I am using the Event Log Backup feature to backup (or backup and clear) the event logs to a central network location, but the event logs are not being backed up. Instead, an "Access Denied" error occurs.

Article ID: 21
Category: Usage
Updated: 2005-09-15

This is usually a permissions issue. When backing up the logs the EventSentry agent is running under the LocalSystem account by default, and you might have to take additional steps in order for the backup to work. If you are only backing up the event logs, then please click the help link below (DOC-ID 18) for more information.

If you are backing up AND clearing the log at the same time, then you you will have to take different steps to make the backup work, due to a known issue with all versions of Microsoft Windows (please click Microsoft KB 329974 below for more information). When backing up and clearing an event log, EventSentry (or Windows) will authenticate to the remote share using the credentials the "Event Log" service is running under, the "LocalSystem" account by default.

Since it is not recommend to change the account the "Event Log" service is running under, you will need to take additional steps and give each computer account permissions to access the location where the event logs are to be stored. Please click the "Accessing Remote Resource" link below and follow step 2.