Fix 0x3A9A: Publisher metadata not found in Event Viewer

You open Event Viewer and see Event ID 15016 with the text "The publisher metadata cannot be found in the resource." It shows up after you install a new program (especially security or backup software) or after a Windows update that didn't finish cleanly. The error usually appears in the Applications and Services Logs section, and it blocks you from seeing events from that specific software. The event log itself still works, but that one publisher's events are blank.

What causes this error

The error code 0x00003A9A means Windows looked for the metadata file (.dll or .exe with embedded event manifest) for a registered event publisher but either can't find the file, the file is missing, or the registry pointer points to a wrong path. This is not a hardware problem. It's a registry-to-file mismatch.

Most of the time, it happens because the software was partially uninstalled, or an upgrade left the old publisher entry but deleted the file. Sometimes antivirus quarantines the metadata file. Rarely, the Event Log service itself has a corrupt cache of publisher info.

How to fix it

These steps work on Windows 10 (all versions) and Windows 11. You'll need an administrator account.

Identify the publisher name.
In Event Viewer, double-click Event ID 15016. Look in the Details tab for the PublisherGuid or ProviderName. Write it down. Example: {12345678-1234-1234-1234-123456789ABC} or a name like AcmeBackup.
Expected outcome: You'll have either a GUID or a friendly name.
Open Command Prompt as admin.
Press Win+R, type cmd, press Ctrl+Shift+Enter. Click Yes on the UAC prompt.
Expected outcome: A black Command Prompt window opens.
Dump the publisher info using wevtutil.
Type this command and press Enter:
```
wevtutil gp <PublisherName> /ge /gm /e > %temp%\pubmeta.txt
```
Replace <PublisherName> with the name or GUID from step 1. For GUIDs, include the curly braces. Example:
```
wevtutil gp {12345678-1234-1234-1234-123456789ABC} /ge /gm /e > %temp%\pubmeta.txt
```
Expected outcome: A file pubmeta.txt appears in your Temp folder. If you get "The specified provider name cannot be found", the publisher is orphaned and you need to skip to step 6.
Check the metadata path in the registry.
Press Win+R, type regedit, press Enter. Navigate to:
```
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{PublisherGUID}
```
In the right pane, look for a string value named ResourceFileName. Double-click it and copy the full path.
Expected outcome: You see a file path like C:\Program Files\SomeApp\metadata.dll. If the path points to a file that doesn't exist, that's your problem.
Reinstall or repair the software.
If the file is missing, run the software's installer again. Choose Repair if available, or just reinstall. This replaces the missing metadata file.
After reinstall, run wevtutil gp again to confirm it works. No error = fixed.
Expected outcome: Event ID 15016 stops appearing.
If the publisher is orphaned (not found in registry):
You have to unregister it manually. In the admin Command Prompt, run:
```
wevtutil um <PublisherGUID>
```
Again, use curly braces if it's a GUID. If you only have the name, convert it to GUID first: run wevtutil el and look for the name. The GUID is listed next to it in brackets.
Expected outcome: Command completes silently. Check Event Viewer – the 15016 error should disappear.
Clear the Event Log service cache (last resort).
If nothing else works, the metadata cache inside the Event Log service might be corrupt. Stop the service, delete the cache file, restart it.
In admin Command Prompt:
```
net stop eventlog

del "%SystemRoot%\System32\winevt\Logs\*EventLog-published*" /q

net start eventlog
```
Expected outcome: Service restarts, cache rebuilt. This clears all published metadata, so you'll need to re-register any custom publishers by running their installers again.

What to check if it still fails

Check file permissions. The Event Log service runs as NT SERVICE\EventLog. Right-click the metadata file, go to Security, make sure that account has Read and Execute access.
Look in the Application event log for errors from EventLog-EventSource. Those errors give more detail, like missing DLL dependencies.
Run System File Checker. Open admin Command Prompt and run sfc /scannow. Wait for it to finish. This fixes corrupted Windows files that might affect the Event Log service.
If the software is uninstalled but the publisher remains, use wevtutil um with the GUID to remove it. That's the cleanest fix.
As a brutal last step, you can export the event logs, then clear everything using wevtutil cl Application and wevtutil cl System. Then reinstall all affected software. That nukes the problem at the cost of your log history.

I've seen this exact error from a backup program that left its metadata in a temp folder that got cleaned by Disk Cleanup. Reinstalling the program fixed it in five minutes. Don't overthink this one – the fix is usually simpler than you'd expect.