Windows 2008 event log access denied

Assume that a terminal server is running Windows Server When many remote desktop users try to log on to the terminal server at the same time, the users receive "Access is denied" error messages. Therefore, TCP port exhaustion occurs, and the terminal server cannot establish out-going TCP connections with a domain controller.

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix. If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article.

If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix. Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix.

For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft website:. If you do not see your language, it is because a hotfix is not available for that language. For more information about how to obtain a Windows Server service pack, click the following article number to view the article in the Microsoft Knowledge Base:.

The global version of this hotfix installs files that have the attributes that are listed in the following tables. The dates and the times for these files on your local computer are displayed in your local time together with your current daylight saving time DST bias. In Events Viewer, if I right click on the Security log and select properties, the Properties dialog comes up. If I attempt to change the properties, like the name or path of the associated eventlog file, I get an Access Denied error, but if I close and re-open the Security eventlog properties, it appears to have updated.

I can open and view any of the other event logs fine application, system, etc from the event viewer, and they are all collecting events. I also tried logging on locally to see if the local admin account can access the Security event log, and that did not help. I tried deleting the security. Tried copying a good Security. I did restart the Windows Event Service between each of these steps, and re-booted after the domain OU changes.

I seem to have run out of ideas? What next? Where should I look to determine the issue? Was this reply helpful? Yes No. This issue has been discussed before. This can be beneficial to other community members reading the thread. Monday, December 12, PM. Regards, RK. Tuesday, December 13, AM. Deaktivate then before you kill them 4. For sure I would recommend logging boot Enable Regards Milos. Wednesday, April 24, PM. Proposed as answer by senthilgmtech Wednesday, April 5, PM.

Thursday, March 27, AM. This was the fix. Tuesday, December 22, PM. Worked for me, thank you! Saturday, January 16, AM. The below steps works for me! Windows Event Viewer service was not starting: sc. Wednesday, April 5, PM. Worked like a charm! Saturday, July 22, PM.