How to Fix Windows 10 Cumulative Update Bug Breaking Down Event Viewer

[The AchieVer]

How to Fix Windows 10 Cumulative Update Bug Breaking Down Event Viewer 

 

The June 11 cumulative updates shipped by Microsoft on Patch Tuesday for Windows 10 device come with several notable improvements, but at the same time, they also include a bug that breaks down Event Viewer.

Event Viewer is a built-in Windows application that comes in handy especially for IT administrators, but it can be launched by any user, to access application logs and system messages, thus helping diagnose errors or trace certain events.

After installing these updates, however, Event Viewer no longer works as expected, with Microsoft acknowledging the bug this week.

Because of the bug, whenever users try to expand, view, or create custom views in the Event Viewer, the application might just crash or stop responding, with an error displayed on the screen indicating that “MMC has detected an error in a snap-in and will unload it.”

The error message comes with the following two options:

· Report this error to Microsoft, and then shut down MMC.
· Unload the snap-in and continue running

“You may also receive the same error using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected,” Microsoft notes.

The issue can be encountered on all supported versions of Windows after installing the following updates released on June 11:
 

KB4503293 LCU for Windows 10, version 1903.

KB4503327 LCU for Windows 10, version 1809 and Windows Server 2019.

KB4503286 LCU for Windows 10, version 1803.

KB4503284 LCU for Windows 10, version 1709.

KB4503279 LCU for Windows 10, version 1703.

KB4503267 LCU for Windows 10, version 1607 and Windows Server 2016.

KB4503291 LCU for Windows 10, version 1507.

KB4503276 Monthly Rollup for Windows 8.1 and Windows Server 2012 R2.

KB4503290 Security-only update for Windows 8.1 and Windows Server 2012 R2.

KB4503285 Monthly Rollup for Windows Server 2012 and Windows Embedded 8 Standard

KB4503263 Security-only update for Windows Server 2012 and Windows Embedded 8 Standard

KB4503292 Monthly Rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1

KB4503269 Security-only update for Windows 7 SP1 and Windows Server 2008 R2 SP1

KB4503273 Monthly Rollup for Windows Server 2008 SP2

KB4503287 Security-only update for Windows Server 2008 SP2

 
While Microsoft says a fix is already in development, users of affected devices can turn to the following workaround to view the previously-defined custom views in Event Viewer.

Launch PowerShell with administrator privileges by heading over to:

Right-click Start menu or press Windows key + X > Windows PowerShell (Admin)

Next, copy the following code and paste in the PowerShell window:

function get-EventViewer {
                Write-Output "List of custom views on the machine"
                Write-Output ""
                Get-ChildItem "C:\ProgramData\Microsoft\Event Viewer\Views" -Filter *.xml | % { select-xml -Path $_.FullName -xpath "//Name" } | Select-Object -ExpandProperty Node | Select-Object -ExpandProperty InnerXml

                Write-Output ""
                $view_name = Read-Host "Enter the name of custom view to execute"

                # Get the file name of the view
                $ViewFile = Get-ChildItem "C:\ProgramData\Microsoft\Event Viewer\Views" -Filter *.xml | where-object { (Select-Xml -Path $_.FullName -xpath "//Name").Node.InnerXml -eq $view_name }

                Get-WinEvent -FilterXml (

((Select-Xml -Path $ViewFile.FullName -XPath "//QueryList").node.OuterXml))

	}

	

	This method allows you to view existing custom views, and for the creation of new ones, you can use the instructions here to build more complex scripts that lets you do this until a full fix lands.

	

	As for the ETA when Microsoft is expected to release this fix, no specifics are available, but the late-June cumulative updates are expected to resolve the bug. A new round of cumulative updates that includes non-security fixes exclusively is due in two weeks.



	

		 
	



	 



	 



	Source 

[csmdew]

You can also go to the event viewer folder in programdata/microsoft/eventviewer , click on views folder and cancel/modify any custom log files  (View_0.xml, etc) and that will fix problem.  Remember to backup the files so you can put them back after MS issues a bug fix for this.