| Previous | Next |
| ERROR_EC_CREDSTORE_FULL | ERROR_EC_NO_ACTIVE_CHANNEL |
ERROR_EC_CRED_NOT_FOUND
ERROR_EC_CRED_NOT_FOUND means that the subscription refers to credentials which Windows Event Collector cannot retrieve. For a collector-initiated subscription, WEC supports both credentials attached to a particular event source and a shared credential for sources that have no individual value. The error identifies a missing stored association; it is not, by itself, proof that the remote source rejected a valid password.
Repair the exact credential association
- Export or inspect the subscription with
wecutil gs <subscription-id> /f:XMLand determine whether it is collector-initiated and which source is affected. - Compare the event source list with the intended authentication design. A source-initiated subscription relies on the clients locating the Subscription Manager and on domain or certificate authorization, whereas a collector-initiated subscription can require stored source credentials.
- Restore or replace the intended credential through approved subscription management rather than editing event-log files or clearing the destination log.
- Finish with
wecutil gr <subscription-id>. Wecutil documentation notes that an incorrect user name or password may not surface until runtime status is queried, so a successful configuration update is not a connectivity test.
Keep this distinct from access control
A present credential can still fail because the remote computer is unreachable, WinRM is not configured, or the account lacks access to the requested source channel. Conversely, recreating a user account does not resolve this code until the subscription's stored reference points to usable credentials again.
References
- Microsoft: Wecutil credential parameters and runtime-status behavior
- Microsoft: source-initiated authorization and certificate setup
- NXLog: WEC and WEF roles over WS-Management
Looking for a different code? Search another status or error code.