• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 797
  • Last Modified:

Event Viewer - Requirements

Hi,

Could someone tell me, what permissions are required to get the event viewer service running under local service account on windows 7?

I understand that local service will require some permissions to parts of the system drive, i.e. %systemroot%\system32\winevt does anyone know what they are specifically?

Perhaps access to the service itself, so full control on Windows event viewer service?

What about registry access? what does local service need for it to work?

Is there any resource i can find on this? or anyone who might know please? thank you kindly.
0
David Harding
Asked:
David Harding
  • 4
  • 2
1 Solution
 
MereteCommented:
Are you having problems with event viewer/not accessible?
Is this a limited version of windows 7 or something else?

This guide will explain what is going on and why if you are getting an error and then will list steps explaining how to fix the error.
 I have removed the xp procedurals.
To fix this problem by manually editing the registry windows 7
 follow these steps:
1 - Click Start
2 - Click Search Bar
3 - Type Regedit
4 - Hit Enter
5 - Navigate to Key (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog)
6 - Double Click ObjectName
7 - Type NT AUTHORITY\LocalService
8 - Close the registry
9 - Reboot your PC

 Upon reboot the service should startup automatically and you should just be able to open your event logs now with no problems. If you still get the error you will want to try to start the service again manually. To start the event log service manually follow these steps:

1 - Click Start
2 - Click Search Bar
3 - Type Service.msc
4 - Hit Enter
5 - Click Windows Event Log Service
6 - Click Start
You should see a window that opens and starts the service.
source with xp procedurals included
0
 
David HardingHead of IT infrastructureAuthor Commented:
Hi, i will try this out now.

Yes i'm having problems with event viewer, the error itself comes up as

"Windows could not start the Windows Event Log service on Local Computer.

Error 0x8007000e: Not enough storage is available to complete this operation."

I have of course googled but haven't had much luck.

I am using Windows 7 Professional SP 1 64bit. It has 90gig spare on the C: and 8 gig of ram so i don't think the error message means anything other than access rights..
0
 
David HardingHead of IT infrastructureAuthor Commented:
Hi Thank you again for helping, this unfortunately has not worked.

I gave the regkey full access to Local Service. Still same error. Is there anywhere which needs folder permissions perhaps? or any other suggestions? Do let me know, thank you.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
MereteCommented:
Have you cleaned out the TEMP files?
Try running a disc cleanup simple enough to do and let it show you how big your temp folders has become, windows thumbnails view stuff like
Out of memory errors can start with a full TEMP folder plus other things, defrag the drive.
These are the changes  ACLS
Access Control Lists
http://msdn.microsoft.com/en-us/library/aa374872%28v=vs.85%29.aspx
Windows 7 Access Denied: Permission & Ownership
http://www.addictivetips.com/windows-tips/windows-7-access-denied-permission-ownership/
The best place to inquire about these things is MSDN
http://msdn.microsoft.com/en-us/library/ms123401.aspx
LocalService Account (Windows)
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684188(v=vs.85).aspx

Configure Windows Service Accounts and Permissions
http://msdn.microsoft.com/en-au/library/ms143504.aspx#Serv_SID
0
 
David HardingHead of IT infrastructureAuthor Commented:
I have fixed the issue.

The issue seemed to be a corrupt GP Object.

The solution in this case, I copied the original GPO in order to make to amendments, (my thoughts were that should i make changes and wanted to revert, it would be easier to just keep the original for comparision or in case i make too many changes and forget where i was etc). So i copied the original, and started removing all the GP permission restrictions that were in place on services. I then applied the new GPO which solved the issue. In order to specfically determine the offending service, i then went through systematically re-adding all the services and their orginal permissions into my copied GPO. The curious thing was that once i completed re-adding all the permissions... the event service was still working.

I have looked around and it seems like the only logical explanation was the original GPO was corrupted somehow. I am going to post another question in regard to this but at least now i have the event service working as normal.

Thank you so much for your help.
0
 
David HardingHead of IT infrastructureAuthor Commented:
Corrupted GPO was my issue which i apprently solved on my own
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now