asked on

Error when reading Event viewer security log

While logged in on W2K server w/Exchange 2k installed and working fine, all of a sudden I am unable to view my Security Log in event viewer. All other logs are fine.

I receive a message "unable to complete the operation on "Security Log"
"A required privilege is required by the client"

What does this mean? I trying logging on as administrator or exch admin and get the same message. thanks.

Rich Weissler

One possibility:

http://support.microsoft.com/?kbid=272587
This behavior can occur if the Administrators group has been removed from the "Backup Files and Directories" user right.

oBdA

Another thing to look at: Start secpol.msc, go to Local Policies\User Rights Assignment; make sure the Administrators group is still listed under under "Manage auditing and security log" (by default this is the only group that has this right).

jlagasse

ASKER

I took a look at that and the Administrators Group is correctly set. Admin group also has rights to "Backup Files and Directories". Why would this suddenly occur?

ASKER CERTIFIED SOLUTION

Rich Weissler

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

CCNI

I had this same problem and found the resolution here. You're gonna laugh at yourself like I did to myself.

Take "GUESTS" out of the members of list.

Guests don't have rights to the event logs

:-)

jlagasse

ASKER

What lists? I am able to see all other event logs except Security. Thanks.