Access Denied when trying to monitor the Security log using WMI..

  • Thread starter Thread starter Rob
  • Start date Start date
R

Rob

I'm writing a VB.NET application to monitor the Security event log, but I
keep getting an 'Access Denied' exception upon executing the .Start() method
of the ManagementEventWatcher class. I have set the security in the
\system32\config\ directory, and I've checked the Microsoft .NET Framework
1.1 Configuration settings.

When I set the LogFile to 'Application' or 'System', it works fine.

Are there other security settings that need to be configured? Am I missing
something in my code?

Any help on this matter is greatly appreciated.


Public Shared Sub QueryEventTest2()
Dim options As New ConnectionOptions()

options.Authentication = AuthenticationLevel.Connect
options.Impersonation = ImpersonationLevel.Impersonate
options.EnablePrivileges = True

Dim ms As New ManagementScope("root\CIMV2", options)

ms.Connect()

Dim watcher As New ManagementEventWatcher( _
New WqlEventQuery("__InstanceCreationEvent", _
"TargetInstance ISA
'Win32_NTLogEvent' AND " & _
"TargetInstance.LogFile =
'Security'"))
watcher.Scope = ms

Dim handler As New MyHandler()
AddHandler watcher.EventArrived, AddressOf handler.Arrived

watcher.Start() 'throws an Access Denied error

Do
System.Threading.Thread.Sleep(1000)
Loop

End Sub
 
Back
Top