AB#7780: SQL Server Agent Service not Starting on Win 2022 & 2025 - Error: 17156 Could not initiate the EventLog Service

[7780](https://dev.azure.com/KMOps/ContentExperience/_workitems/edit/7780)

# Pull request guidance

Thank you for submitting your contribution to our support content! Our team works closely with subject matter experts in CSS and PMs in the product group to review all content requests to ensure technical accuracy and the best customer experience. This process can sometimes take one or more days, so we greatly appreciate your patience.

We also need your help in order to process your request as soon as possible:

- We won't act on your pull request (PR) until you type "**#sign-off**" in a new comment in your pull request (PR) to indicate that your changes are complete.

- After you sign off in your PR, the article will be tech reviewed by the PM or SME if it has more than minor changes. Once the article is approved, it will undergo a final editing pass before being merged.

Author: haywoodsloan

support/sql/database-engine/startup-shutdown/error-17156-eventlog-service.md

@@ -0,0 +1,53 @@
+---
+title: SQL Server Agent Startup Fails with Error 17156 Could Not Initiate the EventLog Service
+description: Learn how to troubleshoot error 17156 "Could not initiate the EventLog Service" when starting SQL Server Agent.
+ms.reviewer: v-shaywood
+ms.date: 10/10/2025
+ms.custom: sap:Startup, shutdown, restart issues (instance or database)\Cannot start SQL Server
+---
+
+# Error 17156 "Could not initiate the EventLog Service" when starting SQL Server Agent
+
+This article provides troubleshooting guidance for error 17156 "Could not initiate the EventLog Service" that can occur when starting the SQL Server Agent. This error can appear after installing or upgrading to Windows Server 2022 or 2025, and will prevent the SQL Server Agent from starting.
+
+## Symptoms
+
+After you install or upgrade SQL Server on Windows Server 2022 or 2025, the SQL Server Agent fails to start. When the startup process fails, it appends an entry to the SQL error log that's similar to the following example:
+
+```log
+2025-10-02 08:24:32.26 Server      Error: 17156, Severity: 16, State: 1.
+2025-10-02 08:24:32.26 Server      initeventlog: Could not initiate the EventLog Service for the key 'MSSQL$SQL2022',  or last error code is 5.
+2025-10-02 08:24:32.26 Server      Microsoft SQL Server 2022 (RTM-CU21) (KB5065865) - 16.0.4215.2 (X64)
+Aug 11 2025 13:24:21
+Copyright (C) 2022 Microsoft Corporation
+Developer Edition (64-bit) on Windows Server 2025 Datacenter 10.0 <X64> (Build 26100: ) (Hypervisor)
+```
+
+## Cause
+
+This error can occur when the SQL Server Agent doesn't have access to write to the Application event log. During startup, the SQL Server Agent attempts to register its own event source to the Application event log, but without write access, registering the event source fails. When SQL Server Agent fails to register the event source, the startup process terminates.
+
+An incorrect configuration in the **Configure log access** group policy can prevent the SQL Server Agent from writing to the Application event log. If the **Configure log access** policy doesn't grant write access to the account the SQL Server Agent runs under, the agent fails to start.
+
+This error can appear after installing or upgrading to Windows Server 2022 or 2025, because of a change to how the **Configure log access** policy is enforced. In Windows Server 2019 and previous versions, the **Configure log access** policy wasn't correctly enforced. The SQL Server Agent would be able to write to the Application event log even without being granted access via the group policy. In Windows Server 2022 and later versions, the **Configure log access** policy is correctly enforced. The SQL Server Agent can't write to the Application event log unless properly configured in the group policy.
+
+## Solution
+
+This error can be resolved by either disabling the **Configure log access** group policy or updating it to grant write access to the account the SQL Server Agent runs under.
+
+First, find the **Configure log access** policy settings:
+
+1. Open the Local Group Policy Editor.
+1. Select **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Event Log Service** > **Application**.
+1. Open the **Configure log access** setting.
+
+To disable the policy, set its value to either **Disabled** or **Not Configured**.
+
+To update the policy, set its value to **Enabled**. Then, append the following to the Security Descriptor Definition Language (SDDL) string in the **Options** panel:
+
+> (A;;0x7;;;\<SQL-Server-Agent-Account-SID\>)
+
+## References
+
+- [How to set event log security locally or by using Group Policy](~/windows-server/group-policy/set-event-log-security-locally-or-via-group-policy.md)
+- [View the SQL Server error log](/sql/tools/configuration-manager/viewing-the-sql-server-error-log?view=sql-server-ver17)

support/sql/database-engine/startup-shutdown/toc.yml

@@ -7,6 +7,8 @@ items:
   href: agent-service-fails-start-stand-alone-server.md
 - name: Error 1069 when starting SQL Server
   href: error-1069-service-cannot-start.md
+- name: Error 17156 when starting SQL Server Agent
+  href: error-17156-eventlog-service.md
 - name: Error 17182 when you start SQL Server service
   href: error-17182-protocols-disabled-start-failure.md
 - name: Event ID 17058 and SQL Server doesn't start