Re: Event Viewer cannont connect to remote WinXP SP2 event viewer

WOW!! I would have never figured that out. That fixed it.

Further info: the Local Service account permission that you identified was
being lost when we joined a PC to the domain. We had to use a computer
group policy to correct the problem.

Thank you very much!

"Vincent Xu [MSFT]" <v-xuwen@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:A$7RjkZ$GHA.3164@xxxxxxxxxxxxxxxxxxxxxxxx
Hi,

Go to the following registry key:

HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg

Check if the Local Service account have Query Value, Enumnerate Subkeys,
Notify, and Read Control allowed permission.

Thanks.

Best regards,

Vincent Xu
Microsoft Online Partner Support

======================================================
Get Secure! - www.microsoft.com/security
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no rights.
======================================================



--------------------
From: "Russell" <Clarksville@xxxxxxxxxxxxx>
References: <OxeLmZG$GHA.2180@xxxxxxxxxxxxxxxxxxxx>
<LBMxrLL$GHA.1984@xxxxxxxxxxxxxxxxxxxxx>
Subject: Re: Event Viewer cannont connect to remote WinXP SP2 event
viewer
Date: Tue, 31 Oct 2006 09:45:53 -0600
Lines: 75
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-RFC2646: Format=Flowed; Original
Message-ID: <#SaaqOQ$GHA.3480@xxxxxxxxxxxxxxxxxxxx>
Newsgroups: microsoft.public.windowsxp.security_admin
NNTP-Posting-Host: nsc64.90.20-10.newsouth.net 64.90.20.10
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP04.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.windowsxp.security_admin:192363
X-Tomcat-NG: microsoft.public.windowsxp.security_admin

Thanks for suggestion. I confirmed that is "remote registery" service is
already running on all the WinXP SP2 PCs. So that is not the problem.
Further thoughts?

"Vincent Xu [MSFT]" <v-xuwen@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:LBMxrLL$GHA.1984@xxxxxxxxxxxxxxxxxxxxxxxx
Hi,

From your description, it appears that the "remote registry" service is
not
running.

Please run "services.msc" and find "remote resigry" service to start
it.

Then, check this issue again.


Best regards,

Vincent Xu
Microsoft Online Partner Support

======================================================
Get Secure! - www.microsoft.com/security
======================================================
When responding to posts, please "Reply to Group" via your newsreader
so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no
rights.
======================================================



--------------------
From: "Russell" <Clarksville@xxxxxxxxxxxxx>
Subject: Event Viewer cannont connect to remote WinXP SP2 event viewer
Date: Mon, 30 Oct 2006 14:58:53 -0600
Lines: 15
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-RFC2646: Format=Flowed; Original
Message-ID: <OxeLmZG$GHA.2180@xxxxxxxxxxxxxxxxxxxx>
Newsgroups: microsoft.public.windowsxp.security_admin
NNTP-Posting-Host: nsc64.90.20-10.newsouth.net 64.90.20.10
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP05.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.windowsxp.security_admin:192320
X-Tomcat-NG: microsoft.public.windowsxp.security_admin

Within EVENTVWR.MSC, Select Connect to Another Computer.

I successfully connect to any remote Windows 2003 or 2000 event viewer
logs.
I always fail when connecting to remote WinXP SP2 machines. Error is:

"Unable to connect to the computer 'computer name or ip address here'
The
error was Access Denied."

I am logged on to local PC with a domain account that is member of
Domain
Admins. All PCs are domain members. I have turned off Windows
Firewall
on
remote Win XP machines. This is all being done on a private LAN
segment.
(i.e. no firewalls other than Windows Firewall involved.) Does not
seem
to
be AV related either. Would appreciate any suggestions. thanks,
Russell










.