{"id":10065,"date":"2019-06-12T12:41:40","date_gmt":"2019-06-12T10:41:40","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=10065"},"modified":"2024-10-05T18:25:38","modified_gmt":"2024-10-05T16:25:38","slug":"windows-10-updates-kb4503293-kb4503327-kills-event-viewer","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2019\/06\/12\/windows-10-updates-kb4503293-kb4503327-kills-event-viewer\/","title":{"rendered":"Windows 10: Updates KB4503293\/KB4503327 kills event viewer"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline;\" src=\"http:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2015\/01\/win102.jpg\" width=\"58\" height=\"58\" \/>[<a href=\"https:\/\/www.borncity.com\/blog\/2019\/06\/12\/windows-10-ereignisanzeige-hngt-nach-update-kb4503293-kb4503327\/\" target=\"_blank\" rel=\"noopener noreferrer\">German<\/a>]After installing the June 2019 cumulative updates KB4503293\/KB4503327, Windows 10 users may notice that the Event Viewer no longer works when the Custom Views branch is selected. You will receive an error message. Here is a fix.<\/p>\n<p><!--more--><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/vg07.met.vgwort.de\/na\/ea07d8243e9c454eb55a052affee599e\" alt=\"\" width=\"1\" height=\"1\" \/>Affected are Windows 10, versions V1903 (Update <a href=\"https:\/\/support.microsoft.com\/help\/4503293\/\">KB4503293<\/a>) and V1809 (Update <a href=\"https:\/\/support.microsoft.com\/help\/4503293\/\">KB4503293<\/a>). If the Event Viewer is called and the Custom Views branch is selected, the display hangs. A dialog box appears with the message 'An error was detected in a snap-in and the snap-in is removed'.<\/p>\n<blockquote><p><strong>Note:<\/strong> Such an error usually indicates broken files. Mark Heitbrink gives the tip to empty the MMC cache in %appdata%\\Microsoft\\MMC. But that might not help in this case.<\/p><\/blockquote>\n<p>Furtunately the colleagues at German site deskmodder.de have described the error in <a href=\"https:\/\/www.deskmodder.de\/blog\/2019\/06\/12\/ereignisanzeige-startet-nach-update-mit-einer-fehlermeldung-loesung-windows-10-1903-und-1809\/#comments\">this blog post<\/a>. They gave the hint, that the message \"The process cannot access the file 'C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\View_0.xml' because it is used by another process\". is displayed in this context. The solution proposed by colleagues is therefore quite simple. Navigate to the following folder in Explorer:<\/p>\n<p>'C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\<\/p>\n<p>There you should find a file <em>View_0.xml<\/em> or with another consecutive number. This file must be deleted (requires administrator privileges). The MMC.exe will then recreate the <em>View_x.xml<\/em> at the next start if required and the display of the user-defined views should work again. Thanks to Matthias for the <a href=\"https:\/\/www.borncity.com\/blog\/2019\/06\/12\/patchday-updates-fr-windows-7-8-1-server-11-juni-2019\/#comment-73188\">hint<\/a> (and also to Max for the comment <a href=\"https:\/\/www.borncity.com\/blog\/2019\/06\/12\/patchday-windows-10-updates-11-juni-2019\/#comment-73182\">here<\/a>).<\/p>\n<h2>Addendum: A more extensive analysis<\/h2>\n<p>I've added a detailled analysis of the bug within my <a href=\"https:\/\/www.borncity.com\/blog\/2019\/06\/12\/windows-10-ereignisanzeige-hngt-nach-update-kb4503293-kb4503327\/\" target=\"_blank\" rel=\"noopener noreferrer\">German edition of this article<\/a>. There I describes, in which circumstances the bug occurs and what you can do as a temporary workaround.<\/p>\n<ul>\n<li>First of all, this crash occurs only, if custom views in event viewer are defined.<\/li>\n<li>Don't delete the <em>View_0.xml\u00a0<\/em>file (and others) &#8211; move em into a created backup folder, because the XML files contains your settings for custom views.<\/li>\n<li>Affected are not only Windows 10 V1903 and V1809, nearly all Windows versions, that has been patched with June 11, 2019, updates are showing this behavior.<\/li>\n<li>You can't use custom views anymore, until Microsoft delivers a fix &#8211; maybe it helps, to uninstall the June 2019 update.<\/li>\n<\/ul>\n<p>In some cases, it's not sufficient, to remove the XML files in<\/p>\n<p>C:\\ProgramData\\Microsoft\\ Event Viewer\\Views\\<\/p>\n<p>The event viewer also stores the data within the profile folder:<\/p>\n<p>C:\\Users\\&lt;account&gt;\\AppData\\Local\\Microsoft\\Event Viewer\\Views\\<\/p>\n<p>So you need to check both folders und move the xml files into a backup folder created.<\/p>\n<h2>Microsoft has confirmed the bug<\/h2>\n<p>At askwoody.com I found <a href=\"https:\/\/www.askwoody.com\/forums\/topic\/june-2019-patch-tuesday-is-rolling-out\/#post-1839052\" target=\"_blank\" rel=\"noopener noreferrer\">the hint<\/a>, that Microsoft has <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/release-information\/status-windows-10-1809-and-windows-server-2019#493msgdesc\" target=\"_blank\" rel=\"noopener noreferrer\">confirmed the bug<\/a>. They wrote:<\/p>\n<blockquote><p><b>Event Viewer may close or you may receive an error when using Custom Views<\/b><\/p>\n<p>You may receive an error and the app may stop responding or close when trying to expand, view or create <strong>Custom Views <\/strong>in Event Viewer. You may also receive an error using <strong>Filter Current Log<\/strong> in the <strong>Action <\/strong>menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.<\/p>\n<p><strong>Affected platforms:<\/strong><\/p>\n<ul>\n<li>Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1<\/li>\n<li>Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2<\/li>\n<\/ul>\n<p><strong>Next steps: <\/strong>We are working on a resolution and will provide an update in an upcoming release.<\/p><\/blockquote>\n<h3>Read custom event event view via PowerShell<\/h3>\n<p>Bleeping Computer has an <a href=\"https:\/\/www.bleepingcomputer.com\/news\/microsoft\/windows-10-v1903-v1809-updates-break-event-viewer-custom-views\/\" target=\"_blank\" rel=\"noopener noreferrer\">article here<\/a> mentions a<a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4508640\/event-viewer-may-close-or-you-may-receive-an-error-when-using-custom-v\" target=\"_blank\" rel=\"noopener noreferrer\"> workaround from Microsoft<\/a> to use custom event views using PowerShell.