Event Viewer will not start

  • Thread starter Thread starter Ray Rogers
  • Start date Start date
R

Ray Rogers

I've been struggling with this for a couple of days now without any success,
I noticed the the event viewer would not start, it reported that "Event
Service is unavailable. Verify that the service is running"
Well, the service was not running and my attempts to start Windows Event log
result in an "Error 5: Access is denied"

So to Google I go.
I tried several things that I found there, taking ownership of files,
resetting the whole system to default permissions by using a Microsoft
utility. That reset everything except one folder that it reported as an
error. That was the EtRTeventLog folder, this seems to locked out
completely. I renamed the folder using Unlocker and Windows recreated a new
folder but I still have the same problem.

So, If anyone has a new idea to try, or some way that I can trace this
"fault" I'd really appreciate it.
Oh, I have Vista Ultimate and SP1, I tried to uninstall SP1 but even that
wouldn't work for me.

Ray Rogers
 
Ray Rogers said:
Thanks Mark, no help I'm afraid.

Ray Rogers

Ray,

I had the same problem for months, and it prevented the installation of SP1.

Try:
http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=2552247&SiteID=17

"OK Ladies and Gentleman, here is what we have found;

Apparently, one of the Windows updates is causing corruption of the Access
Control List (ACL's) in the registry. I had entire sections of my registry
nodes that lost the ACL'S.

While I was researching the problem, I came across a website where someone
had a similar problem with getting windows OS programs/services to run and
they discovered that there was some registry corruption and missing ACL's.

There are two different options that I ended up doing to get the system back
in operation.

It seems that running one or the other alone will not fix the problem, but
doing both should get you back in service.

Make a backup of your registry (and a complete backup of the system wouldn't
hurt either!)
Go to Microsoft's website and download a program called subinacl.exe from
this site;
http://www.microsoft.com/downloads/...56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en
Install the subinacl.exe (it downloads as an MSI file).
Copy the code below into a text file and then name the text file reset.cmd.
I copied the command file to my temp folder to run, but as you can see from
the cmd file, it contains the path to the executable subinacl.exe.
@echo off

title Resetting ACLs...

cd /d "%ProgramFiles%\Windows Resource Kits\Tools"

echo.

echo Resetting ACLs...

echo (this may take several minutes to complete)

echo.

echo
==========================================================================

echo.

echo.

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
/grant=system=f

echo.

echo.

subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
/grant=system=f

echo.

echo.

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f
/grant=system=f

echo.

echo.

echo System Drive...

subinacl /subdirectories %SystemDrive% /grant=administrators=f
/grant=system=f

echo.

echo.

echo Windows Directory...

subinacl /subdirectories %windir%\*.* /grant=administrators=f
/grant=system=f

echo.

echo.

echo
==========================================================================

echo.

echo FINISHED.

echo.

echo Press any key to exit . . .

pause >NUL

3. As this command file runs it will show you the status of the reset and
create a log that you can go back into and inspect for problems.

4. When this command file completes, you then need to open a command window
(using Run As Administrator) and run the following command;

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb
/verbose >c:\temp\secedit_output.txt (the redirect of output echos the
programs output to a text file, but secedit also creates a log file. The
program will show you the location of the log file when it is done).

These two actions combined will reset the permissions on the registry nodes
back to their default settings.

Reboot and check your Event Log service... at this point it should be
running.

After effects of this process which happened to me, were that the Network
List Service would not run... I still had network and internet access,
however the Network icon in the task notification area had a Red X, and
mouse over displayed a tooltip that said "Server Execution Failed". This
was a result of resetting the ACL's.

The Network List Service (netprofm) would not run because it did not have
permission to run.

In order to correct this issue, you must open the Component Services
snap-in and drill down under Computers/My Computer/DCOM Config/netprofm
(this is for Vista!) and right click the node, and select Properties.

Click on the Security tab and make certain the correct user names are listed
and that they have the appropriate permissions. I have 4 users listed with
the same permissions; (your mileage may vary )

Administrators - Perms; Local Launch, Local activation
Interactive
Local Service
System
Next, go to the Identity tab and ensure that The System account (services
only) is the item that is checked. Make sure the changes you make get
applied.

Restart your computer so the ACL's are refreshed.

