Issue:

Microsoft added a new Event Log called State to Windows Server 2019, and for some reason this got backported in the Registry to Windows 10 1809 even though nothing uses this log and it does not show in Event Viewer. However, Exchange Agent when starting attempts to access the Registry entry for it and fails with this error.

Thunder 19+ Resolution:

As of Thunder 2019, the steps to remedy this are contained within the Restricted User Setup Tool. Follow the steps here to resolve: XOS Restricted User Setup Tool - Solve Surge, Sync, and Exchange Agent issues

Thunder 18 and Below Resolution:

To solve this, we need to take ownership of the State registry key and all subkeys, the steps to do so are as follows.

First, run the Restricted Users Setup Tool (this will add other permissions, but doesn't include the STATE log)

1. Start RegEdit as an administrator.
   • Some customers have their systems locked down so you need to go to the EXE and do this instead of using the Start Menu.
2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog
3. Right click on State and select Permissions.
4. Select Advanced.
5. Select to Change the owner, and set it as the Administrators group and select to Replace on all subcontainers.
   • If on a domain, you will need to change the Location to the local machine when entering Administrators.
6. Under Permissions Add the Everyone group with Full Control.
   • Again, if on a domain, you will need to change the Location to the local machine.
7. Apply the changes and Exchange Agent should now start.

We have made a request to have this added in to the Restricted User Setup Tool, so hopefully this will only be a stopgap process.