none
Cannot set ACS filter

    Question

  • Hi,

    whenever I try to set a filter for ACS I'm getting 'error 0x00000005, access is denied'. I'm running the console as administrator and I'm logged on with a domain admin account. 'adadmin.exe /getquery' does work.

    I have no idea where the problem is since the account has access to the adtserver folder, too.

    I'm running SCOM 2012 with SQL Server 2008 R2.

    Thank you in advance,

    Marius


    • Edited by hype00 Wednesday, May 2, 2012 7:44 AM
    Wednesday, May 2, 2012 7:32 AM

Answers

  • I had this same issue.

    Server:  Windows 2008 R2 Sp1

    Installation was SCOM 2012, ACS (Audit Collection Services) in a default config.

    The service is configured to run as 'Network Service'.  When trying to set a filter, the service tries to update a registry entry:

    HKLM\SYSTEM\CurrentControlSet\services\AdtServer\Parameters

    The string that it wants to update is 'DbQueueQuery'.

    The permissions to this registry key does not allow 'Set Value'.  You will need to update the permissions on this registry key to allow 'Network Service' the ability to set this registry value.

    • Proposed as answer by NordicWalker Saturday, May 19, 2012 4:39 AM
    • Marked as answer by Yog LiModerator Wednesday, May 23, 2012 8:37 AM
    Thursday, May 17, 2012 4:40 PM

All replies

  • Hello Marius,

    Did you open the command-prompt Run as Adminisrator?

    What is the filter command you are trying?!


    Regards,

    Mazen Ahmed

    Wednesday, May 2, 2012 11:37 AM
  • I open the command-prompt Run as Administrator. If I don't 'adtadmin /getquery' also says 'access is denied'.

    The filter command is 'adtadmin.exe /setquery /query:"select * from adtsevent where not eventid=4625"'

    Wednesday, May 2, 2012 11:52 AM
  • try this, do not copy and paste the query "Select * From adtsevent Where NOT (eventid=4625)", and write it manual..


    Regards, Mazen Ahmed

    Wednesday, May 2, 2012 1:29 PM
  • Thanks, but I'm still getting an 'access is denied' error.
    Thursday, May 3, 2012 7:20 AM
  • Can you try using the Management Server Action Account?


    Regards, Mazen Ahmed

    Friday, May 4, 2012 11:40 AM
  • If I open the command-promt as the Management Server Action Account I get 'access is denied' when using "adtadmin /getquery" and "adtadmin /setquery".

    Perhaps there is a privilege problem in the ACS database? Besides that I can't set any filter ACS works fine, events are being collected and stored in the database and I'm able to run reports.


    • Edited by hype00 Tuesday, May 8, 2012 10:20 AM
    • Proposed as answer by NordicWalker Thursday, May 17, 2012 4:37 PM
    • Unproposed as answer by NordicWalker Thursday, May 17, 2012 4:37 PM
    Tuesday, May 8, 2012 6:19 AM
  • I had this same issue.

    Server:  Windows 2008 R2 Sp1

    Installation was SCOM 2012, ACS (Audit Collection Services) in a default config.

    The service is configured to run as 'Network Service'.  When trying to set a filter, the service tries to update a registry entry:

    HKLM\SYSTEM\CurrentControlSet\services\AdtServer\Parameters

    The string that it wants to update is 'DbQueueQuery'.

    The permissions to this registry key does not allow 'Set Value'.  You will need to update the permissions on this registry key to allow 'Network Service' the ability to set this registry value.

    • Proposed as answer by NordicWalker Saturday, May 19, 2012 4:39 AM
    • Marked as answer by Yog LiModerator Wednesday, May 23, 2012 8:37 AM
    Thursday, May 17, 2012 4:40 PM
  • Thanks Nordic .. it worked!!!
    Friday, July 6, 2012 4:23 AM