Windows 7 Access Denied (Error 5) when trying to start Windows Event Log service

[djthrive]

Thanks in advance for your assistance. I have a weekly requirement to view and clear the Windows Security Logs on my hardened Windows 7 computer. This has been working fine up until last week. When I open up my saved EventViewer.mmc console, I receive the following error: "Event Log Service is unavailable, verify that the service is running." When I go to services.exe (Run as Administrator) and try to start the Windows Event Log service, I receive the following error: "Windows could not start the Windows Event Log service on Local Computer. Error 5: Access is denied."

Some of the steps already taken to correct this

-Used System Restore to restore to a previous time

-Added "NT SERVICE\EventLog" to the access list for C:\Windows\System32\winevt\logs and applied "Full Control" permissions

-Checked box for "Include inheritable permissions from this object's parent" on the Security properties for C:\Windows\System32\LogFiles\WMI

-Was unable to perform this potential fix due to an "Access Denied" error: Started in Safe Mode, started Cmd" as Administrator and typed "net stop winmgnt" then navigated to C:\Windows\System32\wbem, then tried to rename the Repository folder, but this is when I received my error.

 

[Neemobeer]

This may be difficult to determine, can you elaborate what you've done on your "hardened Windows 7 computer". Also open a command prompt and type sc sdshow eventlog and post the output.

 

[djthrive]

Hi there, thanks for your time. I found an article that mentioned to rename the file extensions for "application.evtx, system.evtx, and security.evtx (all located under C:\Windows\System32\winevt\Logs), then restart the Windows Event Log service. I attempted this while booted into Safe Mode and ran Windows Explorer as Administrator. I rebooted into normal mode and the Windows Event Log service started automatically and I was able to get back into the Event Viewer.

 

[Neemobeer]

So perhaps one or more of the logs were corrupted.