1

After restarting 2008 R2 based Domain Controller I am getting error while opening Event viewer as follows: Event viewer can not open the event log or custom view. Verify that event log service is running or query is too long. Access is denied (5). this error is coming while I open all event logs which are under 'Applications & Service logs' as well as 'Setup' logs under 'Windows logs'. Also half of the log category which are under 'Microsoft>Windows'.

In some websites it is mentioned that it can be due to permission issue on below registry for 'Builtin\Event Log Reader' user. HKLM\System\Currentcontrolset\Services\Eventlog But my other ADCs are working with same permission present in my problematic ADC.

I have also check below Microsoft link for this issue. Error message when attempting to start the Windows Event Log Service: "Access denied" | Microsoft Support

And correct permissions are set on registry as per above link.

1

In server 2008 they changed the way permissions are set, it's no longer ion the registry. Now you have to use the "wevtutil.exe" program to set/change permissions.

I am guessing someone has modified the permissions and that a reboot didn't cause this. There is a brief explanation on this, and how to check/change permissions at the bottom of the page on this link: https://blogs.technet.microsoft.com/janelewis/2010/04/30/giving-non-administrators-permission-to-read-event-logs-windows-2003-and-windows-2008/ Good luck, hope that helps. -larryc

  • Just clarifying that I am using Domain Admin ID to access Event logs on ADC. None of the domain admins IDs are able to access Events Logs of that Additional Domain Controller. – G Vakharia Sep 20 '16 at 12:02
  • Yes, I follow you there. It may be a specific group that admins are not a member of. "access denied" is a permissions issue, and permissions are controlled via the Wevtutil.exe program.-larryc – Larryc Sep 21 '16 at 1:17
  • Hi Layyc, thanks for your response. My problem is resolved after I have removed all log files from below location & restarted server. C:\Windows\System32\winevt\Logs – G Vakharia Sep 21 '16 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.