EventLog Permission Difference between 2016 and 2019

%3CLINGO-SUB%20id%3D%22lingo-sub-1008059%22%20slang%3D%22en-US%22%3EEventLog%20Permission%20Difference%20between%202016%20and%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1008059%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20there%2C%3C%2FP%3E%3CP%3EWe%20have%20a%20legacy%20application%20that%20is%20trying%20to%20create%20an%20event%20source%20and%20tries%20to%20write%20event%20logs%20in%20a%20separately%20created%20EventLog.%20I%20tried%20to%20assign%20the%20permissions%20according%20to%20the%20following%20article%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fde-ch%2Fhelp%2F323076%2Fhow-to-set-event-log-security-locally-or-by-using-group-policy%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fde-ch%2Fhelp%2F323076%2Fhow-to-set-event-log-security-locally-or-by-using-group-policy%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20works%20in%20Windows%20Server%202016%2C%20but%20not%20for%20Windows%20Server%202019.%20According%20to%20my%20network%20trace%20the%20server%20replies%20with%26nbsp%3B%5BExpert%20Info%20(Note%2FResponse)%3A%20Fault%3A%20nca_s_fault_ndr%5D.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20kind%20of%20stuck%20here.%20Do%20you%20have%20any%20suggestions%20how%20I%20can%20continue%20my%20troubleshooting%20here%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%3CBR%20%2F%3EO%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1008059%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1008774%22%20slang%3D%22en-US%22%3ERe%3A%20EventLog%20Permission%20Difference%20between%202016%20and%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1008774%22%20slang%3D%22en-US%22%3E%3CP%3EMay%20be%20a%20known%20issue%20yet%20to%20be%20resolved.%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsocial.technet.microsoft.com%2FForums%2Fen-US%2Fae6a2063-dd63-455c-b556-e8057c52b822%2Fwin10-1809-broke-psloglist-quotthe-stub-received-bad-dataquot-errors-towards-remote-computers%3Fforum%3Dpstools%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3Ehttps%3A%2F%2Fsocial.technet.microsoft.com%2FForums%2Fen-US%2Fae6a2063-dd63-455c-b556-e8057c52b822%2Fwin10-1809-broke-psloglist-quotthe-stub-received-bad-dataquot-errors-towards-remote-computers%3Fforum%3Dpstools%3C%2FFONT%3E%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3Emight%20also%20ask%20for%20help%20here%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsocial.msdn.microsoft.com%2FForums%2Fwindowsdesktop%2Fen-US%2Fhome%3Fforum%3Dwindowsgeneraldevelopmentissues%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3Ehttps%3A%2F%2Fsocial.msdn.microsoft.com%2FForums%2Fwindowsdesktop%2Fen-US%2Fhome%3Fforum%3Dwindowsgeneraldevelopmentissues%3C%2FFONT%3E%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3Eand%20also%20report%20the%20issue%20over%20here%20on%20uservoice.%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fwindowsserver.uservoice.com%2Fforums%2F295047-general-feedback%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3Ehttps%3A%2F%2Fwindowsserver.uservoice.com%2Fforums%2F295047-general-feedback%3C%2FFONT%3E%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

Hi there,

We have a legacy application that is trying to create an event source and tries to write event logs in a separately created EventLog. I tried to assign the permissions according to the following article:
https://support.microsoft.com/de-ch/help/323076/how-to-set-event-log-security-locally-or-by-using-gr...

 

It works in Windows Server 2016, but not for Windows Server 2019. According to my network trace the server replies with [Expert Info (Note/Response): Fault: nca_s_fault_ndr].

 

I am kind of stuck here. Do you have any suggestions how I can continue my troubleshooting here?

 

Thanks,
O

1 Reply