Windows 10: Event Viewer error after installing KB4503293 and KB4503327

Windows administrators who open the local Even Viewer after installation of KB4503293 or KB4503327 may receive an error message when they select Custom Views in the Event Viewer.

Microsoft released cumulative updates for all supported versions of Windows 10 (and other Microsoft operating systems) on yesterday's Patch Day.

KB4503293 for Windows 10 version 1903 and KB4503327 for Windows 10 version 1809 were among those patches. The cumulative updates closed several security vulnerabilities -- some of which rated with a critical severity -- and introduced other changes on devices running these versions of Windows.

Updates may introduce errors and issues, and that appears to be the case with KB4503293 and KB4503327.

Windows users who open the Event Viewer, e.g. by using the Windows-X menu or searching for Event Viewer in the Start Menu, may receive the error "MMC has detected an error in a snap-in and will unload it" on start when custom views are selected.

The only options provided by the dialog are to "report this error to Microsoft, and then shut down MMC", or to "Unload the snap-in and continue running".

Selecting the latter throws an "unhandled exception in Managed Code Snap-In" which causes quite the chaos in the Event Viewer.

The only option left at that point is to restart the Event Viewer. Problem is: the error is thrown again once you select custom views in the application.

Update: Microsoft confirmed the issue and published a workaround to resolve the issue. Admins need to run the following command using PowerShell:

function get-EventViewer {
Write-Output "List of custom views on the machine"
Write-Output ""
Get-ChildItem "C:\ProgramData\Microsoft\Event Viewer\Views" -Filter *.xml | % { select-xml -Path $_.FullName -xpath "//Name" } | Select-Object -ExpandProperty Node | Select-Object -ExpandProperty InnerXml

Write-Output ""
$view_name = Read-Host "Enter the name of custom view to execute"

# Get the file name of the view
$ViewFile = Get-ChildItem "C:\ProgramData\Microsoft\Event Viewer\Views" -Filter *.xml | where-object { (Select-Xml -Path $_.FullName -xpath "//Name").Node.InnerXml -eq $view_name }

Get-WinEvent -FilterXml ([xml]((Select-Xml -Path $ViewFile.FullName -XPath "//QueryList").node.OuterXml))
}

End

Our colleagues over at Deskmodder found a solution that fixes the issue. Here is what you need to do:

1. Open File Explorer on the device.
2. Navigate to the following path: C:\ProgramData\Microsoft\Event Viewer\Views
3. Backup the content of the folder. The next step deletes the custom views and you may want the backup to restore the views when Microsoft fixes the issues.
4. Delete all View_X.xml files in the folder (it starts with View_0.xml and increments the number by 1 for each file).
5. Start the Event Viewer after deleting the files.

The error should be gone after the deletion. A restart is not required to fix the issue.

Advertisement