Access is denied error when trying to access System Event Log.

tommyh used Ask the Experts™
I'm getting this error when I try to access the System Event Log;
Unable to complete the operation on "System Log".
Access is denied.

I can access the Security Log fine, but the application log is causing the same error.

Anyone seen this before?

Its a windows 2000 domain controller and I'm logged in as the domain admin. There is another domain controller in the domain and I can access the Event Log on that fine.
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
No. The other logs work? You are logged in as administrator? Make sure that the event log file (C:\WINNT\SYSTEM32\CONFIG\SYSEVENT.EVT) does grant access to your user account.


Interestingly, If I import the EVENT.EVT files for the logs that I can't open in the Event viewer, I can open them as saved logs.

The permissions on the files themselves are for Adminstrators and SYSTEM, Full control.
Joel MillerDevOps Engineer

Can you back up the logs somewhere else and delete the origianls. New logs will be created hopefully they will work again. If not, you can restore the originals.
11/26 Forrester Webinar: Savings for Enterprise

How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.


unfortunately these files are locked by the OS and I'm at a remote location so I can't boot into recovery mode and do anything to them.

Falco Bethkeperformance engineering

you can delete them, if the eventlog service is stopped.
Here it is explained very detailed:;DE;q172156


Oddly, I opened the files you suggested directly in a text editor. And it started working again.

That wasn't exactly the type of result I wanted, because I like to be able to document the problem, cause and solution for others.

But thanks for your help anyway.

ps. I would have tried jmiller47's suggestion, but I was unable to get a chance, thanks for you help as well.

I had this same problem and found the resolution here.  You're gonna laugh at yourself like I did to myself.

Take "GUESTS" out of the members list.  


how you do this, guest account is not member for any users group nor administrator
i do have same problem still remain.

any comments/solution added to this would be highly appriciated

here you go with microsoft artical for CCNI Reply, it did not help me out..

i am still in hunt for answers for the same problem

thanks all

i have solved my problems :) thanks everybody;en-us;892192


i find many people thier having many problems, related to event viewer please see this too,
may help you...
I followed instructions on the MS site ( on how to modify the registry and set RestricGuestAccess = 0 for the event logs, but that did not solve my problem. On a hunch, I then removed the user from the Guest group and the user WAS able to access the event logs.
Joel MillerDevOps Engineer

Is this the proper use of Open Discussion? This sounds like it should be a new question. I can imagine referring to this thread in the new question, but I don't believe that creating an open discussion on a question that has been closed for over 4 years will get you an answer very quickly.

Sorry, I was just commenting on the solution...hoping my comment might help someone else. I did not have an additional question.
Best wishes,

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial