Vista Remote Event Log viewer

Hi,
How can I view event logs on a remote machine running Vista? I can view
remote events on machines running XP and 2003 but not Vista..... The Vista
machine all have their remote registry service running already. But when I
connect to a remote machine via event viewer, it always complain that rpc
server is not available......

Please help.

Marshall

Try disabling the Firewall on Vista and see if this works. If it works ,
re-enable the firewall and work from there.

Alternatively, you can setup Event Forwarding on Vista.

--
Jabez Gan
Microsoft MVP: Windows Server - File Storage
"mlai" <mlai@community.nospam> wrote in message
news:796FBBA1-C9E7-48E4-9B75-F8C661593AD7@microsoft.com...

> Hi,
> How can I view event logs on a remote machine running Vista? I can
> view remote events on machines running XP and 2003 but not Vista..... The
> Vista machine all have their remote registry service running already. But
> when I connect to a remote machine via event viewer, it always complain
> that rpc server is not available......
>
> Please help.
>
> Marshall

Something strange is going on. On my domain server (Server 2003), I can
access the event logs on Vista PCs. But when I am at my station running
Vista, I cannot access the logs on other Vista PCs.... Doesn't sound quite
like a firewall issue as it should have blocked the 2003 server as well....
"Jabez Gan [MVP]" <mingteikg@blizNOSPAMhosting.com> wrote in message
news867D26A-CF73-4E21-876E-A1CEFBFDE198@microsoft.com...

> Try disabling the Firewall on Vista and see if this works. If it works ,
> re-enable the firewall and work from there.
>
> Alternatively, you can setup Event Forwarding on Vista.
>
> --
> Jabez Gan
> Microsoft MVP: Windows Server - File Storage
> "mlai" <mlai@community.nospam> wrote in message
> news:796FBBA1-C9E7-48E4-9B75-F8C661593AD7@microsoft.com...

>

You need to make a registry change.

http://www.jimmah.com/vista/Administ...ltertoken.aspx



--
Kerry Brown
Microsoft MVP - Shell/User
http://www.vistahelp.ca


"mlai" <mlai@community.nospam> wrote in message
news:796FBBA1-C9E7-48E4-9B75-F8C661593AD7@microsoft.com...

> Hi,
> How can I view event logs on a remote machine running Vista? I can
> view remote events on machines running XP and 2003 but not Vista..... The
> Vista machine all have their remote registry service running already. But
> when I connect to a remote machine via event viewer, it always complain
> that rpc server is not available......
>
> Please help.
>
> Marshall

Dear Marshall,

This issue can be reproduced on my side and when connecting to a Windows
Vista computer from another Windows Vista system, the following error
appears:
Event Viewer cannot connect to computer computer_name and the reported
error: "The RPC server is unavailable".

It is related to the default settings on the Windows Firewall and we can
take the following steps to eliminate this error:

1. Click Start and enter firewall.cpl in the Start Search. Press Enter.
2. In the left tasks pane, click Allow a program through Windows Firewall.
3. Under the Exceptions tab, ensure "Remote Administration" and "Remote
Event Log Management" are checked.
4. Click Apply and OK.

If you have any concerns on the above, please feel free to post back and I
am happy to answer any of your questions.

Regards,

Helen Li, MCSE 2003

Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
================================================== ==
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ==
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| From: "mlai" <mlai@community.nospam>
| Subject: Vista Remote Event Log viewer
| Date: Mon, 5 Nov 2007 09:11:47 +0800
| Lines: 1
| Message-ID: <796FBBA1-C9E7-48E4-9B75-F8C661593AD7@microsoft.com>
| MIME-Version: 1.0
| Content-Type: text/plain;
| format=flowed;
| charset="iso-8859-1";
| reply-type=original
| Content-Transfer-Encoding: 7bit
| X-Priority: 3
| X-MSMail-Priority: Normal
| Importance: Normal
| X-Newsreader: Microsoft Windows Live Mail 12.0.1365
| X-MimeOLE: Produced By Microsoft MimeOLE V12.0.1365
| X-MS-CommunityGroup-MessageCategory:
{E4FCE0A9-75B4-4168-BFF9-16C22D8747EC}
| X-MS-CommunityGroup-PostID: {796FBBA1-C9E7-48E4-9B75-F8C661593AD7}
| Newsgroups:
microsoft.public.windows.server.general,microsoft. public.windows.vista.netwo
rking_sharing,microsoft.public.windows.vista.perfo rmance_maintenance
| Path: TK2MSFTNGHUB02.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl
microsoft.public.windows.vista.networking_sharing: 16774
microsoft.public.windows.vista.performance_mainten ance:14786
microsoft.public.windows.server.general:26000
| NNTP-Posting-Host: TK2MSFTNGHUB02.phx.gbl 127.0.0.1
| X-Tomcat-NG: microsoft.public.windows.vista.networking_sharing
|
| Hi,
| How can I view event logs on a remote machine running Vista? I can
view
| remote events on machines running XP and 2003 but not Vista..... The
Vista
| machine all have their remote registry service running already. But when
I
| connect to a remote machine via event viewer, it always complain that rpc
| server is not available......
|
| Please help.
|
| Marshall
|
|

