The error you're seeing in Event Viewer, “Failure opening metadata of the owning provider for channel: hLastResult = The system cannot find the file specified,” typically indicates that Windows is trying to access an event log channel whose metadata is missing or corrupted. This often happens when:
The system was migrated across platforms (like VMware to Hyper-V)
Certain services or features were removed or reconfigured
Event log providers were not properly registered post-migration
Here’s how you can address it:
Rebuild Event Log Metadata
- Open Command Prompt as Administrator
- Run: powershell wevtutil.exe el | foreach {wevtutil.exe gl $_} *This will list all event logs and attempt to load their metadata. Logs that fail will help you identify which providers are broken.
Re-register Affected Providers
If you identify specific services (e.g., DNS, AD DS) with broken logs, you can re-register their event providers using:
Powershell
wevtutil.exe im <path-to-manifest>.man
*You’ll need the .man file from the service’s installation directory.
Check for Missing or Corrupt Log Files
- Navigate to
C:\Windows\System32\winevt\Logs - Look for missing
.evtxfiles or unusually small ones - You can delete corrupted logs (after backing up) and restart the service to regenerate them
Review ServerManager-ManagementProvider Logs
As noted in your Server Manager warning, check:
code
Event Viewer > Applications and Services Logs > Microsoft > Windows > ServerManager > Operational
*This may give more insight into which logs or permissions are failing.
Run SFC and DISM
These tools can repair system file corruption:
powershell
sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth
These errors don’t usually affect domain controller functionality, but cleaning them up will improve monitoring and reduce noise in your logs. Let me know if you’d like help identifying specific providers or scripting the cleanup.
And if this answer helped, feel free to hit “Accept answer” so others can benefit too 😊.