Fix ERROR_EC_LOG_DISABLED (0x00003AE9) in Windows Event Forwarding

This error means the subscription log is stuck disabled. Quick registry or PowerShell fix usually resolves it without reinstalling the Collector service.

What's the 0x00003AE9 Error Really Telling You?

You're trying to forward events from a source computer to a collector, and you get ERROR_EC_LOG_DISABLED (0x00003AE9). The message says: "The log of the subscription is in a disabled state and events cannot be forwarded to it."

In plain English: The Windows Event Collector service (wecsvc) created a subscription log file on the collector machine, but something corrupted its internal state. I've seen this most often after a forced reboot of a domain controller that hosts the collector role. The log file thinks it's disabled, even though you've done nothing to disable it.

Here's the fix flow. Start with the simplest, stop when it works.

Quick Fix (30 seconds): Restart the Windows Event Collector Service

Sometimes the service just needs a fresh kick. Doesn't always fix the underlying registry issue, but it's free to try.

Open a Command Prompt as Administrator.
Type: net stop wecsvc && net start wecsvc
Wait 10 seconds, then test the subscription again.

If the error goes away, you're done. If not, don't waste time trying to restart it multiple times—move to the next step.

Moderate Fix (5 minutes): Reset the Subscription Registry Key

Had a client last month whose entire print queue died because of this exact issue on their collector server. The registry key that controls the subscription's enabled state gets stuck. Here's how to force it back to enabled.

Open Registry Editor as Administrator (regedit).

Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\Subscriptions

You'll see one or more subkeys with GUIDs. Look for the one matching your problematic subscription.
Inside that key, find Enabled (DWORD). Set it to 1.
Also check HeartbeatInterval and LogFile—if LogFile points to a path that doesn't exist, create that path manually.

After changing the value, restart the Event Collector service (net stop wecsvc && net start wecsvc). Test the subscription. If it's still failing, someone—or something—keeps resetting that Enabled value back to 0. That points to a deeper issue.

Advanced Fix (15+ minutes): Delete and Recreate the Subscription via PowerShell

This is the nuclear option and it always works. I've had to do this on Server 2016 and 2019 boxes where the registry key kept reverting. Something in the subscription metadata is corrupt.

First, identify the subscription name. On the collector machine, run:

Get-WmiObject -Namespace "root\Microsoft\Windows\EventCollector" -Class Subscription

Grab the SubscriptionId (a GUID) for your broken subscription.

Now, store it in a variable and delete it:

$subId = "
$sub = Get-WmiObject -Namespace "root\Microsoft\Windows\EventCollector" -Class Subscription -Filter "SubscriptionId='$subId'"
$sub.Delete()

Wait 10 seconds, then verify it's gone: Get-WmiObject -Namespace "root\Microsoft\Windows\EventCollector" -Class Subscription should return nothing for that ID.

Now recreate the subscription. The best approach is to export the subscription from another working collector (or from a backup of the subscription XML). If you don't have that, use the Event Viewer GUI on the collector to create a new subscription with the same settings:

Open Event Viewer on the collector.
Right-click Subscriptions → Create Subscription.
Name it exactly the same as before (case-sensitive).
Set the log name, source computers, and events to collect.
Under Advanced, choose Minimize Bandwidth (or whatever your original setting was).
Click OK.

After recreation, run Get-WmiObject -Namespace "root\Microsoft\Windows\EventCollector" -Class Subscription again to confirm the new subscription appears. Then restart the service one more time: net stop wecsvc && net start wecsvc.

Test forwarding a test event from a source computer. If you see events arriving in the collector's Forwarded Events log, you're golden. If not, check the source computer's Event Viewer for errors in the Microsoft-Windows-Forwarder/Operational log—that's a different beast.

Why This Happens (So You Can Prevent It Next Time)

Every time a subscription is created, Windows writes a registry key with an Enabled flag and creates a dedicated log file under %SystemRoot%\System32\winevt\Logs\. If that log file gets corrupted—say, by a crash, disk full, or antivirus interference—the Enabled flag flips to 0 and won't auto-recover. The service sees the flag and says, "Yep, can't forward to a disabled log."

Prevention: Avoid setting the subscription log file path to a network drive or removable media. Keep plenty of disk space on the collector. And if you're using antivirus, exclude %SystemRoot%\System32\winevt\Logs\ from real-time scanning—I've seen McAfee and Symantec kill event logs dead.

Pro tip: Always take a screenshot of your subscription settings before deleting and recreating. You'll thank yourself when you're staring at a blank dialog trying to remember the exact XPath query.

That's it. Start with the quick fix, escalate only if needed. Nine times out of ten, the registry reset does it. The other one time, the PowerShell delete/recreate method saves your bacon.