Can't enable Event Log


  • Hi I have a Windows 2012 Server (Microsoft Windows Server 2012 Datacenter) and would like to do some event logging.

    But when I go to the event logger I am unable to Enable Logging for the desired events. (I'm logged in as the Administrator account) Sadly I can't post a print screen of this yet.

    Everything is greyed out, the Log path is not available (which is the only thing I can change, but it doesn't save when I press "ok")

    I tried right click on the Event Log and choose "Enable Log" but it doesn't work. I tried enabling Auditing in the GPO but that didn't work either.

    I have been looking at the GPO and Register but can't find anything related. How can I enable logging on the server?

    Wednesday, May 16, 2018 8:18 AM

All replies

  • Hi, I believe that to log desired events, either the role or feature for this desired event needs to be installed. What is it you desire to log? Kind regards, Leon

    Blog:  LinkedIn:   

    Wednesday, May 16, 2018 9:52 AM
  • Hi Leon, thanks for your reply.
    The specific log I am interested in is the Microsoft -> Windows -> TerminalServices - LocalSessionManager -> Operational
    Wednesday, May 16, 2018 10:08 AM
  • Hi, Have you tried installing the TerminalServices roles/features snd check if you can enable logging? (Might require a restart). Kind regards, Leon

    Blog:  LinkedIn:   

    Wednesday, May 16, 2018 10:13 AM
  • But I can already make RDS connections to this server. If I compare with a server where it has no problems the roles and features are exactly the same. Might there be another reason this is caused?

    Installing the Remote Desktop Services role didn't help....

    Wednesday, May 16, 2018 10:23 AM
  • Might there be another cause to this issue?

    Another odd thing is that under "Applications and Services Logs" there is a whole lot of folders, usually there is only the "Microsoft" folder. Might this also be an indication of what's wrong?

    htt    ps://       /hVNwDy/screenev       ent.png   remove the spaces (who makes a technical forum where you can't post images.... sigh)

    Friday, May 18, 2018 2:57 PM
  • Hi,

    Hmm.. that is indeed very odd, the Applications and Services Logs folder should look like this:

    There is a possibility that something is corrupted, could you run the following in a command prompt to check for any errors?

    sfc /scannow

    Kind regards,

    Blog:  LinkedIn:   

    Friday, May 18, 2018 3:05 PM
  • I did the scan (which apparently had some fixes) and rebooted the server but to no avail :/.

    I also checked the registry at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels" and it says the log file I want to enable is already enabled (value is 1)
    Wednesday, May 23, 2018 2:47 PM