Windows 10 Windows 10 Pro - Problems with Event Viewer and System Restore (0x81000203)

  • Thread starter Thread starter POSitality
  • Start date Start date
P

POSitality

Hi guys,


I have a spare PC I'm attempting to use a basic file server. I've only just loaded up Windows 10 Pro (latest build, 1511) and only done a few things with it past loading the drivers. I've noticed the following problems/symptoms:

  • System Restore encountered an error. Please try to run System Restore again. (0x81000203) when accessing the System Protection tab in System Properties.
  • In Event Viewer all logs are listed at zero size. Attempting to access any one gives the message Event Viewer cannot open the event log or custom view. Verify that Event Log service is running or query is too long. The operation completed successfully (50)
  • File History won't run. Clicking the icon does nothing.

I have checked that the Volume Shadow Copy and Windows Event Log services are running. I have also attempted the usual "Clean Reboot" and "sfc /scannow" tactics. Manually examining the log files suggest they stopped "recording" yesterday. The last events seem to relate to Microsoft Patches - not unusual on a fresh system.


There are only two oddities I can mention about the system:

  1. There is an "archive" drive attached, formatted as ReFS, pulled from a previous server. Obviously the logs were recording events after it was installed but drives for Windows 10 don't typically use this format.
  2. I installed Hyper-V to spin up an old VM to field a client support query. I only mention this as I couldn't get Hyper-V to install on a slightly older build of Windows 10 that updated to 1511 so I gave up, reformatted and installed 1511. Hyper-V then installed correctly.
  3. The User profile directory has been moved to a non-flash drive using Sysprep in Audit mode.

As everything apart from the aforementioned services seems to be running fine (hard to tell without the Event Log!) Is there any way to fix this short of yet another fresh install?


All I can think of is something that System Restore, Event Log and File History all rely on. That points to Volume Shadow Copy but how do I assess if it is running correctly without the Event Logs?


Hmm... thinking along these lines VSSAdmin List Writers comes back with "Error: Internal Error" however, all the information related to this usually starts with "check you event logs..."


Finally, one last bit of strangeness: a few Windows 10 Apps won't run, Calculator, Store and a few others. Definitely looks like a reload job :(


Thank you for your time,


Andy

Continue reading...
 
Back
Top