AFW-311 — User-ID: access denied reading the Security log

Area: Identity & connectors · All support codes · Reference table

Why this happened

The service account authenticated but may not read the Security event log over WinRM. Event Log Readers membership alone is NOT sufficient for remote WinRM reads.

Fix

On the DC: add the account to Event Log Readers AND grant it remote WinRM access with winrm configSDDL default (add the account with Read + Execute). Both are required — without the RootSDDL grant the poll still gets access denied.

---

If the fix doesn't resolve it, file a support ticket from the console — your workspace's diagnostics snapshot is attached automatically, so this code reaches support with its context.