EVENT_E_INVALID_PER_USER_SID (0X80040207) — Fixed

What triggers this error

This error shows up when a user account gets deleted from the system — either because someone removed it, or the machine left a domain — but the EventSystem still holds a per-user subscription pointing to that old SID.

You'll see it in the Event Viewer under Windows Logs > System, often paired with source "ESENT" or "EventSystem", sometimes hanging up services that rely on COM+ subscriptions. The exact message: EVENT_E_INVALID_PER_USER_SID (0X80040207) — "The owner security identifier (SID) on a per-user subscription does not exist."

The fix is to find that orphaned subscription and kill it. There are three common ways, depending on how deep you want to go.

Cause 1: Orphaned per-user subscription in the registry

This is the most common cause. A subscription record lives under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\Subscriptions key. When it points to a SID that's no longer on the machine, you get 0X80040207.

Find the bad SID

1. Open Regedit (regedit.exe) as Administrator — right-click and choose Run as administrator.
2. Go to:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\Subscriptions

3. You'll see a list of GUID-named subkeys (e.g., {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}). Click each one.
4. Look at the value named OwnerSID. If it's a long string of hex like S-1-5-21-..., that's a user SID.
5. To check if that SID still exists, open Command Prompt and run:

   wmic useraccount where sid='S-1-5-21-...' get name,sid

6. If it returns No Instance(s) Available, that SID is orphaned. Write down the GUID of that subkey.

Expected outcome: after running wmic, you'll either see a username or nothing. Nothing means you found your culprit.

Delete the orphaned subscription

1. Back up the key first: right-click the GUID subkey and choose Export. Save it as a .reg file somewhere safe.
2. Right-click that same GUID subkey and choose Delete.
3. Close Regedit.
4. Reboot the machine — or restart the EventSystem service from an Admin command prompt:

   net stop eventsystem && net start eventsystem

After reboot or service restart: check Event Viewer again. The 0X80040207 errors should stop. If they don't, move to Cause 2.

Cause 2: Corrupt subscription in the COM+ catalog

Sometimes the registry is clean but the COM+ catalog itself holds a corrupted subscription record. This happens more often on Server 2016 and Server 2019 after a domain user gets removed.

Nuke it with the COM+ admin tool

1. Open an Administrative Command Prompt.
2. Run:

   COMEXP.MSC

3. In the left pane, expand Component Services > Computers > My Computer.
4. Right-click COM+ Applications and choose Properties.
5. Go to the Advanced tab.
6. Under Subscription Manager, click Delete All Per-User Subscriptions. This button wipes every per-user subscription on the machine — not just the bad one.
7. Click OK and close the console.
8. Reboot.

Warning: This removes all per-user subscriptions. If you have any custom ones — like from third-party software — you'll need to reinstall or reconfigure that software afterward. That's the price of a clean sweep.

Check if it worked

After reboot, open Event Viewer and look for the error. If it's gone, you're done. If it persists, the subscription is probably embedded deeper — see Cause 3.

Cause 3: Stale SID in a user-profile-related subscription

On Windows 10 and 11, some per-user subscriptions are tied to user profiles that were deleted but the profile registry hive wasn't properly unloaded. This is rare but nasty.

Find and fix the profile

1. Open Regedit as Administrator.
2. Go to:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

3. Look for SID subkeys under that key. Each subkey name is a SID.
4. Click each one and look at the value State. If it's 0, the profile is active. If it's 2 or 4, the profile is loaded but orphaned.
5. Also look at ProfileImagePath — if it points to a folder that doesn't exist (like C:\Users\DeletedUser), that profile is dead.
6. For any SID that's both stale and showing State = 2, do this:
   • Open an Admin Command Prompt.
   • Run:

     reg unload HKU\SID-NAME

     — but you can't unload a hive that's currently in use. Instead, use:

     reg delete HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\SID-NAME /f

   • Then delete the profile folder if it still exists:

     rmdir /s /q C:\Users\DeletedUser

7. Reboot.

Expected outcome: after reboot, the stale profile SID is gone, and the EventSystem subscription pointing to that SID can't load — so it gets cleaned automatically. The error should disappear.

Quick-reference summary table

Start with Cause 1 — it fixes 80% of cases. If that doesn't work, go to Cause 2. Cause 3 is last resort. Don't skip the backup step in Cause 1; sometimes you delete the wrong subscription and need to restore. I've seen that happen more than once.