Windows 7: Unable to start Windows event log services - Error 4201

[Doriquto]

Hello friends, I am in trouble here in Windows 7, I had just uploaded on to my system. I cannot start the Windows Event Log service on to my Local Computer. I get the Error 4201: The instance name passed was not recognized as valid by a WMI data provider. I in truth don't know what caused it to stop or what is causing the error above when I try to start it, but I have a guess that it might be the compatibility problem. This is a serious security concern and I need it to fix. I am unable to know what is the issue about. I need some kind of help. Thanks in advance

[Enriquee]

These steps really helped me out from the problem. For the record: 1) first used msconfig to change to safe mode boot. 2) After it I booted it in a safe mode. 3) In safe mode I ran the cmd.exe as an administrator. 4) I then typed "cd C:\Windows\System32\LogFiles\WMI". 5) typed "rename RtBackup RtBackup2". 6) lastly used the msconfig to switch back to the normal boot mode. 7) Restarted the computer and found event viewer working. In short rename C:\Windows\System32\LogFiles\WMI\RtBackup. This will surely help you out.

[Steyn]

I was also having this difficulty. What I did is, I did an upgrade instead of a re-install and everything worked once again. After I re-installed Outlook 2002 then I downloaded Service Pack 3 for Outlook 2002 and restarted and when the system came back up the Event Viewer wasn't working anymore. So I guess one of the offenders is Service Pack 3 for Outlook 2002 that is the Office Service Pack 3.

[Ronchi]

After inspection the Event Log service registry key and values, they were intact. Finally the problem twisted out to be the wrong permissions for the C:\Windows\System32\LogFiles\WMI\RtBackup directory. The SYSTEM group needs complete control permissions for the directory only then the Windows Event Log service would begin. Fixing the Permissions for RtBackup Folder in Windows 7: 1) initially start the windows in to the safe mode. 2) Secondly open the "C:\Windows\System32\LogFiles\WMI" folder. 3) After that right click on to the RtBackup folder and select the Properties. 4) In properties click on to the tab of the Security and click the Edit button. 5) Click Add. 6) In that enter SYSTEM and press ENTER. 7) Enable "Full control" Permission to "Allow". 8) Click OK, and then click Yes when asked for confirmation. 9) Restart Windows (in Normal mode), and verify if the Windows Event Service has started. If you’re still unable to allocate permissions for the RtBackup folder then try taking ownership of the folder, and then repeat the steps 1-9 above.

[Aleksandra]

The fix to this issue is in fact turns out to be very simple to fix. In to the Windows 7 operating system, the SYSTEM account must have read/write access to the subsequent directory: C:/Windows/System32/LogFiles/WMI/RtBackup. When I had view at the properties of this folder, I recollected that my user account was the holder and had Full Control, but the SYSTEM account was misplaced. Adding up this account back in and yielding it Full Control fixes the trouble. There is no need to restart it into the Safe Mode and run a group of scans, follow these steps and you'll include your event service executing and available once again:
1. Initially move to the C: /Windows/System32/LogFiles/WMI/RtBackup and Right-click it. In that have a click onto the tab of the Security.
2. If the SYSTEM account is programmed, then be confirm that the Full Control is checked. If it is unchecked, then check it first and click apply. After it click on to the OK button, and restart your system. I am sure that you should after that be able to start your Windows Event Log Service and access the Windows Event Log.
3. If your SYSTEM account is not programmed in the click "Edit" beneath the account list window and after that click "Add." Within the popup window, type SYSTEM and click "Check Names" just to confirm the spelling is accurate then click OK. After it you are back to the Security tab, then highlight the SYSTEM account and confirm that Full Control is checked. Click OK button and restart your system. You must now be able to confirm your Windows Event Service is running and access your Windows Event Log.

[kraal]

It lastly worked with me. Only two slight modification:
1. while we execute reset.cmd, It should have to be run it as administrator or else it will not be successful to repair every files.
2. The correct domination is:
secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose
with /cfg parameter (not /CF)
Currently I have no difficulty with the Network List Service.