{"record":{"id":"8cbbc286f82c0ebf","repo":"hashicorp/nomad","slug":"could-not-remove-eventlog-configuration-w","errorCode":null,"errorMessage":"could not remove eventlog configuration - %w","messagePattern":"could not remove eventlog configuration - %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"command/windows_service_uninstall.go","lineNumber":112,"sourceCode":"\n\tif !exists {\n\t\treturn nil\n\t}\n\n\t// Grab the service and ensure the service is stopped\n\tsrvc, err := m.GetService(winsvc.WINDOWS_SERVICE_NAME)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not get existing service - %w\", err)\n\t}\n\tdefer srvc.Close()\n\n\tif err := srvc.Stop(); err != nil {\n\t\treturn fmt.Errorf(\"unable to stop service - %w\", err)\n\t}\n\n\t// Remove the service from the event log\n\tif err := srvc.DisableEventlog(); err != nil {\n\t\treturn fmt.Errorf(\"could not remove eventlog configuration - %w\", err)\n\t}\n\n\t// Finally, delete the service\n\tif err := srvc.Delete(); err != nil {\n\t\treturn fmt.Errorf(\"could not delete service - %w\", err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":94,"sourceCodeEnd":122,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/windows_service_uninstall.go#L94-L122","documentation":"performUninstall wraps the error from srvc.DisableEventlog(), which removes the Nomad service's event-log registration so stale entries do not remain after deletion. Failure means the event-log registry configuration could not be updated, though the service itself has already been stopped.","triggerScenarios":"DisableEventlog fails because the HKLM\\SYSTEM\\CurrentControlSet\\Services\\...\\EventLog registry key is locked or access is denied, or the process is not elevated while performUninstall cleans up the eventlog entry.","commonSituations":"Registry ACLs restrict the uninstaller's account; eventlog key held by Event Log service or monitoring software; non-admin run.","solutions":["Run the uninstall from an elevated Administrator prompt","Check the wrapped error for a registry access-denied code and inspect the EventLog key ACLs","Delete the eventlog registry key manually (reg delete) and re-run uninstall","Restart the Windows Event Log service if it holds the key"],"exampleFix":"// manual cleanup alternative\nreg delete HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\nomad /f","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := uninstallCmd.Run(); err != nil {\n    if strings.Contains(err.Error(), \"eventlog configuration\") {\n        // fall back to manual registry cleanup:\n        exec.Command(\"reg\", \"delete\", `HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\nomad`, \"/f\")\n    }\n}","preventionTips":["Run uninstalls elevated so registry EventLog keys are writable","Check ACLs on HKLM\\...\\EventLog keys in locked-down environments","Avoid monitoring software that holds eventlog registry keys open"],"tags":["go","windows","registry","eventlog"],"backgroundTag":"windows-registry-access-denied","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}