WriteEntry can't write under user account

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I would like to write to the EventLog (Application) with following code. But
this works only under admin account. There are no restrictions in the
WriteEntry-documentation.
Can anyone help me?

Thanks in advance!


try
{
EventLog eLog = null;
bool bLäuft = true;
if(!EventLog.SourceExists("XXX")) EventLog.CreateEventSource"XXX", "",".");
eLog = new EventLog();
eLog.Log = "";
eLog.Source = "XXX";
if (bLäuft == true) eLog.WriteEntry("läuft",EventLogEntryType.Information,1);
eLog.Close();
}
catch (Exception ex)
{
MessageBox.Show(ex.ToString());
}
 
Hi

The event log class will underlying call the Event log Win32 API.
You can check the document below.
Event Logging Security
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/eventlog/ba
se/event_logging_security.asp

Based on my test, I create a new user by default, I did not change any
permission for the user. When we logon to the windows with the user, the
code above will run.
Because when we log onto the Windows, the user is an Interactive user.


Best regards,

Peter Huang
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Thanks for your quick answer.

The document explains a lot. But I still have a problem:
If I run the code under user account AND the Source XXX isn' t already
registered to the EventLog, I receive the error "Requested registry access is
not allowed" for the EventLog.SourceExists part.

Can I only register the Source as an admin??? Is there no other way?

Thanks in advanse!
 
Hi

To add an event source, we need to access to the registry key.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application]
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/eventlog/ba
se/adding_a_source_to_the_registry.asp

But by default, the users group did not have permisson to write to the
registry key for security concern.
I think it would better for the admin to create the event source and the
user just write to the event log.


Best regards,

Peter Huang
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Back
Top