KBI 311951 Inaccessible Windows Event Log From Win2019-Based Server

Version

Argent Advanced Technology – All Versions

Date

Monday, 25 Oct 2021

Summary

This article describes symptom of a remote event log being inaccessible.

Connectivity test from Argent License Manager showed the following error,

***NOT ACCESSIBLE*** Error: The requested operation is not supported. (1764)

The symptom is often noticed during Argent server migration, or after Microsoft Windows update for June 2021 and onwards.

Windows Event Viewer however connected fine all the time, and thus cannot be used a diagnostic test – use the Argent License Manager to diagnose.

Technical Background

The issue is caused by mismatch of Microsoft Windows security update between the local and target server.

In June 2021, Microsoft security update KB 5003635 was released.

Two servers running at different security update levels will suffer this Microsoft problem.

Connectivity Test in Argent AT uses Windows Native Win32 API ‘OpenEventLog’ to test if event log is accessible.

The above API fails when only one of two machines has the KB and onward applied.

Windows Event Viewer runs on a newer Event Log API (also known as Vista Event Log API).

This API is not affected by the security update mismatch and thus the Windows Event Viewer cannot be used as a diagnostic test.

Resolution

Regarding KB 5003635, all servers must have this Microsoft fix applied.

For further information, please contact Argent Instant Help at https://help.argent.com/support