Win2K Server Event Viewer not logging any events 1

[dufresnem]

When I select Event Viewer to view the (Local) event logs on my Win2K Server with AD, no events are biing logged.

The service is running and indicates "Started". I cannot stop the service because the start & stop buttons are shaded out.

Looked under Group Policies and enabled what I could. Still doesn't work.

Any suggestions?????

 

[vbrocks]

You have to enable auditing in the security policies....

 

[dufresnem]

That's what I've done, which doesn't seem to be working. On my Win2K Server with AD, Under Administrative Tools, I went under Group Policies for the DC, Local, etc... I checked all settings. What wasn't selected, I configured.

The event logs show nothing. DOes the server have to be rebooted? Did I access the policies in the right area?

 

[oisnds]

Event logs are local to the server. You need to activate auditing in the Local Security Policies.

 

[pgoss]

Try this
under services disable Event log. Start - run - services.msc

You will then have to reboot your system

Do a search for *.evt, and delete sysevent.evt, secevent.evt, and appevent.evt or add.old to the end, if you are not so sure about deleting.

They are located %SystemRoot%\Winnt\System32 \config\<file>.evt

Go back to Services and restart Event log and set to Automatic. You should be good to go

 

[dufresnem]

Sory I didn't respond back sooner. It took me this long to get this to work this far. Now, maybe you know what is causing the service to be shaded out.

All of a sudden, it started logging!!!!!! BUT, under Services the Event Service is still shaded out. I can't manually stop the service.

 

[pgoss]

I think I am reading this right, if not sorry.

Select the service and change the vaule to disabled then reboot. You will recieve an error that a service didn't start, no biggie. Go through delete the *.evt logs and then go back into the services and switch it back to automatic. At this point just start the service.

hth
-pgoss