0x00001B5D: Remote Desktop event log registry fix

Cause 1: Permissions on the EventLog registry key are locked down

What's actually happening here is the Remote Desktop Session Host service (TermService) tries to create an event source entry under HKLM\SYSTEM\CurrentControlSet\Services\EventLog\TerminalServices when a user connects. If that key or its parent doesn't have the right permissions for the NETWORK SERVICE account — which the service runs as — you get 0x00001B5D. I've seen this most often after a third-party security tool or a group policy locked down registry permissions too aggressively.

The fix is straightforward: restore default permissions on the EventLog key.

Step-by-step fix

1. Open Regedit as Administrator.
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog.
3. Right-click EventLog, select Permissions.
4. Click Advanced. Make sure the owner is NT AUTHORITY\SYSTEM. If not, change it.
5. Verify these entries exist with Full Control over This key and subkeys:
   • SYSTEM — Full Control
   • Administrators — Full Control
   • NETWORK SERVICE — Read
6. Add NETWORK SERVICE if missing. Apply and exit.
7. Restart the Remote Desktop Services service (TermService).

The reason step 5 works is because NETWORK SERVICE only needs Read permission on EventLog itself — it creates subkeys under it (like TerminalServices) using inherited permissions. If that inheritance is broken, the write fails. You can test the fix by connecting via RDP again; the error should disappear.

Cause 2: The TerminalServices event log key is corrupted or missing

Sometimes the key HKLM\SYSTEM\CurrentControlSet\Services\EventLog\TerminalServices is present but has a bad subkey or value that prevents the service from writing to it. This happens after a failed update or a manual registry edit gone wrong. The error event in the System log (Event ID 6000 source TermService) often points to this.

Skip trying to repair individual values — the cleanest fix is to delete and recreate the key.

Steps

1. Open Regedit as Administrator.
2. Go to HKLM\SYSTEM\CurrentControlSet\Services\EventLog\TerminalServices.
3. Export that key as a backup (right-click → Export).
4. Delete the TerminalServices key.
5. Restart the Remote Desktop Services service. It will recreate the key with default values on the next connection attempt.
6. Try an RDP connection.

The reason deleting works is the service uses internal defaults to regenerate the key when it initializes. If the existing key has bad data — like a missing EventMessageFile value — the service can't write entries and fails. Letting it start fresh removes that.

Cause 3: Group Policy blocks event log writes

On domain-joined machines, a Group Policy might restrict which accounts can write to the EventLog registry. Look for the policy Restrict Remote Desktop Services event logging under Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections. If enabled and set to Disabled, it blocks the event source creation entirely.

The real fix is to set that policy to Not Configured or Enabled with the logging level set to at least Errors and Warnings. Then run gpupdate /force from an admin command prompt and restart the service.

Quick-reference summary