Go to ...

RSS Feed

Win10 Event Viewer Fails After KB4503293 Or KB4503327

Lots of users — including yours truly — are reporting Event Viewer failures after installing the latest 1809 and 1903 Cumulative Updates from June’s Patch Tuesday earlier this week. Some users who’ve defined custom views already in Event Viewer may experience this failure immediately. Others may experience the failure when they try to open custom views in that application. Other versions of Windows (and related CUs) do not seem to throw this error. Thus, for example, none of my 3 Fast Ring + Skipahead PCs (and even a Release Preview PC) manifested this problem. Here’s what the bug looks like when it first appears:

Win10 Event Viewer Fails After KB4503293 Or KB4503327.init-msg

The initial error looks innocuous but until it’s fixed, Event Viewer won’t run.
[Image Source: ghacks.net]

When This Error Appears, Repairs Are Needed

As the Event Viewer error report dialog box indicates, users must choose to report the error to MS and shut down MMC (first radio button) or unload the snap-in and continue running (second radio button). The natural tendency is to select the second radio button. But even so, Event Viewer will not run. Instead, users will see a “Snap-in Unavailable” error message and Event Viewer does nothing. That’s because Event Viewer is itself an MMC snap-in, and it is in effect reporting its own inability to run. So, of course, it refuses to do anything after making such a report. Here’s what that looks like:

Win10 Event Viewer Fails After KB4503293 Or KB4503327.refusal

Those who try to keep Event Viewer going after seeing the initial error, will most likely see this screen next.
[Image Source: ghacks.net]

This Ugly-Seeming Problem Has a Dead Simple Fix

Although Microsoft published a Support Note about this issue on June 12, which includes a PowerShell-based fix, there’s another, much simpler fix that eliminates this problem. Here’s the recipe:
1. Open File Explorer on the affected PC.
2. Navigate to this folder: C:\ProgramData\Microsoft\Event Viewer\Views
3. [Optional] Copy any files named View_N.xml to a different folder for backup. (Note N denotes an integer value, starting from 0, incrementing by 1s (e.g. View_0.xml, View_1.xml, View_2.xml, and so forth, one for each custom view previously defined in Event Viewer.)
4. Delete all files named View_N.xml

Once these items are no longer present in the afore-cited folder, Event Viewer should launch and run properly. Those who would like to re-use those custom views can try restoring them after a successful Event Viewer launch has been accomplished.

[Note] Shout-out/Thanks to Martin Brinkmann/ghacks.net

I learned about this issue, and its simple fix, thanks to Martin Brinkmann’s June 12 coverage of this topic at ghacks.net: “Windows 10: Event Viewer error after installing KB4503293 and KB4503327.” Although I experienced (and fixed) the problem on my production PC directly, I neglected to capture the error message screens from that machine. Thanks to Martin’s foresight in making such captures, I was able to use his diligent efforts in this story. Thus, he not only informed me about the issue, he made it possible for me to depict it properly. Nochmals vielen Dank, Herr Brinkmann!

Author: Ed Tittel

Ed Tittel is a 30-plus-year computer industry veteran. He’s a Princeton and multiple University of Texas graduate who’s worked in IT since 1981 when he started his first programming job. Over the past three decades he’s also worked as a manager, technical evangelist, consultant, trainer, and an expert witness. See his professional bio for all the details.

Leave a Reply