Event Viewer, access denied

I guys,

I’m getting a message when I tried to open the event viewer “unable to complete the operation system log, access denied”.

I though that I had a corrupted system log, so I followed the steps indicated at the knowledge base. I clear all the evt files from the config directory. I restarted the system all files were recreated, but I got the same message again.

I have searched the knowledge base but I can’t find any solution, does anybody have an idea?

Thanks

pd. i have this problem on the domian controler and the domian backup, all my other servers are find.

 

are you logged on as admim

 

You may need to be set up as an admin of your local machine for that to work. Are you in a Domain environment??

 

I'm in a domian enviroment and yes i'm logged in as the adminstrator.

 

Then check your security policies on that machine.

 

Try rsop.msc on that machine. It may show where you are locked out.

Just a shot in the dark, but what about setting an Admin roaming profile?
Run: gpedit.msc
Computer Config > Admin Templates > System > User Profiles > Add the Admin Security Group to roaming user profiles.

It may also help to configure explicitly:
User Config > Admin Templates > Windows Components > Microsoft Management > Restricted/Permitted Snap-ins > Event Viewer.

 

i'll try

 

Another try. Update the application of policy on the machine.
Run: gpupdate /force /boot

Reboot if it doesn't automatically.

Run: chkdsk /f to check for damaged security descriptors.

 

Have a look at the answer given here:

http://groups.google.com/groups?hl=...=1&[email protected]

and here...

http://groups.google.com/groups?hl=...=1&selm=sjgUo#[email protected]

 

If any body Cares, i found the solution to my problem. First, i made sure that administrator was not in the Guest group account and in the Domian Guest Group account. At that point i still could not access the logs.

I opened the even viewer, clicked on the "open event log", navegate to where the logs are held (commonlly \winnt\system32\config) and open the system log. All the events where there. After i closed the event vier and opened again i was able to see the system log. ?????

i repeated the process for the appllication log and in the other server for the system and application logs.

Could anybody explain this

Thanks for the help

Daniel