Fix Windows Event Log Error 36887 – Windows 10/11 2026

The Event Log service may have stopped or become unresponsive. Restarting it often resolves temporary issues.

1. Press Windows + R, type services.msc and press Enter
2. Scroll down and locate Windows Event Log
3. Right-click on the service and select Properties
4. Note the current status. If stopped, click Start
5. If running, click Stop, wait 10 seconds, then click Start
6. Set Startup type to Automatic
7. Click Apply and OK

Alternative command line method:

net stop eventlog
net start eventlog

Corrupted system files often cause Event Log service failures. SFC and DISM can repair these files.

1. Press Windows + X and select Windows Terminal (Admin)
2. Run the DISM command first to prepare the system:

DISM /Online /Cleanup-Image /RestoreHealth

3. Wait for completion (may take 15-30 minutes)
4. Run System File Checker:

sfc /scannow

5. Restart your computer after both commands complete
6. Check the SFC log for details:

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log

Incorrect permissions on Event Log directories can prevent the service from functioning. This method resets permissions to default values.

1. Open Windows Terminal (Admin)
2. Navigate to the Event Log directory:

cd /d %SystemRoot%\System32\winevt\Logs

3. Take ownership of the Logs folder:

takeown /f . /r /d y

4. Reset permissions using icacls:

icacls . /reset /t /c /l

5. Grant specific permissions to Event Log service:

icacls . /grant "NT SERVICE\EventLog":F /t
icacls . /grant "SYSTEM":F /t
icacls . /grant "Administrators":F /t

6. Restart the Event Log service:

net stop eventlog && net start eventlog

Corrupted .evtx files can cause the Event Log service to fail. This method safely clears and rebuilds the log files.

1. Stop the Event Log service:

net stop eventlog

2. Navigate to the Event Log directory:

cd /d %SystemRoot%\System32\winevt\Logs

3. Create a backup folder and move existing logs:

mkdir C:\EventLogBackup
move *.evtx C:\EventLogBackup\

4. Clear the Event Log registry cache:

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\EventLog" /v "File" /f

5. Restart the Event Log service:

net start eventlog

6. Rebuild the Event Log database:

wevtutil el | ForEach-Object {wevtutil cl $_}

Deep registry corruption may require manual repair of Event Log service configuration.

1. Create a registry backup:

reg export HKLM\SYSTEM\CurrentControlSet\Services\EventLog C:\EventLog_Registry_Backup.reg

2. Open Registry Editor as Administrator:

regedit

3. Navigate to: HKLM\SYSTEM\CurrentControlSet\Services\EventLog
4. Verify the following values exist and are correct:
5. DisplayName (REG_SZ): Windows Event Log
6. ImagePath (REG_EXPAND_SZ): %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p
7. Start (REG_DWORD): 2 (Automatic)
8. Type (REG_DWORD): 32
9. If any values are missing or incorrect, right-click in the right pane, select New, and create the appropriate value type
10. Navigate to: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Parameters
11. Ensure ServiceDll (REG_EXPAND_SZ) is set to: %SystemRoot%\System32\wevtsvc.dll
12. Close Registry Editor and restart the computer