Fix ERROR_EVT_CHANNEL_NOT_FOUND 0x00003A9F in Event Viewer

Event Viewer can't find a channel that's been deleted or corrupted. This typically happens after a Windows update or a bad uninstall. Here's how to fix it fast.

Start Here: 30-Second Fix

The quickest way to get your Event Viewer working again is to rebuild the log files. Don't bother with SFC or DISM first — they rarely fix this specific error. The culprit here is almost always a corrupted log file or a missing registry entry.

Open Command Prompt as Administrator. Hit Windows Key + X, then select Command Prompt (Admin) or Windows Terminal (Admin).
Stop the Windows Event Log service by running:
```
net stop eventlog
```
Delete the corrupt log files. I've seen this error with Application.evtx, System.evtx, and Security.evtx most often. Delete the one showing the error. For example:
```
del C:\Windows\System32\winevt\Logs\Application.evtx
```
Restart the service:
```
net start eventlog
```
Open Event Viewer (eventvwr.msc) and check if the error is gone.

Note: Windows will recreate the log file automatically when the service starts. You might lose older log entries, but the error resolves instantly in most cases.

Moderate Fix: 5 Minutes

If the quick fix didn't work, the problem is likely in the registry. Windows stores the location of each event log channel under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\. If a channel reference is broken, you'll keep getting 0x00003A9F.

Open Registry Editor (regedit.msc) as Administrator.

Navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application

Look for the channel name mentioned in the error. Common ones: Microsoft-Windows-User-Logger/Operational, Microsoft-Windows-Kernel-Process/Operational, or a custom app channel. The error message in Event Viewer will tell you exactly which channel is missing.
Right-click the key and export it as a backup before making changes.
Delete the key for the missing channel. Yes, delete it. The channel will be recreated by the source provider the next time it logs an event.
Close Registry Editor and reboot. Open Event Viewer again — the error should be gone.

Seriously: don't try to recreate the key manually. The registry structure for event channels is complex and you'll mess it up. Just delete the broken reference.

Advanced Fix: 15+ Minutes

For cases where both fixes above fail — usually after a Windows feature update or a third-party app uninstall that nuked a provider — you'll need to re-register the event source. This happens a lot with .NET applications and SQL Server.

Open an elevated PowerShell window (Run as Administrator).
Find the provider name from the error. If it's a Microsoft channel like Microsoft-Windows-PowerShell/Operational, run:
```
wevtutil install-manifest C:\Windows\System32\WindowsPowerShell\v1.0\psevents.dll
```
But that's rare. More often, it's a custom provider. Use wevtutil el to list all channels. If the channel isn't listed, you need to reinstall the source software.

For .NET apps, re-register the event source with:

EventCreate.exe /ID 1 /L Application /T Information /SO "YourAppName" /D "Rebuilding source"

For Windows system channels, run a repair install of the offending component. For example, if the channel belongs to the Task Scheduler service:
```
Dism /Online /Cleanup-Image /RestoreHealth
```
If none of that helps, reset the entire Event Log registry key. This is nuclear, but it works when nothing else does:
```
reg delete HKLM\SYSTEM\CurrentControlSet\Services\EventLog /f
```
Then reboot. Windows will reinitialize all event log channels from scratch. You'll lose all logs, but the error won't return.

When to Give Up and Rebuild

If you're still seeing 0x00003A9F after all this, the problem is deeper — a corrupted system component that references a channel that can't be recreated. I've only seen this twice in 14 years. Both times, an in-place upgrade (using Windows 10/11 installation media with Keep personal files and apps) fixed it. That's your last resort.

Common Scenario That Triggers This

This error pops up most often right after uninstalling an antivirus or a management agent (like Symantec Endpoint Protection or SCCM client). Those tools register their own event channels. When they uninstall badly, the channel's registry key gets removed but the Event Viewer still tries to access it. If that's your case, skip straight to the registry fix — you'll save 5 minutes.