The Operations Manager Audit Collection Service does not start and Event ID 4668 is logged after you install Audit Collection Server from a read-only source

When you install Audit Collection Server from a read-only source, you experience the following symptoms. For example, you experience these symptoms when you install Audit Collection Server from the Microsoft System Center Operations Manager 2007 media:

• One of the following pages appears in the Audit Collection Services Collector Setup wizard:
  
  
  Wizard page 1
  Audit Collection Services has been successfully installed
  
  Find Source Folder: Success
  Create Target Folder: Success
  Copy Files: Success
  Create AdtServer Service: Success
  Write AdtServer Registry Parameters: Success
  Write Password: Success
  Register Application Log: Success
  Register Performance DLL: Success
  Register MOF File: Success
  Create Data Source: Success
  Create Database: Success
  Create Database Tables: Success
  Create Database Stored Procedures: Success
  Create Database Login: Success
  Configure Database Time Format: Success
  Start AdtServer Service: Success
  Wizard page 2
  Audit Collection Services installation failed
  
  Find Source Folder: Success
  Create Target Folder: Success
  Copy Files: Success
  Create AdtServer Service: Success
  Write AdtServer Registry Parameters: Success
  Write Password: Success
  Register Application Log: Success
  Register Performance DLL: Success
  Register MOF File: Success
  Create Data Source: Success
  Create Database: Success
  Create Database Tables: Success
  Create Database Stored Procedures: Success
  Create Database Login: Success
  Configure Database Time Format: Success
  Start AdtServer Service: Failure (0x00000005)
• The Operations Manager Audit Collection Service does not start. If you try to start this service, you receive the following error message:
  Could not start the Operations Manager Audit Collection Service service on Local Computer.
  
  Error 5: Access is denied.
• The following event is logged in the Application log:

  Event Source: AdtServer
  Event Category: None
  Event ID: 4668
  Date: date
  Time: time
  Type: Error
  User: NT AUTHORITY\NETWORK SERVICE
  Computer: ComputerName
  Description: AdtServer encountered the following problem during startup:
  Task: Create Machine Register
  Failure: An error occured connecting to the database and retrieving groups and machines
  Error: 0x00000005
  Error Message:
  Access is denied.

This problem occurs because the AcsConfig.xml file has the Read-only attribute set. If the Operations Manager Audit Collection Service (AdtServer.exe) cannot write to this file, the Operations Manager Audit Collection Service cannot start.

Note The AscConfig.xml file is located in the following folder:

To work around this problem, use one of the following methods, depending on whether Audit Collection Server is installed.

Method 1: Audit Collection Server is installed

If Audit Collection Server is installed, clear the Read-only attribute of the AscConfig.xml file, and then start the Operations Manager Audit Collection Service. To do this, follow these steps:

1. Click Start, click Run, type %systemroot%\system32\security\adtserver, and then click OK.
2. Right-click AcsConfig.xml, and then click Properties.
3. On the General tab, click to clear the Read-only check box, and then click OK.
4. Click Start, click Run, type cmd, and then click OK.
5. At the command prompt, type the following command, and then press ENTER:
   net start adtserver

Method 2: Audit Collection Server is not installed

If Audit Collection Server is not installed, use one of the following methods to clear the Read-only attribute of the AscConfig.xml file.

Method A: Before the installation

If you have not started to install Audit Collection Server, follow these steps:

1. Copy the contents of the Operations Manager 2007 CD to a shared network resource or to a local folder.
2. Locate the acs\platform\AcsConfig.xml file. Then, follow the steps in method 1 to remove the Read-only attribute from the file.
   
   Note In this path, platform represents one of the following folders, depending on your installation:
   • AMD64
   • i386
   • ia64
3. Install Audit Collection Server from the shared network resource or from the local folder.

Method B: During the installation

If you install Audit Collection Server together with the Audit Collection Server database, you can clear the Read-only attribute of the AscConfig.xml file during the installation. To do this, follow these steps:

1. Start the installation of Audit Collection Server.
2. Follow the steps in the Audit Collection Services Collector Setup wizard. When the wizard creates the Audit Collection Server database, a SQL Server logon prompt appears.
3. Before you click OK, follow the steps in method 1 to remove the Read-only attribute from the AcsConfig.xml file.
4. Follow the remaining steps in the Audit Collection Services Collector Setup wizard to install Audit Collection Server.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Steps to reproduce the problem

1. Click Install Audit Collection Server on the Operations Management 2007 CD. Then, follow the steps in the Audit Collection Services Collector Setup wizard to install Audit Collection Server.
   
   The following information appears on the Audit Collection Services has been successfully installed page of the wizard:
   Find Source Folder: Success
   Create Target Folder: Success
   Copy Files: Success
   Create AdtServer Service: Success
   Write AdtServer Registry Parameters: Success
   Write Password: Success
   Register Application Log: Success
   Register Performance DLL: Success
   Register MOF File: Success
   Create Data Source: Success
   Create Database: Success
   Create Database Tables: Success
   Create Database Stored Procedures: Success
   Create Database Login: Success
   Configure Database Time Format: Success
   Start AdtServer Service: Success
2. Click Finish to exit the wizard.
3. Click Start, click Run, type eventvwr, and then click OK.
4. In Event Viewer, click Application.
   
   Error event ID 4668 is logged in the Application log.
5. Click Start, click Run, type services.msc, and then click OK.

The Operations Manager Audit Collection Service is not started.