JSI Tip 8793. When a user attempts to access an event log on a Windows 2000 Server, or on Windows Server 2003, they receive 'Access is denied'?

When accessing an event log on a Windows server, a user receives:

Unable to complete the operation on event log. Access is denied.

If the user is a member of the Guest or Domain Guests, the default behavior is to prevent them from accessing an event log. The RestrictGuestAccess Value Name is set to 1.

To resolve this problem, remove the user from the Guest group and Domain Guests group.

If they continue to have problems, grant them specific Read permission on the event log you wish them to access.

NOTE: The event logs are located at %SystemRoot%\system32\config\<LogName>.