Fix ERROR_EVT_PUBLISHER_DISABLED (0X00003ABD) in 3 Steps

This error means a Windows Event Log publisher got turned off. Quick fixes: enable it in Event Viewer or run a PowerShell command. Advanced reset for stubborn cases.

What's Going On?

You're getting ERROR_EVT_PUBLISHER_DISABLED (0X00003ABD) — that nasty little message that says "The publisher has been disabled and its resource is not available". I've seen this pop up mostly in Windows 10 and 11 after a failed update or when an app like Microsoft Office or SQL Server installs wonky event providers. It just means the event source (publisher) is turned off, so Windows can't log its events. Annoying? Yes. Hard to fix? Nope.

Let's walk through it from easiest to nuclear option. You can stop anytime.

Fix 1: The 30-Second Enable in Event Viewer

This works about 60% of the time. Open Event Viewer — hit Win + R, type eventvwr.msc, press Enter.

On the left, expand Windows Logs — pick Application or System (whichever log gave you the error).
Right-click the log and choose Properties.
Look at the bottom: Log path shows you where the log file lives.

But here's the real trick: Go to Event Viewer root, then Applications and Services Logs — find the publisher that's disabled. Right-click it and Enable Log. If you don't see it listed, skip to Fix 2.

That's it. If the option isn't available or the error persists, move on.

Fix 2: PowerShell One-Liner (5 Minutes)

I use this when the GUI is being stubborn. Open PowerShell as Administrator — right-click Start, choose Windows Terminal (Admin) or PowerShell (Admin).

First, find the disabled publisher. Run:

Get-WinEvent -ListLog * | Where-Object {$_.IsEnabled -eq $False}

That lists all disabled logs. Note the LogName value — usually something like Microsoft-Windows-Something/Operational. Then enable it:

wevtutil sl "LogName" /e:true

Replace LogName with the actual name from the list. For example:

wevtutil sl "Microsoft-Windows-Backup/Operational" /e:true

If you get a parameter incorrect error, the log might not exist — check the spelling. I once spent ten minutes because of a stray space.

Test: run your app again or check Event Viewer. Error gone? You're done.

Fix 3: Registry Reset (15+ Minutes, Advanced)

Still broken? The publisher's registry key might be corrupted. Happens after a botched update or manual registry edit. Back up your registry first — File > Export in regedit.

Open Registry Editor (type regedit in Run). Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PublisherName

Replace PublisherName with the actual publisher (like Microsoft-Office). Look for a DWORD called Enabled — if it's set to 0, that's the culprit. Double-click and change it to 1.

No Enabled key? Create one: right-click in the right pane, New > DWORD (32-bit), name it Enabled, set value to 1.

Restart the Windows Event Log service: open Services.msc, find Windows Event Log, right-click Restart.

If the error still shows, you might need to uninstall the offending software and reinstall it fresh. I've seen this with Adobe Creative Cloud and VMware Tools — their event publishers sometimes break after an update.

When to Give Up and Use System Restore

Last resort: System Restore to a point before the error started. Hit Win + R, type rstrui, pick a restore point from when things worked. This reverts the registry and event log settings without touching your files.

And if you made it this far, I'm betting Fix 1 or 2 already did the job. You're welcome.