Event Log Service Won't Start: Fix in 3 Steps

Why the Event Log Service Drops Out

Windows Event Log (eventlog) is the backbone of system logging. When it's down, you can't open Event Viewer, and apps that rely on logging — like the Windows Security Center or backup software — might stall or throw cryptic errors. I've seen this happen after a failed Windows Update, a bad driver install, or a registry tweak that went sideways. The error message usually reads Windows could not start the Windows Event Log service on Local Computer. Error 1068: The dependency service or group failed to start. or Event ID 7000 in the System log (if you can get there). Don't panic. Let's walk through the fixes, shortest first.

Step 1: The 30-Second Fix — Check If the Service Is Just Disabled

This is the most common cause. Some third-party cleaners or overzealous registry optimizers disable the Event Log service because they think it's unnecessary. They're wrong. You need it.

1. Press Win + R, type services.msc, hit Enter.
2. Find Windows Event Log (not Event Log Collector — that's different). Double-click it.
3. If the Startup type is Disabled, change it to Automatic (or Automatic (Delayed Start) — either works).
4. Click Start to run the service now.
5. Click OK, close Services, open Event Viewer (eventvwr.msc) and check if it loads.

That fix works nine times out of ten. If it doesn't start, you'll get an error saying the service didn't respond in time. Move to Step 2.

Step 2: The 5-Minute Fix — Repair the Registry Key

What's actually happening here is the Event Log service can't find its own registry configuration. Windows stores the service's parameters under HKLM\SYSTEM\CurrentControlSet\Services\EventLog. If that key is corrupted, missing, or has wrong permissions, the service won't load. I've seen this after a third-party uninstaller clobbers the registry, or after a bad rollback of a Windows update.

Here's the fix:

1. Open Registry Editor (regedit.exe as Administrator).
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog.
3. Right-click the EventLog key on the left, choose Permissions.
4. Under Group or user names, select SYSTEM. Make sure Full Control is checked. Do the same for Administrators.
5. Click Advanced, check the Replace all child object permission entries box. Hit OK.
6. Close Registry Editor, reboot, and check Event Viewer again.

If the permissions were already fine, the issue is likely a broken dependency. Windows Event Log depends on the RPC Endpoint Mapper service (RpcEptMapper) and the Remote Procedure Call (RPC) service. Make sure both are running and set to Automatic. Check services.msc for those two. If they're stopped, start them, then start Event Log. I've seen a case where a VPN client killed RpcEptMapper — took me an hour to trace it.

Step 3: The 15+ Minute Fix — Rebuild the Event Log Service from Scratch

Skip to this only if Steps 1 and 2 failed. Something deeply wrong — the service binary itself might be missing or the security descriptor is trashed. This fix re-registers the service using its built-in command-line tool, wevtutil, and if that doesn't work, we'll do a manual registry restore.

Part A: Re-register the Event Log provider

1. Open Command Prompt as Administrator.
2. Run these two commands, one at a time:

wevtutil im WindowsEventLog /rf:%systemroot%\system32\wevtsvc.dll /mf:%systemroot%\system32\wevtsvc.dll
wevtutil um WindowsEventLog

The first command installs the manifest, pointing to the proper DLL. The second uninstalls it. Don't worry — the service isn't actually removed because the DLL stays. What we're doing is forcing Windows to read the registry from scratch. Reboot afterward.

Part B: If the service still won't start — export a working Event Log key from a healthy machine (same Windows version and build). You'll need:

• A second PC or a VM with the same Windows version (e.g., Windows 11 22H2).
• On the healthy machine, open Registry Editor, export HKLM\SYSTEM\CurrentControlSet\Services\EventLog to a .reg file.
• Copy that .reg file to the broken machine, double-click it, confirm the merge.

This replaces the entire service configuration. I've used this after a malware cleanup where the registry was so mangled that nothing else worked. The risk is low because the service only stores configuration — no user data or logs live in that key. The logs themselves are in C:\Windows\System32\winevt\Logs.

After the merge, reboot. Open Event Viewer. It should work. If it doesn't, you're looking at a deeper system file corruption. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth from an admin command prompt. That will take 20-30 minutes and might require a Windows installation disc or internet access to pull clean files from Microsoft.

When to Give Up and Use System Restore

If all three steps fail, and sfc / DISM don't fix it, the Event Log service's core files (wevtsvc.dll and wevtapi.dll) might be corrupted beyond repair from a failed update. In that case, a System Restore to a point before the issue started is your best bet. If you don't have a restore point, you're in repair-install territory — boot from a Windows USB, choose Repair your computer, then Troubleshoot → Reset this PC with the option to keep your files. It's a pain, but it beats rebuilding the OS.

One last thing: if you're on Windows 11 24H2, there's a known bug where the Event Log service fails to start after a feature update if third-party antivirus is installed. Temporarily disable the AV before starting the service, then re-enable it. Yes, it's ridiculous. But that's the fix.