article helpful?
YesNo
Для различных событий и ошибок системы и приложений Windows ведёт журналы событий, которые можно просмотреть и получить дополнительную информацию, которая может быть полезной при решении проблем с компьютером.
В этой инструкции для начинающих — способы открыть просмотр событий Windows 11/10 и дополнительная информация на тему, которая может пригодиться. На близкую тему: Как отключить журнал событий в Windows.
Контекстное меню кнопки Пуск и поиск
Самый быстрый способ перейти к просмотру журналов событий в Windows 11 и 10 — нажать правой кнопкой мыши по кнопке «Пуск» или нажать клавиши Win+X на клавиатуре и выбрать пункт «Просмотр событий» в открывшемся меню.
Ещё один простой и в большинстве случаев работающий способ открыть какой-либо системный инструмент, расположение которого вам неизвестно — использовать поиск в панели задач.
Начните вводить «Просмотр событий» в поиске, после чего запустите найденный результат:
Почему не «Журнал событий» или «Журнал ошибок», которые пользователи обычно ищут? Причина в том, что сами журналы — это файлы на диске в папках
C:\Windows\System32\winevt\Logs C:\Windows\System32\LogFiles
Пользователи, задавая вопрос о том, где журнал событий в Windows, обычно имеют в виду именно системный инструмент «Просмотр событий» для удобного просмотра соответствующих журналов.
Команда «Выполнить»
Самый быстрый и часто используемый метод запуска просмотра журналов событий Windows — использование команды «Выполнить»:
- Нажмите клавиши Win+R на клавиатуре, либо нажмите правой кнопкой мыши по кнопке «Пуск» и выберите пункт «Выполнить».
- Введите eventvwr.msc (или просто eventvwr) и нажмите Enter.
- Откроется «Просмотр событий».
Эту же команду можно использовать для создания ярлыка или для открытия журнала событий в командной строке. Возможно, вам пригодится информация о других полезных командах «Выполнить».
Обычно описанных выше вариантов бывает достаточно для открытия просмотра журналов событий и ошибок в Windows, но есть и другие подходы:
Помимо просмотра журнала событий, в Windows присутствует ещё один полезный инструмент — Монитор стабильности системы, позволяющий наглядно получить информацию о работе вашей системы по дням на основании данных из журнала событий.