Event Viewer

[grebnetso]

I'm having some difficulties accessing event viewer on remote machines using the MMC console. I can log in to the machine locally and using remote desktop and access the event viewer, but when I try going to the snap in and remotely connect to a machine it doesn't allow me to view it. The error I get is "access denied". I've checked the permissions on the logs themselves and they look good. I can also remotely manage the machines to include local groups/users and services. Are there any GPO's that I may need to look at that can be affecting this?

It would also appear that this is only affecting my Server 2003 and XP machines. My Server 2000 machines don't seem to be affected. Thanks in advance.

 

[MikeBatters]

Are you running 2003 SP1 and if so are you running the firewall?

It could be the XP and 2003 SP1 firewall preventing this.

Mike

*************************************

Remember - There is always another way..........I just haven't found out what it is yet!

 

[grebnetso]

Some of the servers don't have SP1 installed. Can you lock down windows firewall to allow remote manage of local users and services and not event viewer?

 

[MikeBatters]

I thought User Management and Remote Event Viewing used different ports but it was just an idea. If you can carry out the management between 2 non-SP1 servers then it can't be that.

I will think on...

Mike

*************************************

Remember - There is always another way..........I just haven't found out what it is yet!

 

[lanman1865]

Granting the LOCAL SERVICE account Read permissions to the these two registry keys will likely resolve the error.

- HKLM\software\microsoft\windows nt\current version\perflib
- HKLM\System\Currentcontrolset\Control\Securepipeservice\winreg