<\/p>\n<pre>function get-EventViewer {\r\n                Write-Output \"List of custom views on the machine\"\r\n                Write-Output \"\"\r\n                Get-ChildItem \"C:\\ProgramData\\Microsoft\\Event Viewer\\Views\" -Filter *.xml | % { select-xml -Path $_.FullName -xpath \"\/\/Name\" } | Select-Object -ExpandProperty Node | Select-Object -ExpandProperty InnerXml\r\n \r\n                Write-Output \"\"\r\n                $view_name = Read-Host \"Enter the name of custom view to execute\"\r\n \r\n \r\n                # Get the file name of the view\r\n                $ViewFile = Get-ChildItem \"C:\\ProgramData\\Microsoft\\Event Viewer\\Views\" -Filter *.xml | where-object { (Select-Xml -Path $_.FullName -xpath \"\/\/Name\").Node.InnerXml -eq $view_name }\r\n \r\n                Get-WinEvent -FilterXml ([xml]((Select-Xml -Path $ViewFile.FullName -XPath \"\/\/QueryList\").node.OuterXml))\r\n}<\/pre>\n<h3>These Updates are affected<\/h3>\n<p>Microsoft has confirmed the issue within <a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4508640\/event-viewer-may-close-or-you-may-receive-an-error-when-using-custom-v\" target=\"_blank\" rel=\"noopener noreferrer\">this support article<\/a>. Affected are the following updates and Windows versions:<\/p>\n<ul>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503293\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503293<\/a> LCU for Windows 10, version 1903.<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503327\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503327<\/a> LCU for Windows 10, version 1809 and Windows Server 2019.<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503286\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503286<\/a> LCU for Windows 10, version 1803.<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503284\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503284<\/a> LCU for Windows 10, version 1709.<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503279\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503279<\/a> LCU for Windows 10, version 1703.<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503267\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503267<\/a> LCU for Windows 10, version 1607 and Windows Server 2016.<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503291\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503291<\/a> LCU for Windows 10, version 1507.<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503276\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503276<\/a> Monthly Rollup for Windows 8.1 and Windows Server 2012 R2.<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503290\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503290<\/a> Security-only update for Windows 8.1 and Windows Server 2012 R2.<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503285\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503285<\/a> Monthly Rollup for Windows Server 2012 and Windows Embedded 8 Standard<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503263\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503263<\/a> Security-only update for Windows Server 2012 and Windows Embedded 8 Standard-<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503292\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503292<\/a> Monthly Rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503269\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503269<\/a> Security-only update for Windows 7 SP1 and Windows Server 2008 R2 SP1<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503273\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503273<\/a> Monthly Rollup for Windows Server 2008 SP2<\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4503287\" target=\"_blank\" rel=\"noopener noreferrer\">KB4503287<\/a> Security-only update for Windows Server 2008 SP2<\/li>\n<\/ul>\n<p><strong>Similar articles:<\/strong><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2019\/06\/12\/windows-10-updates-kb4503293-kb4503327-kills-event-viewer\/\">Windows 10: Updates KB4503293\/KB4503327 kills event viewer<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2019\/06\/16\/tip-powershell-workarounds-for-june-bug-in-windows-event-viewer\/\">Tip: PowerShell workarounds for June bug in Windows Event Viewer<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2019\/06\/16\/tip-powershell-workarounds-for-june-bug-in-windows-event-viewer\/\">Fixes for Windows event viewer bug (June 2019)<\/a><br \/>\n<a href=\"https:\/\/www.borncity.com\/blog\/2019\/06\/12\/windows-10-ereignisanzeige-hngt-nach-update-kb4503293-kb4503327\/\">Windows 7-10: Ereignisanzeige h\u00e4ngt nach Juni 2019-Update (KB4503293\/KB4503327 etc.)<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>[German]After installing the June 2019 cumulative updates KB4503293\/KB4503327, Windows 10 users may notice that the Event Viewer no longer works when the Custom Views branch is selected. You will receive an error message. Here is a fix.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[463,22],"tags":[47,1973,1974,195,76],"class_list":["post-10065","post","type-post","status-publish","format-standard","hentry","category-issue","category-update","tag-issue","tag-kb4503293","tag-kb4503327","tag-update","tag-windows-10"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/10065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=10065"}],"version-history":[{"count":1,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/10065\/revisions"}],"predecessor-version":[{"id":35478,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/10065\/revisions\/35478"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=10065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=10065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=10065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}