System.Diagnostics.Tests.EventLog tests failing with System.UnauthorizedAccessException : Attempted to perform an unauthorized operation

[elinor-fung]

Build Information

Build: https://dev.azure.com/dnceng-public/cbb18261-c48f-4abb-8651-8cdcb5474649/_build/results?buildId=1142533
Build error leg or test failing: System.Diagnostics.Tests.EventLogSessionTests.ClearLog_LogExists_Success
Pull request: #119473

System.Diagnostics.Tests.EventLogMessagesTests.CanReadAndWriteMessages [FAIL]
  System.UnauthorizedAccessException : Attempted to perform an unauthorized operation.
  Stack Trace:
    /_/src/libraries/System.Security.AccessControl/src/System/Security/AccessControl/Win32.cs(308,0): at System.Security.AccessControl.Win32.SetSecurityInfo(ResourceType type, String name, SafeHandle handle, SecurityInfos securityInformation, SecurityIdentifier owner, SecurityIdentifier group, GenericAcl sacl, GenericAcl dacl)
    /_/src/libraries/System.Security.AccessControl/src/System/Security/AccessControl/NativeObjectSecurity.cs(263,0): at System.Security.AccessControl.NativeObjectSecurity.Persist(String name, SafeHandle handle, AccessControlSections includeSections, Object exceptionContext)
    /_/src/libraries/System.Security.AccessControl/src/System/Security/AccessControl/NativeObjectSecurity.cs(368,0): at System.Security.AccessControl.NativeObjectSecurity.Persist(SafeHandle handle, AccessControlSections includeSections, Object exceptionContext)
    /_/src/libraries/System.Security.AccessControl/src/System/Security/AccessControl/NativeObjectSecurity.cs(361,0): at System.Security.AccessControl.NativeObjectSecurity.Persist(SafeHandle handle, AccessControlSections includeSections)
    /_/src/libraries/System.Threading.AccessControl/src/System/Security/AccessControl/MutexSecurity.cs(178,0): at System.Security.AccessControl.MutexSecurity.Persist(SafeWaitHandle handle)
    /_/src/libraries/System.Threading.AccessControl/src/System/Threading/ThreadingAclExtensions.cs(35,0): at System.Threading.ThreadingAclExtensions.SetAccessControl(Mutex mutex, MutexSecurity mutexSecurity)
    /_/src/libraries/Common/src/System/Diagnostics/NetFrameworkUtils.cs(32,0): at System.Diagnostics.NetFrameworkUtils.EnterMutexWithoutGlobal(String mutexName, Mutex& mutex)
    /_/src/libraries/Common/src/System/Diagnostics/NetFrameworkUtils.cs(19,0): at System.Diagnostics.NetFrameworkUtils.EnterMutex(String name, Mutex& mutex)
    /_/src/libraries/System.Diagnostics.EventLog/src/System/Diagnostics/EventLog.cs(446,0): at System.Diagnostics.EventLog.DeleteEventSource(String source, String machineName)
    /_/src/libraries/System.Diagnostics.EventLog/src/System/Diagnostics/EventLog.cs(433,0): at System.Diagnostics.EventLog.DeleteEventSource(String source)
    /_/src/libraries/System.Diagnostics.EventLog/tests/EventLogMessagesTests.cs(82,0): at System.Diagnostics.Tests.EventLogMessagesTests.CanReadAndWriteMessages()
    /_/src/coreclr/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.CoreCLR.cs(36,0): at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
    /_/src/libraries/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.cs(57,0): at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)

Error Message

Fill the error message using step by step known issues guidance.

{
  "ErrorMessage": ["System.Diagnostics.Tests.EventLog", "System.UnauthorizedAccessException : Attempted to perform an unauthorized operation"],
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1142533
Error message validated: [System.Diagnostics.Tests.EventLog System.UnauthorizedAccessException : Attempted to perform an unauthorized operation]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 9/9/2025 2:24:07 AM UTC

Report

Build	Definition	Test	Pull Request
1158976	dotnet/runtime	System.Diagnostics.Tests.EventLogWriteEntryTests.WriteWithoutExistingSource	#120126
1158712	dotnet/runtime	System.Diagnostics.Tests.EventLogWriteEntryTests.WriteWithoutExistingSource	#120126
1154732	dotnet/runtime	System.Diagnostics.Tests.EventLogWriteEntryTests.WriteWithoutExistingSource	#119937
1142533	dotnet/runtime	System.Diagnostics.Tests.EventLogMessagesTests.CanReadAndWriteMessages	#119473

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	3	4

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[elinor-fung]

Likely related to or the same as #116014

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-diagnostics-eventlog
See info in area-owners.md if you want to be subscribed.