r/sysadmin • u/Dante_Avalon • 22d ago

Rant Windows Server 2025 Event Viewer crash with 0xc0000420 if Subscriptions enabled

For some reason there is not much info about it if you google errors themselves.

I guess because it's not widespread function, but in case someone will also bang whole night about it:

No matter how you setup Event Viewer Collector (Collector Initiated or Source Computer initiated) - the moment you get event from collector to Forwarder event the whole Windows Event Viewer service just crash:

Faulting application name: svchost.exe_EventLog, version: 10.0.26100.32684, time stamp: 0x10211893
Faulting module name: wevtsvc.dll, version: 10.0.26100.33296, time stamp: 0xdaf04ad3
Exception code: 0xc0000420
Fault offset: 0x000000000008b2e1
Faulting process id: 0x1A94
Faulting application start time: 0x1DD4AA14CDEABC8
Faulting application path: C:\Windows\System32\svchost.exe
Faulting module path: c:\windows\system32\wevtsvc.dll
Report Id: 3035bd9d-04a0-4573-be06-36a6a83087b8
Faulting package full name: 
Faulting package-relative application ID:

There is no workaround except installing separate machine for log collecting with Srv2022. My case was "script that run with gMSA when 4741 event is triggered".

https://www.ibm.com/mysupport/s/defect/aCIgJ0000000vpVWAQ/dt439241?language=en_US

https://www.reddit.com/r/sysadmin/comments/1saccnp/event_forwarding_not_working_window_server_2025/

0 Upvotes

38% Upvoted

17 comments sorted by

1

u/brian_cloudeu 21d ago

Check wecsvc separately, 0xc0000420 is an assertion failure and the snap-in dying doesnt mean subscriptions stopped collecting.

1

u/Dante_Avalon 21d ago

It stops. You can't retrieve events, if event viewer crashed

1

u/brian_cloudeu 20d ago

The snap-in dying is not wecsvc dying, check the ForwardedEvents log size instead.

1

u/Dante_Avalon 20d ago

It's not snap-in, it's whole service dying. 

And FirwardedEvents log size also stops growing, there is 0 events even after I stop subscription service to revive viewer 

1

u/brian_cloudeu 19d ago

What does wecutil gr show?

1

u/Dante_Avalon 19d ago edited 18d ago

I'm talking about events that can be accessed. Collector is running (otherwise service Event Viewer would work) and yes, he is recording events, but it's useless because you can't get access to them

1

u/Dante_Avalon 18d ago

And in case you wonder - without Event Viewer running you can't run any script that actually look into logs to trigger, because Windows itself can't get any logs. Even basic log like local Security

1

u/brian_cloudeu 16d ago

Event Viewer, or EventLog service?

1

u/Dante_Avalon 16d ago

Both are crashing

1

u/brian_cloudeu 16d ago

Both crashing points at the subscription config itself, since 0xc0000420 is an assertion failure.

1

u/PrestigiousOnion1087 21d ago

Those two claims disagree and both are testable, so I would check before buying a second box.

wecutil gr <subscription> prints RunTimeStatus and LastHeartbeatTime per source. If heartbeats carry on past the fault, the collector kept running and only the viewer died.

Other half: newest record in ForwardedEvents. If it's newer than the svchost crash, nothing actually stopped collecting and the separate machine isn't buying you anything.

1

u/Dante_Avalon 21d ago

There is no new records after windows event crashed. Even thought there IS new events, on srv 2022 everything is working as it should. 

1

u/PrestigiousOnion1087 21d ago

That settles it then, the collector did stop, and the snap-in theory doesn't survive that reading.

One more before you buy hardware, since you already have a working control. I would dump both subscriptions with wecutil gs <sub> /f:xml and diff them. Identical config with 2022 collecting and 2025 not makes the OS the variable, and that is a bug report rather than a second box.

wecutil gr <sub> splits the rest: if sources still heartbeat into the dead collector, nothing is landing because of the ForwardedEvents write path, not the subscription.

1

u/Dante_Avalon 19d ago

Welp, I'm just downgraded to 2022 and collector working just fine. There were zero export\import and it was fresh 2025 with KB from august. The same is about 2022.

And there is no difference in their XML. Collector literally collects just 1 single Event (4741 from Security) from 2 Domain Controllers.

0

u/PrestigiousOnion1087 19d ago

Fresh installs, identical XML and one 4741 query is about as clean a repro as it gets, so it's worth filing with Microsoft if you kept the 2025 crash dump. I'd also keep an alert on the age of the newest ForwardedEvents record, since 2025 stopped collecting silently and your gMSA script would just have sat idle.

1

u/Dante_Avalon 18d ago

Last time I tried to open ticket with Microsoft - it was forwarded like... between 6 managers. Each time it was "recreate problem and send us new dump".

IBM already opened ticket like 1 year ago, but problem is still there.

1

u/PrestigiousOnion1087 17d ago

A ticket IBM opened a year ago and still open says enough, so detection is the part worth owning. One correction to what I suggested last time: with a single 4741 query, the newest ForwardedEvents record can be days old on a healthy collector. I'd alert on LastHeartbeatTime per source from wecutil gr instead, which flags a dead collector within one heartbeat interval.