Hi, We have ACS installed in our environment and earlier i have enabled only few events to be collected. now i want to extend the no of events to be collected to do this i am using ADTADMIN command utility i am getting access issues. can some once help me to resolve this. ----- getting the below error Error 0x00000005 occured: Access is denied. my ACS collector service is running on network service. i am running the command on ACS collector server in a command prompt with admin access.

Hi Is the account you are logged in with an OpsMgr administrator account? Cheers GrahamView OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Hi Graham, Yes i logged in with a domain account having full administrator access. we have 3 server 1.) RMS 2.) MS - which is ACS collector. 3.) SQL server is DB for all scom DB's when i run the command in MS server which is ACS collector i am getting access denide. when i run the saem command from RMS i am getting the parameter incorrect( as given below) ------------------- Error 0x00000057 occured: The parameter is incorrect. ------------------ when i run the command on both the server(RMS and MS) i have given collector name in the command as my MS server only.

Hi, Regarding the error 0x00000005, please refer to: Audit Collection Server (AdtServer) fails to start when ACS installed from CD Media (Access Denied 0x00000005) http://blogs.technet.com/b/cliveeastwood/archive/2007/04/09/audit-collection-server-adtserver-fails-to-start-when-acs-installed-from-cd-media-access-denied-0x00000005.aspx The Operations Manager Audit Collection Service does not start and Event ID 4668 is logged after you install Audit Collection Server from a read-only source http://support.microsoft.com/kb/936579/en-us Hope this helps. Thanks. Nicholas Li - MSFT

What command are you runnning? Does this happen for every AdtAdmin command that you try? Can you try this on the ACS Collector while logged in with an account that has: - local windows administrator rights - OpsMgr administrator rights - start with a right click (Run As Administrator) to open the cmd prompt - then go to %systemroot%\system32\security\Adtserver directory - and then run adtadmin -getquery Access denied when you run this on the ACS Collector suggests a permissions issue. Parameter incorrect when you try it on the RMS suggests the command isn't correctly formatted. But if you could try the above and also let us know the actual command you are trying to run ... hopefully we can resolve this. Cheers GrahamView OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Hi Graham, I have checked running the same query with scom admin rights. still i am getting access error. I run the query (adtadmin -getquery) in "c:\%systemroot%\system32\security\Adtserver directory" and got the access error. When i run the command in CMD ( by opening as Run As Administrator) i am getting "parameter incorrect" - My ACS service is running on network service. - I have run the query on the ACS collector server. - Below is the command i am trying ---------------------------- adtadmin -setquery -collector:"ACSserver" -query:"SELECT * FROM AdtsEvent WHERE (EventId=681 OR EventId=630 OR EventId=634 OR EventId=643 OR EventId=643 OR EventId=644 OR EventId=517 OR EventId=520 OR EventId=529 OR EventId=530 OR EventId=531 OR EventId=532 OR EventId=534 OR EventId=535 OR EventId=537 OR EventId=533 OR EventId=536 OR EventId=632 OR EventId=633 OR EventId=636 OR EventId=637 OR EventId=624 OR EventId=4720 OR EventId=627 OR EventId=4724 OR EventId=628 OR EventId=4723 OR EventId=512 OR EventId=539 OR EventId=550 OR EventId=612 OR EventId=621 OR EventId=622 OR EventId=4777 OR EventId=4726 OR EventId=576 OR EventId=4672 OR EventId=4730 OR EventId=4739 OR EventId=4740 OR EventId=1102 OR EventId=560 OR EventId=4670 OR EventId=608 OR EventId=609 OR EventId=4704 OR EventId=4702 OR EventId=516 OR EventId=4612 OR EventId=567 OR EventId=4656 OR EventId=4663 OR EventId=528 OR EventId=540 OR EventId=4624 OR EventId=4616 OR EventId=4625 OR EventId=4646 OR EventId=6279 EventId=4719 OR EventId=4717 OR EventId=4718)" -----------------------------

Hi, I will "mark as answer" as no activity for a long time, feel free to re-open this thread. ThanksAnders Bengtsson | Microsoft PFE | blog at http://www.contoso.se