iSCSI Initiator Service fails to start with an error message ERROR 5: "Access is denied"

Question

iSCSI Initiator Service fails to start with an error message ERROR 5: "Access is denied"

Rob Mulder 231

It starts on Server 2019.

Server 2022 (and Windows 11):
Sometimes it starts (after a few reboots) but after the next reboot the service gives an error again.

We tried on multiple servers, bare windows installation, fully patched installation, in domain, in workgroup. Tried with and without GPO's.

We used ProcMon but nothing is recorded on the moment the error occurs.

Any help will appreciated.


Event log 'SYSTEM'
event ID: 7023
The Microsoft iSCSI Initiator Service service terminated with the following error: 
Access is denied.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" /> 
  <EventID Qualifiers="49152">7023</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8080000000000000</Keywords> 
  <TimeCreated SystemTime="2023-01-13T15:27:48.7004154Z" /> 
  <EventRecordID>108297</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="748" ThreadID="7548" /> 
  <Channel>System</Channel> 
  <Computer>SCVMM1.DOMAIN.INT</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="param1">Microsoft iSCSI Initiator Service</Data> 
  <Data Name="param2">%%5</Data> 
  <Binary>4D005300690053004300530049000000</Binary> 
  </EventData>
  </Event>

1 answer

Your answer

Answer 1

Rob Mulder 231

SOLVED

It was due to wrong rights on the System Eventlog.

Someone changed those rights when enabling Event Forwarding. That wasn't done correctly.
Changed the rights back to default. The Microsoft iSCSI Initiator Service service starts without problem.

Dursun Ertekin 0 Reputation points

2023-08-16T10:01:59.4566667+00:00

I apologize but could you please let me know how you have changed the right for System Eventlog?
Perez, Francisco 0 Reputation points

2023-08-30T15:00:27.1233333+00:00

We are having the same issue with the iSCSI. After configuring for the first time, and you reboot the server, the service does not want to start with the same error code access denied. Verify the Event Forwarding is not set or default. So that not my issue.
Ripstart 0 Reputation points

2023-09-14T04:34:25.9066667+00:00

BTW spent ages trying to figure this out.

If you run svchost.exe -k netsvcs -p does it get block by an AV? Ours was being blocked by an app called Crowdstrike. I uninstalled that.

If you run gpresult /r /v /scope computer we also had an Event Forwarding GPO applying to this server with log access configured. I moved the server to an OU without this and rebooted then the service was able to start.

I am yet to verify whether it was Crowdstrike or the GPO (or both), but that will be easy enough to figure out by re-installing/re-applying GPO one at a time (reboot required after each).
Ripstart 0 Reputation points

2023-09-22T01:35:15.44+00:00

In my case it was definitely from the GPO with an event forwarding and event log access policy. I haven't figured out yet how to generate an SDDL for it to enter into the GPO.
Aakash Naik 0 Reputation points Microsoft Employee

2023-09-28T19:51:51.4433333+00:00

Did we figure what was the command that helped with access denied?

Share via

iSCSI Initiator Service fails to start with an error message ERROR 5: "Access is denied"

1 answer

Your answer