Fix Event Log channel not enabled error 0x80300111

You're looking at error 0x80300111 and it's telling you the Microsoft-Windows-TaskScheduler event log channel is disabled. That's a pain because it blocks logs, scheduled tasks, and sometimes performance monitoring from working right. Let's get it sorted.

The quick fix: re-enable the channel with wevtutil

Open Command Prompt as Administrator. Don't skip this — click Start, type cmd, right-click Command Prompt, choose Run as administrator. You'll see the User Account Control prompt pop up — click Yes.

Now run this command exactly:

wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:true

After you press Enter, you should see no output — just the command prompt returns to a blank line. That's normal. If it worked, the channel is now enabled.

Test it by running this:

wevtutil gl Microsoft-Windows-TaskScheduler/Operational

Look for the line that says enabled: true. If you see that, you're good. If it still says enabled: false, move on to the registry method below.

When wevtutil doesn't work — fix via Registry

Sometimes the channel is so corrupted or locked that wevtutil can't change it. The registry fix bypasses that.

Open Registry Editor: press Windows Key + R, type regedit, press Enter. Click Yes on the UAC prompt.

Go to this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational

On the right side, you'll see a value named Enabled. Double-click it. Set it to 1 (hexadecimal). Click OK.

Close Registry Editor. Reboot your PC or restart the Windows Event Log service. To restart the service: open Services.msc, find Windows Event Log, right-click it, choose Restart. You'll see a warning about services that depend on it — that's fine, just click Yes.

After the restart, check the channel again with:

wevtutil gl Microsoft-Windows-TaskScheduler/Operational

It should now show enabled: true. The error should be gone.

Why this error happens

The channel got disabled for one of three reasons:

• A group policy pushed a disabled state. Admins sometimes lock down event logs to save space, but they can accidentally disable the wrong channel.
• A third-party cleanup tool turned it off. Tools like CCleaner or BleachBit have options to "clear event logs" — some versions also disable the channels, not just clear them.
• Manual meddling. Someone (or a script) ran wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:false thinking they were disabling logging entirely.

The TaskScheduler channel is important because Windows uses it to log every scheduled task action — start, stop, failure. Without it, Task Scheduler itself still runs, but you lose the audit trail. That's why the error shows up when you try to query performance logs or certain Event Tracing for Windows (ETW) sessions.

Less common variations of this issue

You might see 0x80300111 pop up in different contexts. Here's what they mean:

• In Performance Monitor: When you try to create a Data Collector Set, you get this error. Fix: enable the channel as above, then restart Performance Monitor.
• In PowerShell: Running Get-WinEvent -LogName Microsoft-Windows-TaskScheduler/Operational returns the error. Fix: same channel enable, then run Restart-Service -Name EventLog.
• In a custom application using ETW: The app might crash or log the error to its own log. Fix: enable the channel, then restart the app.
• After a Windows Update: Some cumulative updates reset channel states incorrectly. Fix: re-enable it — it usually sticks after that.

There's also a rarer case where the channel doesn't exist in the registry at all. If the registry key from the section above is missing, you can recreate it. That's an advanced step — you'd export the channel definition from a working machine and import it. But 95% of the time, the channel is there but disabled.

Prevention — keep this from coming back

One thing I tell every tech: stop using third-party disk cleanup tools that touch event logs. The built-in Disk Cleanup (cleanmgr.exe) is safe — it only clears logs, never disables channels. If you gave permission to a tool to "optimize event logs" in the past, undo that setting.

If you're managing a fleet of machines with Group Policy, check the policy path Computer Configuration > Administrative Templates > Windows Components > Event Log Service > Security. There's a setting called "Control Event Log behavior when the log file reaches its maximum size" — that's fine to configure. But avoid policies that directly disable specific channels unless you really mean it.

Finally, add this to your standard troubleshooting script: run wevtutil gl Microsoft-Windows-TaskScheduler/Operational and check the enabled state. Catching this early saves you the headache later.

That's the whole fix. No reboot magic, no third-party tools. Just the registry or wevtutil, and you're back in business.