Symptoms
You receive an error message that resembles the following when you try to install or upgrade Microsoft Exchange Server. For example, this issue can occur when you try to upgrade Microsoft Exchange Server 2010 Service Pack 1 (SP1) to Exchange Server 2010 SP2:
Cannot open log for source ‘MSExchangeSetup.’ You may not have write access
at System.Diagnostics.EventLog.OpenForWrite(String currentMachineName)
at System.Diagnostics.EventLog.InternalWriteEvent(UInt32 eventID, UInt16 category, EventLogEntryType type, String[] strings, Byte[] rawData, String currentMachineName)
at System.Diagnostics.EventLog.WriteEvent(EventInstance instance, Byte[] data, Object[] values)
at Microsoft.Exchange.Setup.Common.SetupEventLog.LogEvent(Int64 eventId, Int32 categoryId, EventLogEntryType type, Object[] messageArgs)
at Microsoft.Exchange.Setup.Common.ConfigurationDataHandler.OnSaveData()
at Microsoft.Exchange.Management.SystemManager.WinForms.SingleTaskDataHandler.OnSaveData(CommandInteractionHandler interactionHandler)
at Microsoft.Exchange.Management.SystemManager.WinForms.DataHandler.Save(CommandInteractionHandler interactionHandler)
at Microsoft.Exchange.Management.SystemManager.WinForms.DataHandler.OnSaveData(CommandInteractionHandler interactionHandler)
at Microsoft.Exchange.Management.SystemManager.WinForms.SingleTaskDataHandler.OnSaveData(CommandInteractionHandler interactionHandler)
at Microsoft.Exchange.Management.SystemManager.WinForms.DataHandler.Save(CommandInteractionHandler interactionHandler)
at Microsoft.Exchange.Management.SystemManager.WinForms.DataHandler.OnSaveData(CommandInteractionHandler interactionHandler)
at Microsoft.Exchange.Management.SystemManager.WinForms.SingleTaskDataHandler.OnSaveData(CommandInteractionHandler interactionHandler)
at Microsoft.Exchange.Management.SystemManager.WinForms.DataHandler.Save(CommandInteractionHandler interactionHandler)
at System.ComponentModel.BackgroundWorker.WorkerThreadStart(Object argument)
Access is denied
Additionally, you may receive an error message that resembles the following when you try to view the Application log or the System log in Event Viewer:
Event Viewer cannot open the event log or custom View. Verify that Event log service is running or query is too long. Access Denied (5)
Cause
This issue occurs if the CustomSD registry value is incorrect.
Resolution
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows
-
Click Start, click Run, type regedit, and then click OK.
-
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application -
Verify that the CustomSD value contains the following string (The screen shot for this step is listed below):
(A;;0x7;;;BA)
If the CustomSD value does not contain this string, go to the next step. -
Right-click CustomSD, and then click Modify.
-
In the Value Data box, edit the CustomSD value so that it contains the string in step 3, and then click OK (The screen shot for this step is listed below).
-
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\System -
Repeat steps 3 through 5 for the registry subkey in step 6.
-
Exit Registry Editor.
-
Try to install or upgrade Exchange Server again.
References
For more information about the CustomSD registry value, visit the following MSDN website:
http://msdn.microsoft.com/en-us/library/windows/desktop/aa363648(v=vs.85).aspxFor more information about how to set event log security locally or by using Group Policy in Windows Server 2003, see the following article in the Microsoft Knowledge Base:
323076 How to set event log security locally or by using Group Policy in Windows Server 2003
