App can't write to EventLog on Windows Server 2003

[Scott Zabolotzky]

I have an app that writes to a custom event log (which is
created at install time with a custom installer DLL). My app
writes just fine to this custom log when running on Windows
2000 Server but when I try to run it on Windows 2003 Server I
get "Access denied" errors.

I'm using impersonation in my app and if I log in with a
user account that is in the "Domain Admins" groups it will
work on 2003 as well.

What permissions do I need to modify to allow "Domain Users"
to be able to write to the EventLog from ASP.NET? Adding all
users to the "Domain Admins" group is not an option.

THanks...Scott

p.s. I tried changing my app to write to the Application log
rather than a custom log but the problem still occurs.

 

[Jim Cheshire [MSFT]]

Scott,

You don't really need to alter any permissions. You just need to create
the event source. The location for that is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

In there, you will have one key for Application, one for Security, and one
for System. If you are writing to an event source of "MyApp" in the
Application log, you would need to create a new key under Application
called MyApp. Once you do that, the application should work fine.

Jim Cheshire, MCSE, MCSD [MSFT]
ASP.NET
Developer Support
(e-mail address removed)

This post is provided "AS-IS" with no warranties and confers no rights.

--------------------

 

[Scott Zabolotzky]

I'm sorry but I guess I should have worded my original message
a little better. When I said:

"I have an app that writes to a custom event log (which is
created at install time with a custom installer DLL)."

I meant that the event source is created with a call to
CreateEventSource("MySource","MyLog") during my installation
process. The event source is definitely created because if I
run the app as an admin I can write entries to MyLog just fine.
It's definitely appears to be some sort of permissions problem.

Any help you can provide would be greatly appreciated.

Scott

You don't really need to alter any permissions. You just need to create
the event source. The location for that is:

In there, you will have one key for Application, one for Security, and one
for System. If you are writing to an event source of "MyApp" in the
Application log, you would need to create a new key under Application
called MyApp. Once you do that, the application should work fine.

Jim Cheshire, MCSE, MCSD [MSFT]
ASP.NET
Developer Support
(e-mail address removed)

 

[Troy Hall]

Here's a link to a kb article explaining how to grant rights to the event logs
http://support.microsoft.com/default.aspx?scid=kb;en-us;323076

 

[Jim Cheshire [MSFT]]

Hi Scott,

Thanks for your courtesy and decency.

If the event source has been successfully created, the post below to 323076
is likely the issue. Note that this is a new feature of Windows Server
2003.

Jim Cheshire, MCSE, MCSD [MSFT]
ASP.NET
Developer Support
(e-mail address removed)

This post is provided "AS-IS" with no warranties and confers no rights.

--------------------

From: Scott Zabolotzky <[email protected]>
Newsgroups: microsoft.public.dotnet.framework.aspnet.security
Subject: Re: App can't write to EventLog on Windows Server 2003
Date: Fri, 16 Apr 2004 18:47:00 +0000 (UTC)
Organization: Ripco Communications Inc.
Lines: 79
Message-ID: <[email protected]>
References: <[email protected]>

NNTP-Posting-Host: shell2.ripco.com
X-Trace: e250.ripco.com 1082141220 3802 209.100.225.144 (16 Apr 2004 18:47:00 GMT)
X-Complaints-To: (e-mail address removed)
NNTP-Posting-Date: Fri, 16 Apr 2004 18:47:00 +0000 (UTC)
User-Agent: nn/6.6.5
Path: cpmsftngxa10.phx.gbl!TK2MSFTNGXA05.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.s
ul.t-online.de!t-online.de!border2.nntp.ash.giganews.com!nntp.giganews.com!e
lnk-atl-nf1!newsfeed.earthlink.net!bigfeed2.bellsouth.net!bigfeed.bellsouth.
net!news.bellsouth.net!cox.net!news-xfer.cox.net!gail.ripco.com!zabolots
Xref: cpmsftngxa10.phx.gbl microsoft.public.dotnet.framework.aspnet.security:9637
X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet.security

I'm sorry but I guess I should have worded my original message
a little better. When I said:

"I have an app that writes to a custom event log (which is
created at install time with a custom installer DLL)."

I meant that the event source is created with a call to
CreateEventSource("MySource","MyLog") during my installation
process. The event source is definitely created because if I
run the app as an admin I can write entries to MyLog just fine.
It's definitely appears to be some sort of permissions problem.

Any help you can provide would be greatly appreciated.

Scott

You don't really need to alter any permissions. You just need to create
the event source. The location for that is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

In there, you will have one key for Application, one for Security, and one
for System. If you are writing to an event source of "MyApp" in the
Application log, you would need to create a new key under Application
called MyApp. Once you do that, the application should work fine.

Jim Cheshire, MCSE, MCSD [MSFT]
ASP.NET
Developer Support
(e-mail address removed)

This post is provided "AS-IS" with no warranties and confers no rights.
cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.sul.t-online.de!t-onl in
e.de!news-lei1.dfn.de!news-fra1.dfn.de!news2.telebyte.nl!border1.nntp.ash. gi
ganews.com!nntp.giganews.com!newshosting.com!nx01.iad01.newshosting.com!ne ws
-feed01.roc.ny.frontiernet.net!nntp.frontiernet.net!tdsnet-transit!newspee r.
tds.net!gail.ripco.com!zabolots

 

[Scott Zabolotzky]

Thanks for the pointer Jim. It looks like the article at

http://support.microsoft.com/default.aspx?scid=kb;en-us;323076

will probably help. I just have to learn SDDL. Too bad it
couldn't be something simple!

Scott

If the event source has been successfully created, the post below to 323076
is likely the issue. Note that this is a new feature of Windows Server
2003.

--------------------
From: Scott Zabolotzky <[email protected]>
Newsgroups: microsoft.public.dotnet.framework.aspnet.security
Subject: Re: App can't write to EventLog on Windows Server 2003
Date: Fri, 16 Apr 2004 18:47:00 +0000 (UTC)

I'm sorry but I guess I should have worded my original message
a little better. When I said:

"I have an app that writes to a custom event log (which is
created at install time with a custom installer DLL)."

I meant that the event source is created with a call to
CreateEventSource("MySource","MyLog") during my installation
process. The event source is definitely created because if I
run the app as an admin I can write entries to MyLog just fine.
It's definitely appears to be some sort of permissions problem.

Any help you can provide would be greatly appreciated.

Scott

You don't really need to alter any permissions. You just need to create
the event source. The location for that is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

In there, you will have one key for Application, one for Security, and one
for System. If you are writing to an event source of "MyApp" in the
Application log, you would need to create a new key under Application
called MyApp. Once you do that, the application should work fine.
--------------------
From: Scott Zabolotzky <[email protected]>
Newsgroups: microsoft.public.dotnet.framework.aspnet.security
Subject: App can't write to EventLog on Windows Server 2003
Date: Fri, 16 Apr 2004 14:19:23 +0000 (UTC)

I have an app that writes to a custom event log (which is
created at install time with a custom installer DLL). My app
writes just fine to this custom log when running on Windows
2000 Server but when I try to run it on Windows 2003 Server I
get "Access denied" errors.

I'm using impersonation in my app and if I log in with a
user account that is in the "Domain Admins" groups it will
work on 2003 as well.

What permissions do I need to modify to allow "Domain Users"
to be able to write to the EventLog from ASP.NET? Adding all
users to the "Domain Admins" group is not an option.

THanks...Scott

p.s. I tried changing my app to write to the Application log
rather than a custom log but the problem still occurs.