Symptoms
Assume that you install Windows Management Framework 3.0 on a computer that is running Windows 7 Service Pack 1 (SP1) or Windows Server 2008 R2 SP1. After you uninstall the Windows Management Framework 3.0 package and then restart the computer, you encounter the following issues in Event Viewer:
-
When you click Windows Logs, and then click Forwarded Events, all the Forwarded Events logs become unavailable.
-
When you click Applications and Services Logs, click Microsoft, and then click Windows, EventCollector is not displayed.
Note For more information about Windows Management Framework 3.0, click the following article number to view the article in the Microsoft Knowledge Base:
2506143 Description of Windows Management Framework 3.0 for Windows 7 SP1 and Windows Server 2008 R2 SP1
Cause
These issues occur because the registry keys that are related to the Forwarded Events log are removed when you uninstall of the Windows Management Framework 3.0 package.
Note For information about the removed keys, refer to the Registry Key section in this article.
Resolution
Hotfix information
To resolve this issue, install the update that is described in update 2823180. For more information about how to obtain this update, click the following article number to view the article in the Microsoft Knowledge Base:
2823180 Update is available for Windows Management Framework 3.0 in Windows 7 SP1, Windows Server 2008 R2 SP1, or Windows Server 2008 SP2
Prerequisites
To apply this hotfix, you must be running Windows 7 SP1 or Windows Server 2008 R2 SP1. Additionally, Windows Management Framework 3.0 must be installed or previously installed in Windows.
For more information about how to obtain a Windows 7 or Windows Server 2008 R2 service pack, click the following article number to view the article in the Microsoft Knowledge Base:
976932 Information about Service Pack 1 for Windows 7 and for Windows Server 2008 R2
Registry information
After you uninstall the Windows Management Framework 3.0 package, the following registry keys are deleted from your computer:
-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ForwardedEvents
-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Debug
-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Operational
-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{b977cf02-76f6-df84-cc1a-6a4b232322b6}
-
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{b977cf02-76f6-df84-cc1a-6a4b232322b6}
-
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{b977cf02-76f6-df84-cc1a-6a4b232322b6}
-
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Microsoft-Windows-EventCollector
-
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\System\Microsoft-Windows-EventCollector
The Status registry keys under the following paths:
-
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{a7975c8f-ac13-49f1-87da-5a984a4ab417}
-
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{a0c1853b-5c40-4b15-8766-3cf1c58f985a}
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
