Event Viewer, access denied

[dkolbach]

I guys,

I’m getting a message when I tried to open the event viewer “unable to complete the operation system log, access denied”.

I though that I had a corrupted system log, so I followed the steps indicated at the knowledge base. I clear all the evt files from the config directory. I restarted the system all files were recreated, but I got the same message again.

I have searched the knowledge base but I can’t find any solution, does anybody have an idea?

Thanks

pd. i have this problem on the domian controler and the domian backup, all my other servers are find.

 

[dai]

are you logged on as admim

 

[skinnywhiteboy]

You may need to be set up as an admin of your local machine for that to work. Are you in a Domain environment??

 

[dkolbach]

I'm in a domian enviroment and yes i'm logged in as the adminstrator.

 

[skinnywhiteboy]

Then check your security policies on that machine.

 

[Elvandil]

Try rsop.msc on that machine. It may show where you are locked out.

Just a shot in the dark, but what about setting an Admin roaming profile?
Run: gpedit.msc
Computer Config > Admin Templates > System > User Profiles > Add the Admin Security Group to roaming user profiles.

It may also help to configure explicitly:
User Config > Admin Templates > Windows Components > Microsoft Management > Restricted/Permitted Snap-ins > Event Viewer.

 

[dkolbach]

i'll try

 

[Elvandil]

Another try. Update the application of policy on the machine.
Run: gpupdate /force /boot

Reboot if it doesn't automatically.

Run: chkdsk /f to check for damaged security descriptors.

 

[Rollin' Rog]

Have a look at the answer given here:

http://groups.google.com/groups?hl=...=1&selm=OZ3Mnpq2DHA.3496@TK2MSFTNGP11.phx.gbl

and here...

http://groups.google.com/groups?hl=...=1&selm=sjgUo#j3DHA.3348@cpmsftngxa07.phx.gbl

 

[dkolbach]

If any body Cares, i found the solution to my problem. First, i made sure that administrator was not in the Guest group account and in the Domian Guest Group account. At that point i still could not access the logs.

I opened the even viewer, clicked on the "open event log", navegate to where the logs are held (commonlly \winnt\system32\config) and open the system log. All the events where there. After i closed the event vier and opened again i was able to see the system log. ?????

i repeated the process for the appllication log and in the other server for the system and application logs.

Could anybody explain this

Thanks for the help

Daniel