DivageekDesigns.comFree Online Resources for Designers and Developers

I run Vista on my computer at home and about 3 months after I bought it some of the Windows services stopped working out of the blue namely the Windows Event Log Viewer. Not having it hasn’t really caused me problems yet and I assumed the only way to fix it was to reinstall Vista..

So..I just ignored it.

Until a couple days ago when I was prompted to install the new Windows Service Pack 1 the installation failed and it returned Error Code 800706B5 on SP1.

So, I was forced to figure out how to fix the issue and I found a work around that worked like a charm. I finally got the Event Log Viewer running and I successfully installed the service pack.

I think what happens when you try to install the update is it trys to write to the system event file, finds that it’s non-operational, and then quits. That’s just a guess, though.

According to the forums it was discovered that the the issue has to do with permissions that have been configured incorrectly at some point. The evil lies within this folder… C:\Windows\System32\LogFiles\WMI\RtBackup and so you if you either delete it or rename the folder and reboot it will automatically re-create the folder and your issue will be fixed.  First I tried to rename the RtBackup folder but all I got was permission denied errors so I downloaded a client called Unlocker which worked. Some claime you can rename the folder in Safe Mode with UAC off. I already had UAC disabled; I just used the Unlocker application and I didn’t even try it in Safe Mode.

I’m such the tech rebel.. I know..

Download link: Unlocker

More detailed instructions on how to do it after the cut…..>

Unlocker helps delete locked files with error messages like:

- Cannot delete file: Access is denied
- There has been a sharing violation.
- The source or destination file may be in use.
- The file is in use by another program or user.
- Make sure the disk is not full or write-protected and that the file is not currently in use.Note that if you’re using UAC, you have to set “Run as administrator” on “Compatibility” tab for file C:\Program Files\Unlocker\Unlocker.exe

After installing and setting compatibility mode, go to C:\Windows\System32\LogFiles\WMI\RtBackup” right click on the RtBackup folder, select “Unlocker”, select “Rename” from drop-down list, type the new name for example “RtBackup1″ and click “OK” twice. If it fails it will ask you if you want to try again on the next reboot which is what I had to do; just select rename and enter the name you want.

Then Reboot.

Check your Windows Event Log Viewer to see if it’s running. Control Panel > Admin Tools > Event Viewer > Presto!

Install your Servce Pack

Let me know if you have any questions about this fix.

Read the Threads below where I found all the clues to the final conclusion. There is another work around but it was much more complicated and didn’t seem to always work:

• Error Code 800706B5 on SP1 Failed to Install thread
• Event log error 4201 - ERROR_WMI_INSTANCE_NOT_FOUND thread