EBS by S.R

July 20, 2008

Vista blue screened on a system restore “Event viewer service” error 4201

Filed under: EBS,Vista — WITS-SR @ 11:17 pm

We found that after doing a system restore on a Vista x64 sp1, it blue screened on startup, however a safe mode boot worked; after enabling msconfig, and disabling all the Symantec modules, the system booted;

Next step was uninstalling Endpoint which failed on the services screen, on further investigation we found that the “event viewer service” was not starting, and was generating a “Error_WMI_Instance_Not_Found 4201 The instance passed was not recognized as valid by WMI data provider”

We found the quickest fix was to boot into repair mode, and rename Repository locate in C:\windows\systems32\wbem\

If this does not work, then

net stop winmgmt

winmgmt /resetrepository

restart computer, event viewer should now be working, Endpoint did not not to be uninstalled.




1 Comment »

  1. I researched several forums and none of the suggestions worked. So I compared the folder permissions to c:\windows\system32\logfiles\wmi\RTbackup to a working machine. Navigate to RTbackup properties and check security settings. It requires SYSTEM – full control. I added this permission and rebooted PC to fix the issue. I can now access my event viewer.

    Comment by Susan Eubanks — June 30, 2009 @ 3:34 pm | Reply

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

Create a free website or blog at WordPress.com.

%d bloggers like this: