OpenEventLog returns RPC_S_SERVER_UNAVAILABLE on Windows 24H2

Ljungberg, Ted 10 Reputation points
2024-11-13T12:07:58.58+00:00

We have a tool that parse data from the eventlog. However this has stopped working to access remote servers when run Windows 24H2 machines, with either of the following errors:

RPC_S_SERVER_UNAVAILABLE
RPC_X_BAD_STUB_DATA

The following application works perfectly fine when run on Windows 22H2:

#include <windows.h>

#include <tchar.h>

#include <string>

#include <iostream>

using namespace std;

int __cdecl main(int argc, char* argv[])

{

string serverName = argv[1];

string eventLogName = argv[2];

cout << serverName << endl << eventLogName << endl;

HANDLE hEventLog = OpenEventLog(serverName.c_str(), eventLogName.c_str());

if (!hEventLog)

{

DWORD lastError = GetLastError();

cout << "Cannot open event log on machine " << serverName << ", error: " << to_string(lastError) << endl;

cout << "Trying to use widechar method..." << endl;

wstring wServerName(serverName.begin(), serverName.end());

wstring wEventLogName(eventLogName.begin(), eventLogName.end());

HANDLE hEventLog = ::OpenEventLogW(wServerName.c_str(), wEventLogName.c_str());

if (!hEventLog)

{

DWORD lastError = GetLastError();

cout << "(Widechar attempt) Cannot open event log on machine " << serverName << ", error: " << to_string(lastError) << endl;

return lastError;

}

}

cout << "Successfully opened eventlog on machine " << serverName << endl;

CloseHandle(hEventLog);

return NO_ERROR;

}

The result is on 22H2:

application.exe myserver application

myserver

application

Successfully opened eventlog on machine myserver

However same application run on 24H2:

application.exe myserver application

myserver

application

Cannot open event log on machine myserver, error: 1722

Trying to use widechar method...

(Widechar attempt) Cannot open event log on machine myserver, error: 1783

This is a bug in Windows 24H2. Can you please confirm this bug and give an estimate when it will be fixed, and/or a workaround?

Windows development | Windows API - Win32
Windows for business | Windows Client for IT Pros | User experience | Other
Developer technologies | C++
{count} vote

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.