Fix ERROR_EVT_VERSION_TOO_OLD 0X00003ABA in Windows Event Log

What Is ERROR_EVT_VERSION_TOO_OLD?

This error pops up when Windows Event Log tries to load a resource file (like a .dll or .exe that provides event descriptions) but finds that resource is from an older version than the log expects. I've seen this most often on Windows 10 version 22H2 and Windows Server 2019 after a failed update or a third-party software install that replaced system files with older copies. The exact error code is 0X00003ABA, and it usually appears in the Application or System log, or when you try to open Event Viewer yourself and it hangs.

Don't panic. The fix is straightforward, and you can try the easiest option first.

Fix 1: Quick Command (30 Seconds)

Open Command Prompt as Administrator. No, seriously—right-click Start, choose "Command Prompt (Admin)" or "Windows PowerShell (Admin)". Run this:

wevtutil el

That lists all event logs. If it works, great—your core Event Log service is fine. The error is likely in a specific log. To check a specific log (say, Application), run:

wevtutil gp Application

If you see the error again, the next step is our friend.

Sometimes just running wevtutil refreshes the resource cache. I've had it work on a client's Windows 10 22H2 machine that threw this error after a botched driver update. If it doesn't, move on.

Fix 2: Re-register the Event Log Service (5 Minutes)

The Event Log service uses wevtsvc.dll. If that file is old or corrupt, you'll get this error. Here's the manual way to force it to use the correct version.

First, stop the service:

net stop eventlog

Then re-register the DLL:

regsvr32 /i wevtsvc.dll

Now restart the service:

net start eventlog

Open Event Viewer and see if the error is gone. If you still see 0X00003ABA, we need to dig deeper.

Opinion: Skip the SFC /scannow here—I've never seen it fix this specific error. DISM is overkill for this problem.

Fix 3: Manual Resource File Replacement (15+ Minutes)

This is the nuclear option, but it works. The error means a specific event provider (like Microsoft-Windows-Kernel-General or a third-party driver) has an outdated resource file under its registry key.

Step 1: Find the offending provider

Open Event Viewer. Look in the log where the error occurs. The error message usually includes the provider name, like "Provider Microsoft-Windows-User-Logger" or similar. Write it down.

Step 2: Locate the registry key

Open Regedit (as Administrator). Go to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\[Provider Name]

Replace [Provider Name] with your provider (e.g., Microsoft-Windows-User-Logger). Look for a string value named EventMessageFile. That points to the .dll or .exe that's too old.

Step 3: Check the file version

Right-click that .dll path in File Explorer, go to Properties > Details. Compare the file version to what Windows expects. For a Windows 10 22H2 system, most system files should be version 10.0.19041.x or later. If yours is 10.0.17134.x or older, that's the problem.

Step 4: Replace the file

Download the correct version from a reliable source (like a known-good Windows installation or the Microsoft Update Catalog). For system files, I recommend extracting from your own Windows installation media using dism /Get-WimInfo and dism /Export-Image to get the exact version you need. Then:

takeown /f "C:\Windows\System32\[file.dll]"
icacls "C:\Windows\System32\[file.dll]" /grant Administrators:F
copy /y "newfile.dll" "C:\Windows\System32\[file.dll]"

Step 5: Reboot

That's it. The error should be gone.

Warning: Don't mess with registry keys if you're unsure. Back up the key first (right-click > Export). And never replace a file from an untrusted source—stick with Microsoft-sourced files.

When to Give Up and Use a Different Log Tool

If none of these work, consider using Sysinternals DebugView or Log Parser 2.2 to read the logs directly without relying on the faulty resource. That's a workaround, not a fix, but sometimes you just need the data.

This error tripped me up the first time I saw it on a Windows Server 2019 box that had been patched out of order. The quick command saved me that day. Hope it does for you too.