Event log check Access Denied

Kris · Post by **Kris** » Tue Jan 28, 2014 6:57 am

Hiya all,

I'm trying to create an event log check, but as soon as I hit the "Log/Channel" drop down list I get the following error:

"Cannot retreive Channels list from <COMPUTERNAME>
Cannot open channel list. Access is denied.
Local system list will be used"

HM version: 9.59
HM computer OS: W7 x64
Target OS: W2K8 r2

I've reviewed the credentials, even added them manually, still no joy.

However, I can browse the target's event log from the HM computer without any problem....

Any ideas?

KS-Soft · Post by **KS-Soft** » Tue Jan 28, 2014 7:04 am

HostMonitor started as service?
Application?
UAC enabled?

Regards
Alex

Kris · Post by **Kris** » Tue Jan 28, 2014 7:12 am

HM as application.
UAC disabled locally and on target.

KS-Soft · Post by **KS-Soft** » Tue Jan 28, 2014 8:03 am

HostMonitor started under admin account?
Could you check security event log on target system? Any errors?

Regards
Alex

Kris · Post by **Kris** » Tue Jan 28, 2014 9:29 am

Yes, HM started under domain admin account.
There are no relevant errors on the target or HM system....

Mind you, I can connect to and browse the remote eventlog with the eventviewer....

Weird eh?

KS-Soft · Post by **KS-Soft** » Tue Jan 28, 2014 12:32 pm

We cannot reproduce this problem...
Could you try to start HostMonitor using built-in administrator account?

Regards
Alex

Kris · Post by **Kris** » Wed Jan 29, 2014 12:35 pm

What do you mean by that?
I run HM as domain administrator...

KS-Soft Europe · Post by **KS-Soft Europe** » Wed Jan 29, 2014 2:05 pm

Every Windows system has built-in administrator account. On Windows Vista+ this account disabled by default
http://technet.microsoft.com/en-us/libr ... s.10).aspx

I run HM as domain administrator...

Does it belongs to local administrators group?

Could you enable BUITL-IN Administrator account on target system (W2K8 r2) and use it in "Connect as" option of NT Event Log test?

Kris · Post by **Kris** » Thu Jan 30, 2014 2:22 am

Still no luck...

The local administrator on the target computer was enabled.
Tried using these credentials; still the same...

The group Domain Admins was already member of the local administrators group on the target.
Added the domain administrator specifically; still the same...

Kris · Post by **Kris** » Thu Jan 30, 2014 4:10 am

Update:

Moved the whole HM installation to another server (W2K8R2)
Still the same behavior.....

KS-Soft Europe · Post by **KS-Soft Europe** » Thu Jan 30, 2014 8:46 am

Both systems are located on the same Domain?
How do you specify remote system: using IP/HostName/FQDN?

Kris · Post by **Kris** » Thu Jan 30, 2014 9:48 am

Both systems are on the same vlan and the same domain.
Tried IP, HostName and FQDN.

No difference in behavior.

As I said, I can connect to and browse the remote eventlog with the eventviewer.
So basically it seems there are no security or authentication issues between the two.

Tried some more:
It does work with W2K3 servers, but I can't set up a NT EventLog test against any of our W2K8R2 servers.
However, it does work to <localhost>, which is also W2K8R2....

KS-Soft Europe · Post by **KS-Soft Europe** » Thu Jan 30, 2014 10:43 am

What Compatibility mode do you use: "Windows NT mode" or "Windows Vista mode"?

Kris · Post by **Kris** » Thu Jan 30, 2014 12:42 pm

For testing the W2K3 server I used NT mode, for W2K8r2 I used Vista mode, as per instructions.

I also tried NT mode on the W2K8 target. Although it configures without errors, it doesn't actually work. New events are not detected then.

KS-Soft Europe · Post by **KS-Soft Europe** » Thu Jan 30, 2014 1:22 pm

Have you checked Security log on Target system? Any failure logins?
Could you please setup several additional test items for the same target system and using same user account (using "Connect as" option or Connection Manager)?
- CPU Usage test
- Service test
- Process test
- Performance Counters test
- WMI test