[monkkey]

Run regedit.
Go to computer\HKLM\system\currentcontrolset\services\eventlog\
run through all subkeys looking for path names and make sure the folders exist and have write privileges.
For example, the log file may be stored in:
%SystemRoot%\system32\winevt\Logs\Application.evtx
If the folder is not there or is not write enabled, the service may fail to start.
You would get an error "file path not found" or "file access denied" or something like that.
Проверьте, есть ли у SYSTEM полный доступ на ветку реестра
HKEY_LOCAL_MACHINE