Forwarded Events log is unavailable and EventCollector log is not displayed after you uninstall Windows Management Framework 3.0 in Windows 7 SP1 and Windows Server 2008 R2 SP1

Article translations Article translations
Article ID: 2809215 - View products that this article applies to.
Expand all | Collapse all

On This Page

Symptoms

Assume that you install Windows Management Framework 3.0 on a computer that is running Windows 7 Service Pack 1 (SP1) or Windows Server 2008 R2 SP1. After you uninstall the Windows Management Framework 3.0 package and then restart the computer, you encounter the following issues in Event Viewer:
  • When you click Windows Logs, and then click Forwarded Events, all the Forwarded Events logs become unavailable.
  • When you click Applications and Services Logs, click Microsoft, and then click Windows, EventCollector is not displayed.
Note For more information about Windows Management Framework 3.0, click the following article number to view the article in the Microsoft Knowledge Base:
2506143 Description of Windows Management Framework 3.0 for Windows 7 SP1 and Windows Server 2008 R2 SP1

Cause

These issues occur because the registry keys that are related to the Forwarded Events log are removed when you uninstall of the Windows Management Framework 3.0 package.

Note For information about the removed keys, refer to the Registry Key section in this article.

Resolution

Hotfix information

To resolve this issue, install the update that is described in update 2823180. For more information about how to obtain this update, click the following article number to view the article in the Microsoft Knowledge Base:
2823180 Update is available for Windows Management Framework 3.0 in Windows 7 SP1, Windows Server 2008 R2 SP1, or Windows Server 2008 SP2

Prerequisites

To apply this hotfix, you must be running Windows 7 SP1 or Windows Server 2008 R2 SP1. Additionally, Windows Management Framework 3.0 must be installed or previously installed in Windows.

For more information about how to obtain a Windows 7 or Windows Server 2008 R2 service pack, click the following article number to view the article in the Microsoft Knowledge Base:
976932 Information about Service Pack 1 for Windows 7 and for Windows Server 2008 R2

Registry information

After you uninstall the Windows Management Framework 3.0 package, the following registry keys are deleted from your computer:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ForwardedEvents
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Debug
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Operational
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{b977cf02-76f6-df84-cc1a-6a4b232322b6}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{b977cf02-76f6-df84-cc1a-6a4b232322b6}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{b977cf02-76f6-df84-cc1a-6a4b232322b6}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Microsoft-Windows-EventCollector
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\System\Microsoft-Windows-EventCollector
The Status registry keys under the following paths:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{a7975c8f-ac13-49f1-87da-5a984a4ab417}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{a0c1853b-5c40-4b15-8766-3cf1c58f985a}

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Properties

Article ID: 2809215 - Last Review: April 9, 2013 - Revision: 1.0
Applies to
  • Windows Server 2008 R2 Service Pack 1, when used with:
    • Windows Server 2008 R2 Datacenter
    • Windows Server 2008 R2 Enterprise
    • Windows Server 2008 R2 for Itanium-Based Systems
    • Windows Server 2008 R2 Foundation
    • Windows Server 2008 R2 Standard
    • Windows Web Server 2008 R2
Keywords: 
kbqfe kbhotfixserver kbfix kbexpertiseadvanced kbsurveynew KB2809215

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com