We have the latest System Center Core MPs (6.1.7695.0) imported into our environment. Yesterday, a scenario occurred that set off the "Failed Accessing Windows Event Log Monitor" on most of the servers in our environment. While researching, I found that the MP Guide, as well as http://technet.microsoft.com/en-us/library/dd350060.aspx state the following: Problem: The Failed Accessing Windows Event Log monitor is in a warning state even though it has access to the event log. This monitor is disabled by default. If you enable the monitor and it does not have access to the event log, it changes to a warning state (yellow). After you fix the issue by giving the monitor access to the event log, the monitor remains in a warning state even though it should change to a healthy state (green). Solution: None. It is recommended that you do not enable the monitor. If you have enabled it, you can disable it. My question is with the statements I've put in bold. Reviewing the monitor in our console, this does not seem to be the case. It is enabled by default. We have no overrides. Should this monitor be disabled? What do others see - is the monitor enabled or disabled on your system... and if yours is disabled, was this by default or an override? Kate

Hi Kate! We have not made any modifications and the Monitor is enabled by default. If, like you said, it's Unhealthy on most of your servers, I would disable it and try to figure out what's happening. (In the monitors properties you can see whitch events it's looking for). /RogerThis posting is provided "AS IS" with no warranties, and confers no rights.