| Previous | Next |
| ERROR_EVT_INVALID_QUERY | ERROR_EVT_EVENT_TEMPLATE_NOT_FOUND |
ERROR_EVT_PUBLISHER_METADATA_NOT_FOUND
The Event Log provider metadata resource is unavailable
A manifest-based provider stores channels, levels, tasks, opcodes, keywords and event definitions in metadata resources referenced by its registration. EvtOpenPublisherMetadata can read those resources from a registered provider or, for archived logs, from metadata embedded in the EVTX file. This error means the lookup reached the provider context but could not obtain the required metadata resource.
Check provider registration and the resourceFileName/messageFileName paths rather than treating this as a missing event record. Deployment skew is common: an executable or DLL was removed, moved, replaced with the wrong architecture or version, or the manifest was unregistered while old events remain. For portable EVTX files, archive localized metadata before moving the log to a system without the provider.
What to inspect
- Enumerate the registered publisher and inspect its resource paths.
- Verify that referenced DLL or executable files exist and match the manifest.
- For exported logs, check whether provider metadata was archived with the file.
References
- Microsoft: EvtOpenPublisherMetadata
- Microsoft: provider and event metadata
- Microsoft: provider resources and parameter files
- Microsoft: archiving localized event resources
Looking for a different code? Search another status or error code.