"Unable to complete the operation" error in Event Log

[Chris]

Hello,

We are running an new installation of Server2003 in a
mixed domain (two 2003 servers, one original NT4.0
server). The PDC was upgraded to 2003 to carry all domain
accounts and settings, and a second 2003 server was joined
as a DC.

When attempting to access the logs in Event Viewer I get
this on BOTH 2003 servers:
"Unable to complete the operation on "Application".
Access is denied".

The "Application" is replaced with whichever log I am
trying to access. Oddly enough I can successfully open
the Security log on both servers, but none of the other
logs.

I have reset file security on the drives, deleted the old
log files and allowed windows to recreate, with no luck. I
am logging in with the root Administrator / Domain admin
account. I have tried opening the logs from the NT4.0
server with the 'Connect to Server' option, but get a
similar 'Access Denied' error. Anyone have any ideas?

Thanks in advance,

Chris

 

[Diana Smith [MSFT]]

Hello Chris,

The user account used to login belongs to a group that has been added to
local Guests group on the system and the Restrict guest access to
application log policy
has been enforced.

To fix, either disable the policy or remove the appropriate group/groups
from the guests group. In this case the group that was added to the local
Guests group was NTAuthority\Interactive Users.


Remove the specified account from the Guest account if you want to keep the
policy enabled {make sure domain users are not members of the guest group).

-- Or --

Reset the policy back to "Not Defined" and set the following Registry key to
0 instead of 1, and then restart the computer for the changes to take
effect.

HKLM\System\CurrentControlSet\Services\EventLog\Application
Name: RestrictGuestAccess
Type: REG_DWORD
Value: 0x1

HKLM\System\CurrentControlSet\Services\EventLog\System
Name: RestrictGuestAccess
Type: REG_DWORD
Value: 0x1

HKLM\System\CurrentControlSet\Services\EventLog\Security
Name: RestrictGuestAccess
Type: REG_DWORD
Value: 0x1