Access Denied Event Viewer

Event viewer "access is denied" on Server 2003 upgraded from 2000

When you try to remotely manage (e.g. Event Viewer, etc.) a server that's been ugpraded from Windows 2000 Server to Windows Server 2003 you get an "Access is denied" error message. Access Denied Event Viewer



The error messages occur because the Local Service user account does not have permissions to the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ SecurePipeServers\winreg



The article below (from Microsoft's KB) refers to XP and 2000 but it holds for 2003 and 2000.
RESOLUTION

To resolve this issue, use Registry Editor to grant Read Only permissions to the Local Service user account. To do this, follow these steps:

1.


Click Start, click Run, type regedit, and then click OK.

2.


Expand the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ SecurePipeServers

3.


Right-click winreg, and then click Permissions.

4.


Click Add.

5.


In the Enter the object names to select box, type Local Service, and then click OK.

Alternatively, you can type the name of a user or group that you want to grant access permission.

6.


In the Permissions for LOCAL SERVICE list, next to Read, click to select the Allow check box.

7.


Quit Registry Editor, and then restart your computer.
MORE INFORMATION

By default, Windows 2000 does not have a built-in user account named Local Service. Instead, the Remote Registry Service is logged on as Local System. In Windows XP, the Remote Registry Service is logged on as Local Service. Access Denied Event Viewer