Fix Event Log Service Error 4201 The Instance Name Passed Was Not Recognized

One of our readers faced a problem where the Windows Event Log failed to start, and as a result, a couple of other services failed as well. Attempting to start the Windows Event Log service manually via the Services MMC resulted in error 4201. The complete error message is provided below:

Windows could not start the Windows Event Log service on Local Computer.

Error 4201: The instance name passed was not recognized as valid by a WMI data provider.


And the following errors popped up when opening the Event Viewer and Task Scheduler.

Event Log service is unavailable. Verify that the service is running.

Task Scheduler service is not available. Task Scheduler will attempt to reconnect to it.

Upon checking the Event Log service registry key and values, they were intact. Eventually, the problem turned out to be the incorrect permissions for the C:\Windows\System32\LogFiles\WMI\RtBackup directory. The SYSTEM account needs full control permissions for the directory — only then the Windows Event Log service would start. Note that I didn’t have to rename or delete the RtBackup directory.

Solution for Event Log Service Error 4201

Fix the Permissions for RtBackup Folder

  1. Start Windows in Safe mode.
  2. Open the “C:\Windows\System32\LogFiles\WMI” folder.
  3. Right-click on the RtBackup folder and choose Properties.
  4. Click the Security tab, and click the Edit button.
  5. Click Add.
  6. Type SYSTEM and click OK.
  7. Enable “Full control” Permission to “Allow.”
  8. Click OK, and then click Yes when asked for confirmation.
  9. Restart Windows (in normal mode), and verify if the Windows Event Service has started.

Unable to assign permissions for the RtBackup folder?

If you’re unable to assign permissions for the RtBackup folder, try taking ownership of the folder and then repeat steps 1-9 above.

One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

...

30 thoughts on “Fix Event Log Service Error 4201 The Instance Name Passed Was Not Recognized”

  1. Hmmm… I see an improvement in your blog, Ramesh. No more any of those “How disable …” Instead, you are actually posting very useful topics. Very nice.

    Still, I wonder how that one of your readers managed to get himself into this trouble…

    Reply

  5. thank you this worked perfectly for us on a windows 2008 server. Fortunately we didn’t go through with the instructions found elsewhere to reset the permissions of ALL registry keys!!

    Reply

  7. Thanks for the walk through, it worked for me. However I’m running a W2K8R2 server and didn’t need to startup in safe-mode…but I did have to log in as network administrator to set the permissions. For those wanting more info on this issue, there is a MSDN social thread that expands on the “permissions of ALL registry keys” here; http://social.msdn.microsoft.com/Forums/en/windowscompatibility/thread/c75ae899-d05b-411d-a7f2-00fdd33b8589

    Thanks again!

    Reply

  9. Eyy! Tahnks man I fix me issue, I had been loking a lot web sites tos fix the problem and dindnt work any topic, your solution runn well, thanks one time more.

    Reply

  14. Thanks! Simple, effective, and probably the most “correct” fix. No screwy backdoor registry renaming deletion foolishness. If you must do all that, fine, but why not fix the problem instead of playing hide and seek with an unknown? Followed your directions exactly, worked perfectly. Windows 7 64bit.

    Reply

  19. Well, I think Occam said it already, no need for me to repeat it. Excellent, intuitive and perfectly effective. If only this process would catch on in the entire programming world!…

    Reply

  21. After trying to install Office 2013 Pro Plus many, many times and each time getting a very generic error of:
    Microsoft Office Professional Plus has encountered an error during setup.
    Then getting the message:
    Microsoft Setup Bootstrapper has stopped working.
    I tried a lot of remedies proffered by various websites

    I was about to throw in the towel when I came across your suggestion.
    Voilà – Office 2013 installed flawlessly!

    Many thanks, very much appreciated.

    Windows 7 Ultimate N Service Pack 1

    Reply

  23. Tks for that – tried a few other solutions posted elsewhere and none proved effective for various reasons but your solution immediately worked. Brilliant!

    Reply

  26. I had this same issue “Error 4201: The instance name passed was not recognized as valid by a WMI data provider.”

    The problem was the incorrect permissions. Solved thanx!

    Reply

  28. this worked for me:

    changed start from 0 to 1 in these three in AutoLogger

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\

    \EventLog-Application\
    \EventLog-Security\
    \EventLog-System\

    Reply

  30. Fantastic. Finally got Event Viewer running again.
    The RtBackup folder was deleted by me!
    Created a new folder and checked permissions. All was good.

    Reply

Leave a Comment