It uses the System Image to replace existing files with good copies. If there is any corruption restricting the event log viewer from creating log files, this will help. Open Event Viewer ...