“Access denied” errors on Windows nodes after adding a Group Policy to the Application event log in Puppet Enterprise

On Windows, after you add a Group Policy to restrict access to the Application event log, you run Puppet. You get Access denied errors on some Windows nodes, and the PXP agent does not start.

Error messages and logs

When you run Puppet, on some Windows nodes, you get errors similar to: RegisterEventSourceW failed to open Windows eventlog: Access is denied

By default, Puppet logs to the Application event log. If permissions on the Application event log are misconfigured, Puppet can’t write to the log, so you get errors.

Version and installation information

PE version: All supported
OS: Windows

Solution

To fix the issue, configure Puppet to log to a custom log location for the affected nodes by completing the following steps.

1. To enable logging in a custom location, create a registry key by opening a command prompt and running one of the following commands:

   The Command shell: reg add HKLM\System\CurrentControlSet\Services\EventLog\Application\Puppet /v EventMessageFile /t REG_EXPAND_SZ /d "%SystemRoot%\System32\EventCreate.exe"

   PowerShell and the New-EventLog cmdlet: if ([System.Diagnostics.Eventlog]::SourceExists("puppet")) { Remove-EventLog -Source 'puppet' } & New-EventLog -Source puppet -LogName Puppet

2. To complete configuration, reboot the affected nodes.