Once you come back up from the reboot, things should be pretty much back to
normal.

You may find a stray program here and there that may need to have it's
permissions reset, but you should be operational.

I directed the Microsoft engineers to this forum (and Goggle search it) so
they can see this is getting to be an issue for a lot of people. They in
fact have a brand new case (same problem) that was just escalated to them
and they are going to take an Image of that persons system first thing so
they can determine what is causing this, and if necessary put out a hotfix
or service pack to correct it.

In the meantime, if you run into anyone else going through this problem, at
least there was one solution that worked for me...

I cannot guarantee that this will work for everyone and the issue may effect
each machine differently, so just be aware that this is not the blue pill!

I think that because the Registry database is so critical to the operation
of Windows, Microsoft engineers should have some sort of utility that can
repair and/or reset the registry and file permissions easily should
something happen...

I personally believe that this should be part of the base operating system
and we should not have to shell out extra bucks to third party vendors for
these type of utilities, particularly if the registry is prone to corruption
either by Microsoft's own hands or by a third party application.

I am not knocking third party programmers as I am one myself, I am just
saying that this is Microsoft's OS and they should provide these easily
accessible tools to keep us running!

Good Luck!"

I tried this and it worked, and I was then able to install SP1 without any
errors.

--
Live strong and have a nice day, - "Nil carborundum illegitimi"!
Mac H E L P the planet - Don't I D L E ! ! !
Over 1600 Links at Http://MacArthur.Funknstyle.Com
Pictures at http://www.flickr.com/photos/macarthur
and http://www.flickr.com/photos/macarthur-ii/
 
Thanks Mark, this was the utility that I had previously tried but I ran it
again just in case I missed something. Still the same result, there were a
few error messages, I don't think they are related, I'm including them here
just in case.
Still no Event log.

Ray


----Configure File Security...
Configure c:\program files\common files\speechengines\microsoft\tts.
Warning 2: The system cannot find the file specified.
Error setting security on c:\program files\common
files\speechengines\microsoft\tts.
Configure c:\programdata\microsoft\windows\drm.
Configure c:\programdata\microsoft\windows\drm\cache.
Configure c:\windows\repair\default.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\default.
Configure c:\windows\repair\ntuser.dat.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\ntuser.dat.
Configure c:\windows\repair\sam.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\sam.
Configure c:\windows\repair\security.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\security.
Configure c:\windows\repair\software.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\software.
Configure c:\windows\repair\system.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\system.
Configure c:\windows\system32\wbem\mof.
Configure c:\windows\system32\windows media.
Warning 2: The system cannot find the file specified.
Error setting security on c:\windows\system32\windows media.

File Security configuration was completed successfully.


----Configure General Service Settings...
Configure sysmonlog.
Error 1060: The specified service does not exist as an installed service.
Error opening sysmonlog.
Configure SamSs.
Configure ntmssvc.
Error 1060: The specified service does not exist as an installed service.
Error opening ntmssvc.
Configure netddedsdm.
Error 1060: The specified service does not exist as an installed service.
Error opening netddedsdm.
Configure netdde.
Error 1060: The specified service does not exist as an installed service.
Error opening netdde.
Configure dmserver.
Error 1060: The specified service does not exist as an installed service.
Error opening dmserver.
Configure clipsrv.
Error 1060: The specified service does not exist as an installed service.
Error opening clipsrv.
 
You are probably stuck with waiting for a better Windows Update. I would use
System restore, and disable the suspect update. You are in a tough spot, and
should definitely consider backing up vital data.
If you are so inclined, you should save a report from MSINFO32 , and send it
to the Microsoft people.
Help and Support - 2 instances free:
https://support.microsoft.com/oas/default.aspx?ln=en-us&prid=3518&gprid=185522
--
Was this helpful? Then click the Ratings button. Voting helps the web
interface.
http://www.microsoft.com/wn3/locales/help/help_en-us.htm#RateAPostAsAnswer
Mark L. Ferguson
..
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

False Event Viewer/WinUpdate messages? 11
Event Viewer 1
Event Viewer Not Working 3
Event Viewer Error 1
Windows Audio won't start....MMCSS service 5
permission question 2
Event Viewer Question 13
Event Viewer 5

Back
Top