Issue #1 - Event Viewer keeps closing in v1903

Desktop Windows 10 Pro, version 1903, OS Build 18362.476 - upgraded from v1809 to v1903 on Nov. 17, 2019.
I've read through numerous web posts about this issue but none of the suggestions worked. None of the KB updates in relation to this issue were installed, so there was nothing to uninstall.

Thanks for the suggestion, but please try to be more helpful.

If I have problems with v1903 which was released 6 months ago, I can imagine the problems with v1909. I am too experienced to waste another half day on upgrading and configuring the new settings and reconfiguring the old. As it is now and as it always was, MS software updates never respected users' settings and reset them to what they want. This is a constant irritation from decades past.

Have you tried running DISM and SFC commands from an Elevated Command Prompt to see if they clear up the problem? Run up to 3 times until you get a clean run from each.

Dism /Online /Cleanup-Image /StartComponentCleanup
Dism /Online /Cleanup-Image /RestoreHealth
SFC /scannow

@Ztruker, thanks for the advice. Before posting here, I scour the web and read up on this issue extensively. I've done what you you suggested, but not several times as you suggested. I will do that now. Also ran chkdsk c: /v/f.

- - - Updated - - -

It's interesting that dism is used before sfc. Always started with sfc /scannow first, and wait for its report at completion. I used the following order of repair.
Dism /Online /Cleanup-Image /StartComponentCleanup - Found nothing wrong
Dism /Online /Cleanup-Image /RestoreHealth - Restored the image
SFC /scannow - Reported error
Dism /Online /Cleanup-Image /RestoreHealth - It restored the image again
SFC /scannow - Everything is OK

Event Viewer still crashed, so I deleted the Event logs and when reopened it stayed open. Deleted the Event logs again, and rebooted to see what are the most recent errors. The event viewer' Administrative Events listed numerous mmc.exe related errors by various processes.

So now it works. . . Thanks

P.S: My current assumption is that the mmc.exe errors indicate that it will probably crash again once the System log grows.

The MMC that you commented on was reported in this Microsoft link:
https://support.microsoft.com/en-us/...using-custom-v

Code:

Event Viewer may close or you may receive an error when using Custom Views
Applies to: Windows 10, version 1903Windows 10, version 1809Windows Server 2019, all versions

Summary

When trying to expand, view or create Custom Views in Event Viewer, you may receive the error, "MMC has detected an error in a snap-in and will unload it." and the app may stop responding or close. You may also receive the same error using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.


In the link they displayed a powershell work around:

Code:

Workaround

To work around this issue, copy and paste the following function into a PowerShell window and run it.  You can now use the command get-EventViewer at the PowerShell prompt to view your Custom Views. You will need to re-enter the function each time you open a new PowerShell window. Note The get-EventViewer function will only allow you to view previously defined Custom Views.  To create new Custom Views, see Creating Get-WinEvent queries with FilterHashtable.

function get-EventViewer {
                Write-Output "List of custom views on the machine"
                Write-Output ""
                Get-ChildItem "C:\ProgramData\Microsoft\Event Viewer\Views" -Filter *.xml | % { select-xml -Path $_.FullName -xpath "//Name" } | Select-Object -ExpandProperty Node | Select-Object -ExpandProperty InnerXml
 
                Write-Output ""
                $view_name = Read-Host "Enter the name of custom view to execute"
 
 
                # Get the file name of the view
                $ViewFile = Get-ChildItem "C:\ProgramData\Microsoft\Event Viewer\Views" -Filter *.xml | where-object { (Select-Xml -Path $_.FullName -xpath "//Name").Node.InnerXml -eq $view_name }
 
                Get-WinEvent -FilterXml ([xml]((Select-Xml -Path $ViewFile.FullName -XPath "//QueryList").node.OuterXml))

This problem was not reported for Windows 1909.

Consider that as another option.




There are log collectors used in another forum room.
Please upload V2 into this thread:
BSOD - Posting Instructions

sfc /scannow reports no system file problems but DISM repaired it, . . . for a while, and now it went dead again.

I know that venting here or anywhere else is useless, but this problem existed since its release in the spring.

As for upgrading to 1909, where this is not a problem, but what other issues will crop up at this early stage? I would like to wait for awhile for more info on the bugs.

zbook, thanks for the instructions. The Macrium backup is not a problem. I often had to restore, and I have several backups in descending date order. I am starting with a clean boot because I suspect app software to be the problem. Also have the ISO file and the USB created from it.

- - - Updated - - -

ineuw said:

zbook, thanks for the instructions. The Macrium backup is not a problem. I often had to restore, and I have several backups in descending date order. I am starting with a clean boot because I suspect app software to be the problem. Also have the ISO file and the USB created from it.

The clean boot did not help. Then I tried the in-place update and ended up with rel.1909. This failed with the event viewer as well. A clean install of 1909 may help but this means that all my ~50 apps must be installed. So, I restored the mirror of Dec 8 at which date the Event Viewer worked before it failed again. My take is that this is caused by a bad app software, and the problem is how to find it.
@zbook, regardless of the outcome, I really appreciate the info you provided .