Thanks for the link. Followed the link, added the DWORD to the registry and
rebooted. Fired up Event view and tried to connect to a remote machine.
Same error of RPC Server unavailable.....



"Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
newsDA47E46-E3B3-4FBC-9A4E-C56B5EEABC17@microsoft.com...

> You need to make a registry change.
>
> http://www.jimmah.com/vista/Administ...ltertoken.aspx
>
>
>
> --
> Kerry Brown
> Microsoft MVP - Shell/User
> http://www.vistahelp.ca
>
>
> "mlai" <mlai@community.nospam> wrote in message
> news:796FBBA1-C9E7-48E4-9B75-F8C661593AD7@microsoft.com...

>

The change has to be done on the remote machine if the remote machine is
running Vista.

--
Kerry Brown
Microsoft MVP - Shell/User
http://www.vistahelp.ca


"mlai" <mlai@community.nospam> wrote in message
news28BED3C-8B46-4A55-98DF-E0F486006B97@microsoft.com...

> Thanks for the link. Followed the link, added the DWORD to the registry
> and rebooted. Fired up Event view and tried to connect to a remote
> machine. Same error of RPC Server unavailable.....
>
>
>
> "Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
> newsDA47E46-E3B3-4FBC-9A4E-C56B5EEABC17@microsoft.com...

I have done it on all my domain machines..... And still didn't work.

"Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
news:66A87FDD-9948-4D07-B261-2A2F7B4FEE6F@microsoft.com...

> The change has to be done on the remote machine if the remote machine is
> running Vista.
>
> --
> Kerry Brown
> Microsoft MVP - Shell/User
> http://www.vistahelp.ca
>
>
> "mlai" <mlai@community.nospam> wrote in message
> news28BED3C-8B46-4A55-98DF-E0F486006B97@microsoft.com...

>

You may also need to add TCP port 135 to the firewall. This link may help.

Remote Management Issues
http://www.chicagotech.net/Windows/remotemgr.htm

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com


""Helen Li [MSFT]"" <v-helenl@online.microsoft.com> wrote in message
news:NyP1vF4HIHA.5204@TK2MSFTNGHUB02.phx.gbl...

> Dear Marshall,
>
> This issue can be reproduced on my side and when connecting to a Windows
> Vista computer from another Windows Vista system, the following error
> appears:
> Event Viewer cannot connect to computer computer_name and the reported
> error: "The RPC server is unavailable".
>
> It is related to the default settings on the Windows Firewall and we can
> take the following steps to eliminate this error:
>
> 1. Click Start and enter firewall.cpl in the Start Search. Press Enter.
> 2. In the left tasks pane, click Allow a program through Windows Firewall.
> 3. Under the Exceptions tab, ensure "Remote Administration" and "Remote
> Event Log Management" are checked.
> 4. Click Apply and OK.
>
> If you have any concerns on the above, please feel free to post back and I
> am happy to answer any of your questions.
>
> Regards,
>
> Helen Li, MCSE 2003
>
> Microsoft Online Partner Support
> Get Secure! - www.microsoft.com/security
> ================================================== ==
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ================================================== ==
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> --------------------
> | From: "mlai" <mlai@community.nospam>
> | Subject: Vista Remote Event Log viewer
> | Date: Mon, 5 Nov 2007 09:11:47 +0800
> | Lines: 1
> | Message-ID: <796FBBA1-C9E7-48E4-9B75-F8C661593AD7@microsoft.com>
> | MIME-Version: 1.0
> | Content-Type: text/plain;
> | format=flowed;
> | charset="iso-8859-1";
> | reply-type=original
> | Content-Transfer-Encoding: 7bit
> | X-Priority: 3
> | X-MSMail-Priority: Normal
> | Importance: Normal
> | X-Newsreader: Microsoft Windows Live Mail 12.0.1365
> | X-MimeOLE: Produced By Microsoft MimeOLE V12.0.1365
> | X-MS-CommunityGroup-MessageCategory:
> {E4FCE0A9-75B4-4168-BFF9-16C22D8747EC}
> | X-MS-CommunityGroup-PostID: {796FBBA1-C9E7-48E4-9B75-F8C661593AD7}
> | Newsgroups:
> microsoft.public.windows.server.general,microsoft. public.windows.vista.netwo
> rking_sharing,microsoft.public.windows.vista.perfo rmance_maintenance
> | Path: TK2MSFTNGHUB02.phx.gbl
> | Xref: TK2MSFTNGHUB02.phx.gbl
> microsoft.public.windows.vista.networking_sharing: 16774
> microsoft.public.windows.vista.performance_mainten ance:14786
> microsoft.public.windows.server.general:26000
> | NNTP-Posting-Host: TK2MSFTNGHUB02.phx.gbl 127.0.0.1
> | X-Tomcat-NG: microsoft.public.windows.vista.networking_sharing
> |
> | Hi,
> | How can I view event logs on a remote machine running Vista? I can
> view
> | remote events on machines running XP and 2003 but not Vista..... The
> Vista
> | machine all have their remote registry service running already. But
> when
> I
> | connect to a remote machine via event viewer, it always complain that
> rpc
> | server is not available......
> |
> | Please help.
> |
> | Marshall
> |
> |
>

