EventViewer service not starting

Question

Hello all,

EventViewer service not starting for particular 2 Windows Server 2012 R2.

Found a solution from below website

http://klevster.com/fix/windows-event-log-service-error-13-the-data-is-invalid/

First, try to clear out the existing logs from: %SystemRoot%\System32\Winevt\Logs and make sure the permissions on the folder were ok.

If it doesn't work, the last recommendation is that deleted the Key: HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog then tried to start the Windows Event Log service

In my case , deletion of the registry entry is the solution but the same issue appears after couple of weeks after.

Any help for a permanent fix is greatly appreciated.....

Answer 1

I think that your problem might be the Retention value on the Security eventlog. I don't have a Server 2012 machine to test with so I used a Win10 Pro VM.

If I set the log to "Overwrite events as needed", the retention value is 0. If I set it to "Archive the log when full" it got set to 0xffffffff.

Run regedit and set Retention to 0 in both:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security

Try to start the eventlog service. If it won't start then reboot.

When it comes back up, set the retention to "Archive the log when full" and then examine the value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security

If it's 0x00ffffff then you've still got some other problem. If it's 0xffffffff then tell your AD administrator that his policy is bad and to remove that Retention setting. It may be that older versions like Server2003 or 32 bit Server versions used 0x00ffffff

Answer 2

Sounds like a group policy problem. Who supports Active Directory in your organization? Talk to them and verify that the 2 servers are in the correct OU and getting the correct policies assigned.

From an admin command prompt you can review policies and look at those registry entries to see what it's changing.

gpresult /r
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog /s

Rsop.msc will show you a GUI version of policies.

Answer 3

Hi,

I checked the RSOP.MSC output and found the security eventlogs retention is set for 90 days in both the servers , they are in the same OU.

When I checked for other 2012 R2 server which is having the same problem in test OU not applied with that GPO also , having the same issue.

Any inputs where the issue stems from?

Answer 4

Thanks for your inputs, I will keep posted on the updates on the proceedings further to resolve

Answer 5

Hi all,

Finally found that the issue arose from bad GPO

Thanks for the help MotoX80