Event viewer event 4201

Zardoc · Aug 28, 2021

Hey all,

Just wanted to check with you guys. Has anyone gotten an error message for event viewer windows-USB video/Analytic?

Windows could not start the Windows Event Log service on Local Computer.

Error 4201: The instance name passed was not recognized as valid by a WMI data provider.

I haven't changed permissions in WMI to see if it fixes the issue but I wanted to check if others got this issue also.

Thanks

Event 4201 Viewer 2021-08-28_14-45-23.png

iko22 · Aug 29, 2021

Hi,

does this answer help, "ERROR 4201: The instance name passed was not recognized as valid by a WMI provider." ?

Zardoc · Aug 29, 2021

iko22 said:
Hi,

does this answer help, "ERROR 4201: The instance name passed was not recognized as valid by a WMI provider." ?

Thanks for the help but I found the answer. It is a Win 11 bug that was also in Win 10 but I don't know ( I think ) it was fixed. It seems to be a naming error but I change the file names they don't show up in viewer and that's not the right answer. I bugged it so it will probably show as by design as usual.

Zardoc · Nov 15, 2021

Ok friends,

Here is the fix I tested.

If you want to apply this fix:
1) Save a copy of your registry
2) Copy this reg command in a text file and save as Fix for WMI Viewer USB Video Analytic.reg

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USB-Video/Analytic]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USB-Video/Analytic\ChannelAccess]
"Owners"=hex(7):75,00,73,00,62,00,76,00,69,00,64,00,65,00,6f,00,2e,00,69,00,6e,\
  00,66,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USB-Video/Analytic\Enabled]
"Owners"=hex(7):75,00,73,00,62,00,76,00,69,00,64,00,65,00,6f,00,2e,00,69,00,6e,\
  00,66,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USB-Video/Analytic\Isolation]
"Owners"=hex(7):75,00,73,00,62,00,76,00,69,00,64,00,65,00,6f,00,2e,00,69,00,6e,\
  00,66,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USB-Video/Analytic\OwningPublisher]
"Owners"=hex(7):75,00,73,00,62,00,76,00,69,00,64,00,65,00,6f,00,2e,00,69,00,6e,\
  00,66,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USB-Video/Analytic\Type]
"Owners"=hex(7):75,00,73,00,62,00,76,00,69,00,64,00,65,00,6f,00,2e,00,69,00,6e,\
  00,66,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USB-Video/Analytic]
"OwningPublisher"="{da1d1dbd-3186-4fa2-bc2d-075efd9e43e2}"
"Enabled"=dword:00000001
"Isolation"=dword:00000001
"ChannelAccess"="O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)"
"Type"=dword:00000002

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{da1d1dbd-3186-4fa2-bc2d-075efd9e43e2}]
@="Microsoft-Windows-USB-Video"
"ResourceFileName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,\
  00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\
  5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,75,00,73,00,62,00,76,\
  00,69,00,64,00,65,00,6f,00,2e,00,73,00,79,00,73,00,00,00
"MessageFileName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
  6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
  00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,75,00,73,00,62,00,76,00,\
  69,00,64,00,65,00,6f,00,2e,00,73,00,79,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{da1d1dbd-3186-4fa2-bc2d-075efd9e43e2}\ChannelReferences]
"Count"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{da1d1dbd-3186-4fa2-bc2d-075efd9e43e2}\ChannelReferences\0]
@="Microsoft-Windows-USB-Video/Analytic"
"Id"=dword:00000010
"Flags"=dword:00000000

Reboot and try the viewer again, should work (well until next update and MS will mess it up again

UGian · Jun 4, 2022

Hi,
thank you so much for helping me solve the problem.
The solution you proposed worked wonders.
I would just add that for the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ PnpResources\ Registry\HKLM \SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USB-Video/Analytic" you must change the permissions, otherwise the change will not you are allowed.
Thanks again.

Zardoc · Jun 4, 2022

UGian said:
Hi,
thank you so much for helping me solve the problem.
The solution you proposed worked wonders.
I would just add that for the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ PnpResources\ Registry\HKLM \SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USB-Video/Analytic" you must change the permissions, otherwise the change will not you are allowed.
Thanks again.

Thanks for adding the info

mike54545457444 · Sep 7, 2023

Does not work. Cannot add that registry to the key.

Try3 · Sep 7, 2023

mike54545457444 said:
Does not work. Cannot add that registry to the key.

To which user did you change Ownership of the parent Registry Key?
To which user / user group did you give change Permission for the parent Registry Key?

~~Denis~~

mike54545457444 · Sep 7, 2023

first i tried to set it all to administrator. Then I used the run as software to run as trusted installer. The keys installed...but they did nothing. The WMI error in the log persists, and unable to delete the logs.

Try3 · Sep 7, 2023

If you set it to Administrator then you set it to the normally-disabled Built-in Admin account.
A more common & effective step would be to set it to Administrators [plural] because that is a User group to which all your Admin accounts belong.

If you change the ownership & permissions then you do not need to use that utility to run as TrustedInstaller.

I cannot advise you about your WMI error, I know nothing about that topic.
I only posted to help you with the Ownership & Permissions changes.

best of luck,
Denis

Zardoc · Sep 7, 2023

mike54545457444 said:
Does not work. Cannot add that registry to the key.

