r11332: eventlog API uses NTSTATUS, not WERROR for return codes