This is usually a permissions issue since the EventSentry agent is running under the LocalSystem account by default.
Please click the help link below KB-ID 18 for more information.