What does Windows error code 15013 (ERROR_EVT_NON_VALIDATING_MSXML) mean?

ERROR_EVT_NON_VALIDATING_MSXML

The available MSXML parser does not support required validation

Structured Event Log queries are XML documents governed by the QueryList schema. This code points to the XML parser capability or registration used by the Event Log component, not merely to an invalid XPath predicate. A damaged or incorrectly registered MSXML installation can expose a parser that loads XML but cannot perform the expected schema validation.

First preserve the query and confirm that it is well-formed. If the same valid QueryList fails system-wide, inspect servicing health and MSXML registration rather than rewriting the filter repeatedly. Avoid installing arbitrary legacy parser DLLs beside the application; Windows components expect supported system MSXML versions and their normal COM registration.

What to inspect

• Test a minimal known-good QueryList on the same machine.
• Check operating-system servicing and MSXML component registration.
• Do not treat parser capability failure as a channel-access problem.

References

• Microsoft: structured Event Log query schema
• Microsoft: MSXML document validation
• W3C: XML specification
• Microsoft: Windows Event Log error constants