Many companies prioritize the hardening of their servers to ensure they are protected from known vulnerabilities. However, it is crucial to thoroughly test all applications on a test server before implementing any hardening measures. In this article, we will discuss how to fix the issue of the Eventlog Service not starting in SQL Server.
Recently, one of my clients reached out to me with a problem. They informed me that they were unable to start the SQL Server Agent Service after running a hardening script. Without wasting any time, I joined a session with them and began investigating the issue by looking at the logs.
Initially, I asked them to start the SQL Server Agent from the configuration manager. However, it failed with an unhelpful error message: “The request failed or the service did not respond in a timely fashion. Consult the event log or other applicable error logs for details.” Upon checking the LOG folder, I noticed that there was no SQLAgent.out generated.
My next step was to check the event viewer, where I found the following message:
The EventLog service has not been started 2017-08-03 09:24:45 – ? [098] SQLServerAgent terminated (normally)
At first, I was unsure if this message was related to the SQL Server Agent startup issue. To investigate further, I ran the SQLAgent executable in console mode using the following command:
SQLAGENT.EXE” -i SQL2016 -c -v
Unfortunately, this command failed with an error: “The EventLog service has not been started.” It became clear that the EventLog service was not running. When I attempted to start it, I encountered an “access denied” error:
Windows could not start the Windows Event Log service on Local Computer. Error 5: Access is denied.
To troubleshoot this issue, I used the Process Monitor tool and discovered that we were receiving an “Access Denied” error on the C:\Windows\System32\winevt\Logs\System.evtx file, which is the System Event Log. Upon further investigation, we found that the “Read-only” option was checked for this file, unlike other machines.
Once we unchecked the “Read-only” option, we were able to start the SQL Server Agent service successfully.
Have you ever encountered similar issues due to hardening? Please share your experiences in the comments section below.