Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

Forwarded Events log is unavailable and EventCollector log is not displayed after you uninstall Windows Management Framework 3.0 in Windows 7 SP1 and Windows Server 2008 R2 SP1


View products that this article applies to.

Symptoms

Assume that you install Windows Management Framework 3.0 on a computer that is running Windows 7 Service Pack 1 (SP1) or Windows Server 2008 R2 SP1. After you uninstall the Windows Management Framework 3.0 package and then restart the computer, you encounter the following issues in Event Viewer:
  • When you click Windows Logs, and then click Forwarded Events, all the Forwarded Events logs become unavailable.
  • When you click Applications and Services Logs, click Microsoft, and then click Windows, EventCollector is not displayed.
Note For more information about Windows Management Framework 3.0, click the following article number to view the article in the Microsoft Knowledge Base:
2506143 Description of Windows Management Framework 3.0 for Windows 7 SP1 and Windows Server 2008 R2 SP1

↑ Back to the top


Cause

These issues occur because the registry keys that are related to the Forwarded Events log are removed when you uninstall of the Windows Management Framework 3.0 package.

Note For information about the removed keys, refer to the Registry Key section in this article.

↑ Back to the top


Resolution

Hotfix information

To resolve this issue, install the update that is described in update 2823180. For more information about how to obtain this update, click the following article number to view the article in the Microsoft Knowledge Base:
2823180 Update is available for Windows Management Framework 3.0 in Windows 7 SP1, Windows Server 2008 R2 SP1, or Windows Server 2008 SP2

Prerequisites

To apply this hotfix, you must be running Windows 7 SP1 or Windows Server 2008 R2 SP1. Additionally, Windows Management Framework 3.0 must be installed or previously installed in Windows.

For more information about how to obtain a Windows 7 or Windows Server 2008 R2 service pack, click the following article number to view the article in the Microsoft Knowledge Base:

976932 Information about Service Pack 1 for Windows 7 and for Windows Server 2008 R2

Registry information

After you uninstall the Windows Management Framework 3.0 package, the following registry keys are deleted from your computer:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ForwardedEvents
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Debug
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Operational
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{b977cf02-76f6-df84-cc1a-6a4b232322b6}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{b977cf02-76f6-df84-cc1a-6a4b232322b6}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{b977cf02-76f6-df84-cc1a-6a4b232322b6}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Microsoft-Windows-EventCollector
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\System\Microsoft-Windows-EventCollector
The Status registry keys under the following paths:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{a7975c8f-ac13-49f1-87da-5a984a4ab417}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{a0c1853b-5c40-4b15-8766-3cf1c58f985a}

↑ Back to the top


Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

↑ Back to the top


Keywords: kbqfe, kbhotfixserver, kbfix, kbexpertiseadvanced, kbsurveynew, kb

↑ Back to the top

Article Info
Article ID : 2809215
Revision : 1
Created on : 1/7/2017
Published on : 4/9/2013
Exists online : False
Views : 284