Thanks. Anyway to do this via a group policy object?
""Helen Li [MSFT]"" <v-helenl@online.microsoft.com> wrote in message
news:NyP1vF4HIHA.5204@TK2MSFTNGHUB02.phx.gbl...

> Dear Marshall,
>
> This issue can be reproduced on my side and when connecting to a Windows
> Vista computer from another Windows Vista system, the following error
> appears:
> Event Viewer cannot connect to computer computer_name and the reported
> error: "The RPC server is unavailable".
>
> It is related to the default settings on the Windows Firewall and we can
> take the following steps to eliminate this error:
>
> 1. Click Start and enter firewall.cpl in the Start Search. Press Enter.
> 2. In the left tasks pane, click Allow a program through Windows Firewall.
> 3. Under the Exceptions tab, ensure "Remote Administration" and "Remote
> Event Log Management" are checked.
> 4. Click Apply and OK.
>
> If you have any concerns on the above, please feel free to post back and I
> am happy to answer any of your questions.
>
> Regards,
>
> Helen Li, MCSE 2003
>
> Microsoft Online Partner Support
> Get Secure! - www.microsoft.com/security
> ================================================== ==
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ================================================== ==
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> --------------------
> | From: "mlai" <mlai@community.nospam>
> | Subject: Vista Remote Event Log viewer
> | Date: Mon, 5 Nov 2007 09:11:47 +0800
> | Lines: 1
> | Message-ID: <796FBBA1-C9E7-48E4-9B75-F8C661593AD7@microsoft.com>
> | MIME-Version: 1.0
> | Content-Type: text/plain;
> | format=flowed;
> | charset="iso-8859-1";
> | reply-type=original
> | Content-Transfer-Encoding: 7bit
> | X-Priority: 3
> | X-MSMail-Priority: Normal
> | Importance: Normal
> | X-Newsreader: Microsoft Windows Live Mail 12.0.1365
> | X-MimeOLE: Produced By Microsoft MimeOLE V12.0.1365
> | X-MS-CommunityGroup-MessageCategory:
> {E4FCE0A9-75B4-4168-BFF9-16C22D8747EC}
> | X-MS-CommunityGroup-PostID: {796FBBA1-C9E7-48E4-9B75-F8C661593AD7}
> | Newsgroups:
> microsoft.public.windows.server.general,microsoft. public.windows.vista.netwo
> rking_sharing,microsoft.public.windows.vista.perfo rmance_maintenance
> | Path: TK2MSFTNGHUB02.phx.gbl
> | Xref: TK2MSFTNGHUB02.phx.gbl
> microsoft.public.windows.vista.networking_sharing: 16774
> microsoft.public.windows.vista.performance_mainten ance:14786
> microsoft.public.windows.server.general:26000
> | NNTP-Posting-Host: TK2MSFTNGHUB02.phx.gbl 127.0.0.1
> | X-Tomcat-NG: microsoft.public.windows.vista.networking_sharing
> |
> | Hi,
> | How can I view event logs on a remote machine running Vista? I can
> view
> | remote events on machines running XP and 2003 but not Vista..... The
> Vista
> | machine all have their remote registry service running already. But
> when
> I
> | connect to a remote machine via event viewer, it always complain that
> rpc
> | server is not available......
> |
> | Please help.
> |
> | Marshall
> |
> |
>