Windows Event Log service will not start, it says "Error 2: The system cannot find the file specified." I've tried sfc /scannow and it reported zero issues. All other services start up fine, so svchost.exe isn't the issue. I'm guessing there is some permission or path issue or missing file, but I don't what I should do to find out where it is failing. Is process explorer useful in this situation? If so, what do I watch for?

Windows error


After watching what failed using Process Monitor, the "fix" for my particular situation was to create a registry key at HKLM\System\CurrentControlSet\services\eventlog\Parameters\ServiceDll containing the same value as the key HKLM\System\CurrentControlSet\services\eventlog\ServiceDll

I'm a big fan of mysterious windows self-reconfigurations.

  • 3
    Have you checked the logs? Oh wait....
    – mfinni
    Jun 14, 2011 at 19:47
  • Thanks for updating with specific information. Saved me loads of annoyances. Mar 1, 2012 at 8:22

2 Answers 2


Process Monitor would be more useful than Process Explorer. You would filter on only the executable that is used by the service. I don't have a Win7 box in front of me, so I can't check what that is.

Run it, try to start the service, and see what fails.

  • 2
    Thanks for the tip on process monitor, I was able to see that it was looking for a registry key that doesn't exist and created the key with the value it was looking for. Perhaps a screwy windows update changed something. The key used to be found at HKLM\System\CurrentControlSet\services\eventlog\ServiceDll but I had to create it at HKLM\System\CurrentControlSet\services\eventlog\Parameters\ServiceDll for it to work.
    – jayrdub
    Jun 14, 2011 at 21:48
  • fantastic news.
    – mfinni
    Jun 14, 2011 at 21:59

Are the event logs trying to write to a location that isn't there? Rt-Click on a particular windows event log and select properties. Look at the path that the logs are writing to. Is it something other then the default windir, for example another drive that isn't there?

  • To add to this, check the path of the executable, which is under the general tab. For windows 7 it should say something like C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    – Nixphoe
    Jun 14, 2011 at 19:12
  • If you find the exe, or it's path, isn't right: this could be a sign of pending hard disk or hard-disk/RAID controller failure, or of course a nice little virus/trojan/malware infection.
    – DutchUncle
    Jun 14, 2011 at 19:21
  • @UnisoftDesign: I'm failing to see how a failing HDD or controller would alter the path. Malware, yes.
    – joeqwerty
    Jun 14, 2011 at 20:32
  • I don't know what you mean by your first suggestion of "Rt-Click on a particular windows event log and select properties. Look at the path that the logs are writing to." The event viewer won't run because the event log doesn't run. Sure there are a bunch of files in C:\Windows\System32\winevt\Logs but looking at those files does me no good, their permissions seem fine. The "path to executable" of the service is there and permissions seem fine.
    – jayrdub
    Jun 14, 2011 at 21:28
  • @ joeqwerty: "If you find the exe ... isn't right:"
    – DutchUncle
    Jun 14, 2011 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.