Fix Event Viewer Error 0x3A9C Invalid Publisher Name

This error pops up when Event Viewer can't find a log publisher's registry entry. Usually after a .NET or Windows update screws up the manifest registration.

When This Error Hits

You're in Event Viewer, checking Application or System logs, and instead of events you get this error code 0x3A9C. The exact message reads: "The specified publisher name is invalid". This almost always happens after a Windows Update, a .NET Framework update, or when someone manually messed with event log publishers in the registry. I've seen it on Windows 10 20H2, Windows Server 2019, and Server 2022 — usually after a cumulative update that included a manifest change for a built-in provider like .NET Runtime or Microsoft-Windows-Security-Auditing.

Root Cause

The event log system registers publishers via manifests — XML files that describe where logs live and how to format them. When a publisher is installed, it creates a registry key under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventLog\. If that key gets deleted, corrupted, or points to a missing manifest, Windows can't resolve the publisher name. The error code 0x3A9C is the system's way of saying "I looked up this publisher, found nothing in the registry, so I'm out."

The specific culprit is often the .NET Runtime publisher. Microsoft has a habit of updating the .NET Framework and not cleaning up old publisher registrations. Also, if you've removed a Windows feature like Windows Communication Foundation (WCF) or Windows Identity Foundation (WIF), the manifest goes but the registry entry sometimes sticks — causing this exact error.

The Fix

Skip the sledgehammer approach (sfc /scannow, DISM, or a system restore). In 90% of cases, the fix is re-registering the publisher using wevtutil. Here's how:

Open an elevated Command Prompt. Hit Win+X, select "Command Prompt (Admin)" or "Windows Terminal (Admin)".
List all registered publishers to find the problem one. Run:
```
wevtutil gp /en
```
This dumps a long list. Look for the publisher name in your error message — something like .NET Runtime, Microsoft-Windows-Security-Auditing, or Microsoft-Windows-Application-Experience.
Uninstall the problem publisher. Run:
```
wevtutil um <manifest-path>
```
But here's the trick — you need the manifest file that originally registered it. If you don't know the path, check the registry at:
```
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EventLog\<LogName>\<PublisherName>
```
Look for a value called ManifestFile. That's your path.

Re-install the manifest. Run:

wevtutil im <manifest-path>

For example, for .NET Runtime on a 64-bit system:

wevtutil im "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EventLogManifest.man"

Do the same for the 32-bit flavor if present:

wevtutil im "C:\Windows\Microsoft.NET\Framework\v4.0.30319\EventLogManifest.man"

Refresh Event Viewer. Hit F5 or restart the Event Viewer snap-in. The error should be gone.

What to Check If It Still Fails

Registry permissions. Right-click the publisher's key in Regedit, go to Permissions, and make sure NETWORK SERVICE and LOCAL SERVICE have Read access. I've seen malware or security tools lock these down.
Missing .NET Framework. If the manifest path doesn't exist, you might have a .NET version removed. Reinstall the appropriate .NET Framework from Control Panel -> Programs -> Turn Windows features on/off.
Corrupted Event Log file. Try clearing the specific log (right-click it in Event Viewer -> Clear Log) — but only if you're okay losing old events. Some publishers get stuck on a corrupted .evtx file.
Check for hard-coded SIDs. In rare cases, the registry's ProviderGuid value points to a guid that doesn't match any installed provider. Use wevtutil gp <publisher> /ge to verify the provider GUID matches what's in the registry. If not, update the registry key manually.

Last resort: System Restore to a point before the update. But that's the Hail Mary. In my 14 years, the wevtutil re-register fix worked 9 times out of 10. Try that first.