Windows Event Log Service Will Not Start

Some core Windows services are so fundamental that others will not start without them. One such service is the Windows Event Log service. Exchange 2010 (and probably other Exchange versions) will not start without the Event Log service running. This will prevent the use of Exchange Management Shell (EMS) and Exchange Management Console (EMC). This can be caused by the event log file locations being moved to a different folder without the appropriate permissions, or some old event log file permissions being changed preventing the service from being able to create or modify the event logs. The error I have seen is “Error 5: Access denied“. For default permissions required by the Event Log service, see Microsoft Support Article: attempting to start the Windows Event Log Service: “Access denied”. In addition to permissions on the folder(s), I recommend deleting or moving the existing event log files in case they are corrupted or otherwise preventing the service from starting.

If the event log files were moved to a non-standard location and you want to move them back for a more standard system configuration, you can find the settings in the registry as documented on MSDN: “Eventlog Key (Windows)”. The registry location is HKLM\System\CurrentControlSet\Services\Eventlog\* (Application, Security, System, …). If the Event Log Service will not run, you will not be able to use the GUI to change these back (use regedit). I recommend copying the default event log file locations from the registry of a working system with default file locations. *Do not* export and import the whole eventlog section of the registry, just copy and paste the text values of the parameters used to set the event log file locations.


About notesbytom

Keeping technology notes on to free up my mind to solve new problems rather than figuring out the same ones repeatedly :-).
This entry was posted in System Administration and tagged , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s