Event logs fails to start on Exchange Server 2010

Question

My Exchange server 2010 R2 SP1 Enterprise single server is down.  All exchange services fail to start.  It appears like the Microsoft Exchange Active Directory Topology service isn't starting which is a dependency for all other services.
The error I get when trying to start this service is:
Windows could not start the Microsoft Exchange Active Directory Topology on Local Computer.  For more information, review the System Event Log.  If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code
-2147024882
To make matters worse, the event viewer is not starting either.
When trying to start the Windows Event Log, I get the error:
Windows could not start the Windows Event Log service on Local Computer. Displays Error code 5
This is running on a Windows Server 2008 R2 SP1 Standard box.
Any assistance is appreciated.

Answer 1

When trying to start the Windows Event Log, I get the error:
Windows could not start the Windows Event Log service on Local Computer. Displays Error code 5
Hi,
Based on this error, this problem happens if any of the following conditions are true:
The built-in security group EventLog does not have permissions on the folder %SystemRoot%\System32\winevt\Logs
The Local Service account does not have default permissions on the following registry key: HKLM\Software\Microsoft\Windows\CurrentVersion\Reliability
To solve this problem, we need to restore the default permissions in the list below on %SystemRoot%\System32\winevt\logs.
Authenticated user - List folder/read data, Read attributes, Read Extended attributes, Read permissions
Administrators - Full control
SYSTEM - Full control
EventLog - Full control
Please try the following methods:
Method 1
To restore the default permissions on folder %SystemRoot%\System32\winevt\logs, follow these steps.
Right-click on %SystemRoot%\System32\winevt\logs and select Properties.
Select the Security tab.
Click Edit button and click the Add button in the permissions dialog box.
In Select users, computers, or Groups dialog box ensure that under object types Built in Security Principals and the location as local computer name is selected.
Enter the object name as "NT SERVICE\EventLog" without quotes. And click OK. This group should have full control on the folder.
Once EventLog group is added add the rest of the groups with above mentioned permissions.
Method 2
Identify a Windows Server 2008 machine with default permissions.
Click Start, and then type cmd in the Start Search box.
In the search results list, right-click Command Prompt, and then click Run as Administrator.
When you are prompted by User Account Control, click Continue.
Type the command CD %SystemRoot%\SYSTEM32.
Once the working directory is changed to %SystemRoot%\SYSTEM32 type the command icacls winevt\* /save acl /T.
This will save a file named ACL in %SystemRoot%\SYSTEM32. Copy this file to the C: drive on the problem computer.
On the problem computer, open command prompt with administrator privileges (refer to previous steps 1-3).
Change the working directory to %SystemRoot%\SYSTEM32.
Execute the command icacls winevt\ /restore acl.
Default permissions on the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Reliability should be:
CREATOR OWNER - Full control
SYSTEM - Full control
LOCAL SERVICE - Query Value, Set Value, Create Subkey, Notify and Delete
Administrators - Full control
Users - Read
To set the permission on this registry key:
Click the Start menu, select Run and type Regedit.
Go to the location HKLM\Software\Microsoft\Windows\CurrentVersion\Reliability.
From the Edit menu click Permissions.
Add the permissions for the accounts as listed above.
In addition, Exchange 2010 SP1 and SP2 are end of support.
https://support.microsoft.com/en-us/lifecycle/search/default.aspx?alpha=exchange%20server%202010&Filter=FilterNO
Best Regards.
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Lynn-Li
TechNet Community Support