Windows Event Log Service – Error 13: The data is invalid

For me, I had run through a series of hardening of the server and I found that the Windows Event Log service would no longer start.

After trying a series of other attempted fixes, like clearing out the existing logs from: %SystemRoot%\System32\Winevt\Logs, as well as making sure the permissions on the folder were ok.

There was a suggestion to use Process Monitor(procmon), so I tried starting the service, worked out what PID it was then filtered the view by that PID.  I saw the PID was attempting to traverse a set of Registry Keys which were showing as NOT FOUND.

The full key was: HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog

I checked the registry and this contained a set of Keys for Application, Security and System. For me these then only contained an entry for Retention.

Which got me thinking, does this even need to be here?

I deleted the Key: HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog then tried to start the Windows Event Log service and BAM! worked straight up 🙂

One comment

  1. Sid says:

    Hi Admin, Thanks for this fix. I had been going on searching for a fix for Windows Server 2012 R2 STD 64bit, from past 6 hrs. Had tried other threads, this one works for me to enable Windows Event Log service

Leave a Reply

Your email address will not be published. Required fields are marked *