1

I am troubleshooting an installer problem where it's giving an error writing to a registry key. So when I use the Registry Editor (regedit) to create the same key under

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

I get the following error:

Cannot create key: Error writing to the registry

Looking at the permissions, administrators have full access and I am a member of that group. I can create entries in other areas in the registry.

When I try to take ownership, I see my name already listed. But then I get an error:

Unable to set new owner on Eventlog. Insufficient system resources exist to complete the requested service. 

I tried after a new reboot. I turned off my firewall (Comodo).

Why can't I create a new key when I am an admin and permissions indicate I have full control?

4 Answers 4

1

The computer seems to be screwy. This happened after a Windows update which failed. I did a whole backup and it works now.

1

Try running C:\Windows\System32\regedt32.exe using Run As credentials of the built-in administrator account. Note that some (few) registry keys mostly related to system can be modified only be the built-in administrator account.

Also if you are on your company network, it could be a group policy that may be preventing you from modifying the key.

Best bet is to run the installer with Run-As credentials of the built-in administrator. If you do not remember its password, just reset it and do as above.

3
  • I tried runas as administrator with same problem. It's a stand alone machine not connected to a domain. I tried the process on another machine and it worked. Jan 14, 2010 at 8:27
  • Is this dependnet on some local policy or service? Jan 14, 2010 at 8:31
  • are you sure that administrator is the builtin administrator? Check in Administrative Tools -> local security settings that "Administrative account status" is 'Enabled'. The name you see in 'Rename Administrator account' is the built in administrator.
    – Ganesh R.
    Jan 14, 2010 at 12:28
0

The EventLog is a virtualized part of the registry that cannot be written to by users. It's there so the system can log what's going on for diagnostic purposes when stuff goes wrong (e.g. during a crash).

You're not allowed to write stuff because that might that might confuse someone who has to fix problems later, and because there's no good reason to write stuff there manually.

0

The best is to run regedit with the Sysinternals PsExec to give you the rights to access and modify these keys:

Somethings like this in a shortcut:

"c:\Program Files\PsExec\psexec" -i -d -s c:\windows\regedit.exe

This command works for example with legacy registry keys ("normally" undeletables...)

Sysinternals: look for PsExec (or the complete commands suite)

http://technet.microsoft.com/en-ca/sysinternals/bb842062

BTW: you can use Windows System Control Center to download, update and install ALL Sysinternals utilities and NirSoft's utilities easily...

http://www.kls-soft.com/wscc/index.php

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .