OpenEventLog rc = 1783 on Windows Server 2019

Kuri55 21

Hello.

I am creating a program that reads the Windows Event log, but when I run it on Windows Server 2019, there are always cases where it fails with OpenEventLog rc = 1783. (This occurs when acquiring the event log of another Windows machine from Windows Server 2019.)
There was no problem using the same program on Windows Server 2012 or Windows Server 2016.

Has anyone experienced the same event?
Thank you.

Drake Wu - MSFT 991 Reputation points

2020-10-16T08:39:08.547+00:00

Hi @Kuri55 Did you try to explicitly use the UNICODE version OpenEventLogW?

If the answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Kuri55 21 Reputation points

2020-10-16T15:29:47.663+00:00

Hi, Thank you for your reply.

I haven't verified it with the UNICODE version yet.
Will the UNICODE version solve the problem? (It will take time to UNICODE everything.)
If UNICODE is the solution, we will consider how to deal with it.
Drake Wu - MSFT 991 Reputation points

2020-10-19T07:01:59.553+00:00

1783 is the error RPC_X_BAD_STUB_DATA which means: The stub received bad data. And there is also a thread that got the error "The stub received bad data." when using OpenEventLogA. Could you please check the Unicode version with a small sample like OpenEventLogW(L"UNC name of the remote server",L"The name of the log");?
Drake Wu - MSFT 991 Reputation points

2020-10-19T07:34:47.047+00:00

In addition, will you get the same error if using OpenEventLog(NULL,"xxx") to open the local computer event?
Kuri55 21 Reputation points

2020-10-19T08:14:16.287+00:00

Thank you, for your reply.
I'm sorry. There was a lack of my information. Using OpenEventLog(NULL,"xxx") locally(on Windows Server 2019) does not cause an error. I can get the log normally. Only remote access will fail.
Kuri55 21 Reputation points

2020-10-22T10:22:27.813+00:00

Hi @Drake Wu - MSFT
Your point was accurate. After changing the command to OpenEventLogW, RC=1783 disappeared. But instead it became RC=1722. I know this return code is an RPC-related error, but it doesn't resolve it. Given that I don't get any errors when using the new API (Windows Eventing 6.0 support), it seems that Win2019 has already lost compatibility with the Legacy API. Thank you.
Drake Wu - MSFT 991 Reputation points

2020-10-26T03:32:57.14+00:00

Hi @Kuri55 1722 means RPC_S_SERVER_UNAVAILABLE According Accessing Remote Computers "To access data on the remote computer, the remote computer must enable the "Remote Event Log Management" Windows Firewall exception; otherwise, when you try to use the session handle, the call will error with RPC_S_SERVER_UNAVAILABLE."
Make sure you have enable the exception.
Kuri55 21 Reputation points

2020-10-29T09:22:46.697+00:00

Hi @Drake Wu - MSFT
Thank you for your support.
Windows Firewall has disabled both remote computer(Win2016) and Win2019.
On this environment, Event Log viewer and new API(Windows Eventing 6,0 support) are no problem. (These can normally refer to the event log on the remote computer.)
Only OpenEventLogW will get the rc=1722 error.
Is there anything else I should check?

Drake Wu - MSFT 991

You could try to establish a connection to the $IPC resource with WNetAddConnection2 before OpenEventLogW , like:

	NETRESOURCE NetRes;  
	DWORD dwStatus;  
	TCHAR szRemoteName[RMLEN + 1];  
  
	_sntprintf(szRemoteName, RMLEN + 1, _T("%s\\IPC$"), pszMachine);  
  
	NetRes.dwType = RESOURCETYPE_ANY;  
	NetRes.lpLocalName = NULL;  
	NetRes.lpRemoteName = szRemoteName;  
	NetRes.lpProvider = NULL;  
  
	dwStatus = WNetAddConnection2(&NetRes, pszPassword,pszUserName, 0);

Kuri55 21 Reputation points

2020-11-03T13:02:03.517+00:00

Hi @Drake Wu - MSFT
As you suggested, I modified and validated part of WNetAddConnection2.
(Added "\IPC$" at the end of lpRemoteName)
WNetAddConnection2 was successfully, but still rc=1722 occured on OpenEventLogW.

Share via

OpenEventLog rc = 1783 on Windows Server 2019

Your answer