This issue is caused by a timing problem that occurs where the
RegisterEventSource function cannot locate the Automatic Updates event source.
Before an Automatic Updates event is logged for the first time in the System log, the location of the source file for the Automatic Updates event is added to the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\System\Automatic Updates
Immediately thereafter, the
RegisterEventSource function obtains a handle to write events. If the location of the source file is not yet flushed to the registry when the
RegisterEventSource function obtains a handle to write events, the
RegisterEventSource function logs the event in the Application log instead of in the source file. Therefore, the event is incorrectly logged in the Application log instead of in the System log.
When the Automatic Updates log entry is logged in the Application log, the correct description is not displayed for the event because the
RegisterEventSource function cannot locate the event source. That is, an event source that is named Automatic Updates does not exist in the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application
Therefore, the message that is mentioned in the "Symptoms" section is displayed for the event.