Event ID 2001 in source NetiqMCcnt found in Application Event log after install (NETIQKB72855)

After agent installation an application event log entry for the NetIQmcCnt is showing up stating an event id of 2001. This may occur on all servers with the agent installed or only servers installed recently.

This problem can be resolved by changing the following GPO or Local Security Policy setting:

• Open the Domain Security Settings or Local Security Policy
• Browse to the Local Policies > Security Options
• Find the System objects: Default owner for objects created by members of the Administrators group setting
• Select "Administrators Group" instead of "Object Creator"
• Click OK

Restart the NetIQ Client Resource Monitor service and the application event log entries should now disappear.

This is caused by a GPO or Local Security policy setting that sets the default owner of an object at installation to either the 'object creator' or 'administrators group'. When this setting is set to 'object creator' and the agent is installed with a different user account than the NetIQ services use to run it can cause a file access problem that leads to this error.

Formerly known as NETIQKB72855

While this is the same event log message as NETIQKB9076 this is NOT the same problem. If that solution does not work, these settings should be checked, and if after changing these settings the event is still created then you may also need to reload the Performance Counters.