Don't bother adding the key. It gets overridden eventually. Besides, that error only appears if the journal is empty and not every time. I don't bother because it has no impact on the O/S

mike54545457444 · Sep 7, 2023

That's fine but in the event viewer it pops up with this dialog when viewing the administrative summary custom log at the top. I suppose ignoring it is the only way but it didn't pop up a few days ago so something happened which can't be fixed.

Cor3 · Jun 4, 2025

I know, this is an old thread. But I found this error this/last week. With Windows 11 Pro 26100.4202 have no clue where this came from. This registry key is not on clean Windows 11 Edu test install.

catspyjamas · Jun 26, 2025

Cor3 said:
I know, this is an old thread. But I found this error this/last week. With Windows 11 Pro 26100.4202 have no clue where this came from.

Same here, on every Win 11 machine in the house but not my Win 10 machine. Our Win 11 machines are a mixture of Pro & Home, none are Education.

I thought it might be due to the CU preview for Windows 11 today (when I went looking in the Event Viewer for the Windows Advanced Firewall errors mentioned in the thread about said update), but it's also doing on a Win 11 machine which I haven't installed that CU Preview on.

I'm not sure when this started for me - I can't remember looking an the event viewer on anything in a few months, but it it definitely the first time it's happened - so it's within the last few months.

I haven't gone looking for the relevant registry key mentioned in this thread, as it seems like it's not a permanent fix. Also, once I hit OK to get rid of the error window, then I can load the Administrative view in the EV just fine (although the error warns the events displayed are partial results).

pepanee · Jun 26, 2025

Try this method:

Fix Event Log Service Error 4201 The Instance Name Passed Was Not Recognized

Event Log Error 4201: The instance name passed was not recognized as valid by a WMI data provider.

www.winhelponline.com

See if that isn't just a temporary fix.

Cor3 · Jun 27, 2025

catspyjamas said:
Same here, on every Win 11 machine in the house but not my Win 10 machine. Our Win 11 machines are a mixture of Pro & Home, none are Education.

I thought it might be due to the CU preview for Windows 11 today (when I went looking in the Event Viewer for the Windows Advanced Firewall errors mentioned in the thread about said update), but it's also doing on a Win 11 machine which I haven't installed that CU Preview on.

I'm not sure when this started for me - I can't remember looking an the event viewer on anything in a few months, but it it definitely the first time it's happened - so it's within the last few months.

I haven't gone looking for the relevant registry key mentioned in this thread, as it seems like it's not a permanent fix. Also, once I hit OK to get rid of the error window, then I can load the Administrative view in the EV just fine (although the error warns the events displayed are partial results).

I dont know how good this is for registry. I tried few methods. I had an backup before doing anything harmful and this was best resolution. I did do some search within web and ChatGPT. Method what worked me best was to remove registry entries for this Event Viewer entry. This is conclusion with ChatGPT remove both registry entries and if you try this, delete that first one and that GUID under Publishers:

Great! That confirms the issue was an orphaned ETW channel pointing to a missing or invalid provider, and Event Viewer/WMI was just failing silently until queried.

What You Just Did

By deleting:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USBVideo/Analytic
(And optionally the associated GUID under ...WINEVT\Publishers\)

You removed the invalid log registration, which:

Cleared the error from Event Viewer and PowerShell
Prevents WMI from trying to load a broken provider

Levitate11 · Jun 27, 2025

@catspyjamas : Try the fix in the answer here.:

Microsoft-Windows-USBVideo/Analytic - Microsoft Community

The link will take you to a Reg file that deletes three keys. Download the file and run.

Code:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USBVideo/Analytic]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USBVideo/Analytic]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{da1d1dbd-3186-4fa2-bc2d-075efd9e43e2}]

I had a slight variation on the USBVideo/Analytic error (vs. the first post here) but removing that errant channel reference fixed it.

Cor3 · Jun 27, 2025

Levitate11 said:
@catspyjamas : Try the fix in the answer here.:

Microsoft-Windows-USBVideo/Analytic - Microsoft Community

The link will take you to a Reg file that deletes three keys. Download the file and run.

Code:

Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USBVideo/Analytic] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USBVideo/Analytic] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{da1d1dbd-3186-4fa2-bc2d-075efd9e43e2}]

I had a slight variation on the USBVideo/Analytic error (vs. the first post here) but removing that errant channel reference fixed it.

Its all same what I did do, expect that middle one, I tried to run regfile and remove it, but regedit doesnt allow. Thanks for sharing this, I didnt find it when were searching.

Levitate11 · Jun 27, 2025

Cor3 said:
Its all same what I did do, expect that middle one, I tried to run regfile and remove it, but regedit doesnt allow. Thanks for sharing this, I didnt find it when were searching.

Do you mean that it gives you a security warning when you run it? What does it say?

Cor3 · Jun 27, 2025

Levitate11 said:
Do you mean that it gives you a security warning when you run it? What does it say?

That my Microsoft -account with Administrator privileges doesnt allow to remove that key.

Event viewer event 4201

Dazed & Confused

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Dazed & Confused

My Computer My Computer

At a glance

Dazed & Confused

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Dazed & Confused

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Dazed & Confused

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer