1

I have a project that included 3 windows services, the services were worked very well, then for business needs, we need to move from windows server 2008 to windows server 2019.

The issue which I faced is:

When I install the services, It didn't start and returned the error in the Event Viewer:

Service cannot be started. System.Security.SecurityException: The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security, State.

I searched for this issue and I found a lot of answers ( like this) but it won't help me.

I installed the services in Command Line as administrator using InstallUtil.exe.

Then opened the Registry Editor and give the user NETWORK SERVICE a full control in the path as below:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Security HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog

Then I check the subkey of the services in the path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application

Also, it exists.

My code related to EventLog :

 public class EventViewer
{
    public static void WriteEvent(string ServiceName, string msg, EventLogEntryType _EventLogEntryType)
    {

        EventLog eventLog = new EventLog();
        eventLog.Source = ServiceName;
        eventLog.Log = "Application";
        ((System.ComponentModel.ISupportInitialize)(eventLog)).BeginInit();
        if (!EventLog.SourceExists(eventLog.Source))
        {
            EventLog.CreateEventSource(eventLog.Source, eventLog.Log);
        }
        ((System.ComponentModel.ISupportInitialize)(eventLog)).EndInit();
        eventLog.WriteEntry(msg, _EventLogEntryType);
    }
}

The Event Viewer give me the line of the exception and it refers to:

((System.ComponentModel.ISupportInitialize)(eventLog)).BeginInit();

I tried to debug the service on my machine using Visual Studio 2019, but also give me the same error, and the service wouldn't start to debug using "Attach to Process".

M.Youssef
  • 146
  • 9

1 Answers1

1

I think the issue is while scanning the registry to check if the event source exist. https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.createeventsource?view=dotnet-plat-ext-6.0

As per Microsoft the account requires administrative privilege to do this task. I have also seen there is a new registry hive under 'EventLog' called 'state' in windows 2019 which has less access compared to other hives.

Debug with process monitor and see if you are getting access denied in that hive.

Shauvik Dutta
  • 11
  • 1