I am attempting to use the eventcreate command. It works successfully as long as I do not specify the /so parameter. When I do attempt to specify the /so parameter, I receive an "ERROR: Access is denied" error. I am an administrator on the system. The system is running Win 2003 R2 Std Edition with Service Pack 2. The version of eventcreate is 5.2.3790.3959.I have tried it on several different similar systems with similar results. However, on my desktop system that is running XP, it works just fine.I done a number of searches and they do not return anything of value.Any help would be appreciated.

hi ray ,thank you for posting in windows forum ./SO option is used for source, if you have your custom source you can use the command and if you are trying /SO with microsoft app's it wond work. please send us the command to analyzesainath !analyze

HiPlease Refer URl :http://technet.microsoft.com/en-us/library/bb490899.aspxDeva Try hard to get what u like (or) you will be forced to like what u get"

Thanks for replying. As I read the documentation, I understood the /so command to allow any string value. Below is a screen shot representing the error received. As you can see, the only difference between the two commands is the addition of the /so parameterWhat I find interesting is that the same command with the /so parameter specified works with XP Pro on the desktop.Microsoft Windows [Version 5.2.3790](C) Copyright 1985-2003 Microsoft Corp. H:\>eventcreate /t information /id 500 /l application /d "test" SUCCESS: An event of type 'information' was created in the 'application' log with 'EventCreate' as the source. H:\>eventcreate /t information /id 500 /l application /d "test" /so somethingERROR: Access is denied. H:\>

This is the syntax of the eventcreate command on windows server 2003Syntax:eventcreate /S \\servername /L Application /T Success /SO Application Name /ID 1754 /D Description of eventand also refer this articlehttp://blogs.techrepublic.com.com/datacenter/?p=243http://techrepublic.com.com/5208-11184-0.html?forumID=47&threadID=184939&messageID=1889868DevaTry hard to get what u like (or) you will be forced to like what u get"

any update on this case? Deva

Unfortunately no. I have been unable to create an event using the /so parameter on a group of servers. I have escalated the issue to our global infrastructure group for resolution.Thanks for the assistance. I think this thread can be closed.

Strangely, I can use the /SO Logon And nothing else.

I never did get any resolution on this. However, the root cause of this request has been superceded by an implementation of Service Broker. The original intent was to embed the eventcreate in batch files that use robocopy to move files around, and when an error would occur, the eventcreate would throw an error into the event log, where MOM would be watching, and an alert would be generated Got rid of the need by eliminating the robocopy by implementing service broker. Thanks for the interest.

I have exactly the same problem. But I want to write an event as a standard user via the network. So i gave permissions to write to a custom log on the server. Without the "/SO" Switch it's working fine, but if I'm using it I get the Access Denied message. But I really need to define a source. Cause I want to have an Event made by an C# Application and it's not allowing to create an event without a source. Does anyone have a solution for this?

Even logged in as an administrator, eventcreate.exe works from comand line only if I start cmd.exe by right click then select Run As Administrator. But, I want to run it from a batch file. So how to I "Run As Administrator" from within a batch file? RunAs wants a password for the Administrator account, which I don't have and the domain admins will not provide.

I solved this problem by running the eventcreate command from powershell while running powershell as administartor. Beth S