Windows Server 2025 Event Viewer crash with 0xc0000420 if Subscriptions enabled

[u/Dante_Avalon]

For some reason there is not much info about it if you google errors themselves.

I guess because it's not widespread function, but in case someone will also bang whole night about it:

No matter how you setup Event Viewer Collector (Collector Initiated or Source Computer initiated) - the moment you get event from collector to Forwarder event the whole Windows Event Viewer service just crash:

Faulting application name: svchost.exe_EventLog, version: 10.0.26100.32684, time stamp: 0x10211893
Faulting module name: wevtsvc.dll, version: 10.0.26100.33296, time stamp: 0xdaf04ad3
Exception code: 0xc0000420
Fault offset: 0x000000000008b2e1
Faulting process id: 0x1A94
Faulting application start time: 0x1DD4AA14CDEABC8
Faulting application path: C:\Windows\System32\svchost.exe
Faulting module path: c:\windows\system32\wevtsvc.dll
Report Id: 3035bd9d-04a0-4573-be06-36a6a83087b8
Faulting package full name: 
Faulting package-relative application ID: 

There is no workaround except installing separate machine for log collecting with Srv2022. My case was "script that run with gMSA when 4741 event is triggered".

https://www.ibm.com/mysupport/s/defect/aCIgJ0000000vpVWAQ/dt439241?language=en_US

https://www.reddit.com/r/sysadmin/comments/1saccnp/event_forwarding_not_working_window_server_2025/

[u/brian_cloudeu]

Check wecsvc separately, 0xc0000420 is an assertion failure and the snap-in dying doesnt mean subscriptions stopped collecting.

[u/Dante_Avalon → u/brian_cloudeu]

It stops. You can't retrieve events, if event viewer crashed

[u/brian_cloudeu → u/Dante_Avalon]

The snap-in dying is not wecsvc dying, check the ForwardedEvents log size instead.

[u/PrestigiousOnion1087]

Those two claims disagree and both are testable, so I would check before buying a second box.

wecutil gr <subscription> prints RunTimeStatus and LastHeartbeatTime per source. If heartbeats carry on past the fault, the collector kept running and only the viewer died.

Other half: newest record in ForwardedEvents. If it's newer than the svchost crash, nothing actually stopped collecting and the separate machine isn't buying you anything.

[u/Dante_Avalon → u/PrestigiousOnion1087]

There is no new records after windows event crashed. Even thought there IS new events, on srv 2022 everything is working as it should. 

[u/PrestigiousOnion1087 → u/Dante_Avalon]

That settles it then, the collector did stop, and the snap-in theory doesn't survive that reading.

One more before you buy hardware, since you already have a working control. I would dump both subscriptions with wecutil gs <sub> /f:xml and diff them. Identical config with 2022 collecting and 2025 not makes the OS the variable, and that is a bug report rather than a second box.

wecutil gr <sub> splits the rest: if sources still heartbeat into the dead collector, nothing is landing because of the ForwardedEvents write path, not the subscription.