Event 0x00040200: Some Event Subscribers Failed

When you'll see this error

This error shows up in Event Viewer under Windows Logs → System or Application. You're looking at an event log entry, and the Description says something like "An event was able to invoke some, but not all, of the subscribers" with error code 0x00040200. It's not a crash—things still mostly work. But somewhere, a service or app that was supposed to react to a specific event didn't get the message. Common triggers:

• You just installed or uninstalled a third-party antivirus or security tool (like McAfee, Norton, or Comodo).
• A Windows Update (especially a cumulative update to Windows 10 22H2 or Windows 11 23H2) partially failed.
• You disabled a service in Services.msc that was subscribed to certain events—like the Windows Push Notifications System Service.
• A registry cleanup tool (CCleaner, Wise Registry Cleaner) removed a subscriber key.

What's actually happening

Windows uses a publisher-subscriber model for events. When something happens (like a service crashes or a disk fills up), the Event Log service (which is the publisher) tries to notify every registered subscriber. A subscriber is any component that registered to get a callback when that event fires—think: the Windows Security Center, a backup scheduler, or even a third-party app that monitors logs.

Error 0x00040200 just tells you: "I told some of them, but not all." The subscriber that failed is usually listed right after the error code in the Details tab of the event. If you look closely, you'll see a GUID or a friendly name like {1B1F3E6B-8A1B-4B8A-9E6C-8B2B3A6F7E1D} or EventSystem.Subscriber. That's the broken piece.

Fix it: Step by step

Don't run a registry cleaner or a "fix all" tool—they'll just make this worse. The fix depends on which subscriber is broken. Here's how to find out and handle it.

1. Open the failing event and find the subscriber.
   In Event Viewer, double-click the 0x00040200 entry. In the General tab, look at the second or third line. You'll often see something like:
   

   EventSystem.Subscriber: {C8E6B3A1-4B7C-4D8A-9E2F-1A3B5C7D9E6F}

   
   Write down that GUID or name.
   What to expect: If you see a friendly name like "Windows Security Center" or "Volume Shadow Copy", you're halfway done. If it's just a GUID, you'll need to translate it.
2. Look up the GUID in the registry.
   Press Win + R, type regedit, hit Enter. Go to:
   

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\EventSystem\Subscriptions

   
   Look for a subkey that matches your GUID. Right-click it and choose Export to back it up first. Then look at the MachineName or SubscriberName value inside—it'll tell you the service or app that owns it. For instance, if it points to WalletService or Windows Defender, you're close.
3. Check if the associated service is running.
   Open Services.msc (Win + R, type services.msc). Find the service that was named. Common ones that break:
   
   • Windows Security Center (wscsvc) — if it's disabled, this error pops up often.
   • Volume Shadow Copy (VSS) — might be set to Manual, but if it's stopped, subscribers fail.
   • Windows Push Notifications System Service (WpnService) — stopped by some privacy tools.
   If the service is stopped, set it to Automatic (or at least Manual) and start it. Right-click → Properties → Startup type → Automatic → Apply → Start.
   What to expect: After you start the service, the error should stop appearing for new events. Old errors stay in the log but won't repeat.
4. If the subscriber is from a third-party app, reinstall that app.
   Sometimes the subscriber is left behind when you uninstall something. That orphaned registry key points to a program that doesn't exist anymore. In that case, you can delete the subscription key (the GUID you backed up in step 2). Right-click it → Delete. But only do this if you're sure the app is gone.
   What to expect: After deleting, reboot. The event log will clean up those references, and 0x00040200 should stop.
5. Reset the Event Log service as a last resort.
   If you can't find the broken subscriber or too many are failing, run this from an elevated command prompt (right-click Start → Terminal (Admin)):
   

   wevtutil el | findstr /i "eventlog"

   
   Then:
   

   net stop eventlog & net start eventlog

   
   This restarts the whole Event Log service. It won't fix orphaned subscriptions, but it clears any transient state.
   What to expect: A quick flash of "services stopped and started." Check Event Viewer again after 5 minutes—new events shouldn't have the error if it was a transient issue.

If it still fails

If the error keeps coming back after you've started the service and deleted orphaned keys, there's a deeper problem: a corrupt subscription database. Go to:

%SystemRoot%\System32\Winevt\Logs\