Repost - Unable to remotely manage event log on WinXP Pro upgraded from Win2K

[Mike Matheny]

OK, the remote registry service is running. I can connect to the registry,
and have full control to the HKCR, but immediately get an Access Denied when
trying to access the HKLM or HKCU hives. I have checked the permissions on
those hives, and domain admins have full control, so I am completely
confounded. Even if I didn't have access to the levels below the hive, I
would think I would still be able to at least click on HKLM without getting
the Access Denied message!

 

[Shain Wray [MSFT]]

Hello Mike,

Take a look at the following KB and make sure you have everything setup
correctly for remote access -

314837 How to Manage Remote Access to the Registry
http://support.microsoft.com/?id=314837

The other possibility is that the domain admins group has been added to a
more restricted group or has been explicity denied in the GPO on this local
machine since your other 14 machines work correctly.

Best regards,
--
Shain Wray
Microsoft PSS Security Team

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!

 

[Mike Matheny]

Everything looks fine - even looking at the effective permissions on the
EventLog and EventSystem keys shows local adminstrators have full control
(the domain\domain admins group is a member of local administrators). Tried
removing from the domain and adding back in, still no luck.

 

[Shain Wray [MSFT]]

Hello Mike,

What happens if you give an individual domain account into the Local Admins
group and then connect to the Event Viewer?

What OS are you connecting to the Windows XP system with?

Since this was an upgrade, it is possible that your permissions have been
munged up due to a problem during the upgrade. If this is the case, it
would be best just to backup the data and rebuild clean with Windows XP.

This does seem strange though if you have given the Admins full control on
the winreg key and added the AllowedPaths key entry -
System\CurrentControlSet\Services\Eventlog.


Best regards,
--
Shain Wray
Microsoft PSS Security Team

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!

 

[Mike Matheny]

From a Win2K Server. I will try adding the domain administrator to the local
admins group and report back.