In both ConfigureEventManifestRegister and ConfigureEventManifestUnregister the calls to wevtutil are sequenced incorrectly. This means that if a rollback occurs during this action a file will not be rolled back.
The correct sequence for
ConfigureEventManifestRegister is wevtutil um (rollback) then wevtutil im. The correct sequence for
ConfigureEventManifestUnregister is wevtutil im (rollback) then wevtutil um.
As a rule of thumb Rollback CAs should always come before the CA that does the system change.
This Tracker item was closed automatically by the system. It was
previously set to a Pending status, and the original submitter
did not respond within 15 days (the time period specified by
the administrator of this Tracker).