App can't write to EventLog on Windows Server 2003

[Scott Zabolotzky]

I have an app that writes to a custom event log (which is
created at install time with a custom installer DLL). My app
writes just fine to this custom log when running on Windows
2000 Server but when I try to run it on Windows 2003 Server I
get "Access denied" errors.

I'm using impersonation in my app and if I log in with a
user account that is in the "Domain Admins" groups it will
work on 2003 as well.

What permissions do I need to modify to allow "Domain Users"
to be able to write to the EventLog from ASP.NET? Adding all
users to the "Domain Admins" group is not an option.

THanks...Scott

p.s. I tried changing my app to write to the Application log
rather than a custom log but the problem still occurs.

[Jim Cheshire [MSFT]]

Scott,

You don't really need to alter any permissions. You just need to create
the event source. The location for that is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Eventlog

In there, you will have one key for Application, one for Security, and one
for System. If you are writing to an event source of "MyApp" in the
Application log, you would need to create a new key under Application
called MyApp. Once you do that, the application should work fine.

Jim Cheshire, MCSE, MCSD [MSFT]
ASP.NET
Developer Support
[email]jamesche@online.microsoft.com[/email]

This post is provided "AS-IS" with no warranties and confers no rights.

--------------------

>From: Scott Zabolotzky <zabolots@ripco.com>
>Newsgroups: microsoft.public.dotnet.framework.aspnet.security
>Subject: App can't write to EventLog on Windows Server 2003
>Date: Fri, 16 Apr 2004 14:19:23 +0000 (UTC)
>Organization: Ripco Communications Inc.
>Lines: 18
>Message-ID: <c5oq1b$bcv$1@e250.ripco.com>
>NNTP-Posting-Host: shell2.ripco.com
>X-Trace: e250.ripco.com 1082125163 11679 209.100.225.144 (16 Apr 2004

14:19:23 GMT)

>X-Complaints-To: [email]usenet@ripco.com[/email]
>NNTP-Posting-Date: Fri, 16 Apr 2004 14:19:23 +0000 (UTC)
>User-Agent: nn/6.6.5
>Path:

cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed 00.sul.t-online.de!t-onlin
e.de!news-lei1.dfn.de!news-fra1.dfn.de!news2.telebyte.nl!border1.nntp.ash.gi
ganews.com!nntp.giganews.com!newshosting.com!nx01. iad01.newshosting.com!news
-feed01.roc.ny.frontiernet.net!nntp.frontiernet.net !tdsnet-transit!newspeer.
tds.net!gail.ripco.com!zabolots

>Xref: cpmsftngxa06.phx.gbl

microsoft.public.dotnet.framework.aspnet.security: 9658

>X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet.security
>
>I have an app that writes to a custom event log (which is
>created at install time with a custom installer DLL). My app
>writes just fine to this custom log when running on Windows
>2000 Server but when I try to run it on Windows 2003 Server I
>get "Access denied" errors.
>
>I'm using impersonation in my app and if I log in with a
>user account that is in the "Domain Admins" groups it will
>work on 2003 as well.
>
>What permissions do I need to modify to allow "Domain Users"
>to be able to write to the EventLog from ASP.NET? Adding all
>users to the "Domain Admins" group is not an option.
>
>THanks...Scott
>
>p.s. I tried changing my app to write to the Application log
>rather than a custom log but the problem still occurs.
>

[Scott Zabolotzky]

I'm sorry but I guess I should have worded my original message
a little better. When I said:

"I have an app that writes to a custom event log (which is
created at install time with a custom installer DLL)."

I meant that the event source is created with a call to
CreateEventSource("MySource","MyLog") during my installation
process. The event source is definitely created because if I
run the app as an admin I can write entries to MyLog just fine.
It's definitely appears to be some sort of permissions problem.

Any help you can provide would be greatly appreciated.

Scott

[email]jamesche@online.microsoft.com[/email] (Jim Cheshire [MSFT]) writes:

>You don't really need to alter any permissions. You just need to create
>the event source. The location for that is:

>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servi ces\Eventlog

>In there, you will have one key for Application, one for Security, and one
>for System. If you are writing to an event source of "MyApp" in the
>Application log, you would need to create a new key under Application
>called MyApp. Once you do that, the application should work fine.

>Jim Cheshire, MCSE, MCSD [MSFT]
>ASP.NET
>Developer Support
>jamesche@online.microsoft.com

>This post is provided "AS-IS" with no warranties and confers no rights.

>--------------------

>>From: Scott Zabolotzky <zabolots@ripco.com>
>>Newsgroups: microsoft.public.dotnet.framework.aspnet.security
>>Subject: App can't write to EventLog on Windows Server 2003
>>Date: Fri, 16 Apr 2004 14:19:23 +0000 (UTC)
>>Organization: Ripco Communications Inc.
>>Lines: 18
>>Message-ID: <c5oq1b$bcv$1@e250.ripco.com>
>>NNTP-Posting-Host: shell2.ripco.com
>>X-Trace: e250.ripco.com 1082125163 11679 209.100.225.144 (16 Apr 2004

>14:19:23 GMT)

>>X-Complaints-To: [email]usenet@ripco.com[/email]
>>NNTP-Posting-Date: Fri, 16 Apr 2004 14:19:23 +0000 (UTC)
>>User-Agent: nn/6.6.5
>>Path:

>cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfee d00.sul.t-online.de!t-onlin
>e.de!news-lei1.dfn.de!news-fra1.dfn.de!news2.telebyte.nl!border1.nntp.ash.gi
>ganews.com!nntp.giganews.com!newshosting.com!nx01 .iad01.newshosting.com!news
>-feed01.roc.ny.frontiernet.net!nntp.frontiernet.net !tdsnet-transit!newspeer.
>tds.net!gail.ripco.com!zabolots

>>Xref: cpmsftngxa06.phx.gbl

>microsoft.public.dotnet.framework.aspnet.security :9658

>>X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet.security
>>
>>I have an app that writes to a custom event log (which is
>>created at install time with a custom installer DLL). My app
>>writes just fine to this custom log when running on Windows
>>2000 Server but when I try to run it on Windows 2003 Server I
>>get "Access denied" errors.
>>
>>I'm using impersonation in my app and if I log in with a
>>user account that is in the "Domain Admins" groups it will
>>work on 2003 as well.
>>
>>What permissions do I need to modify to allow "Domain Users"
>>to be able to write to the EventLog from ASP.NET? Adding all
>>users to the "Domain Admins" group is not an option.
>>
>>THanks...Scott
>>
>>p.s. I tried changing my app to write to the Application log
>>rather than a custom log but the problem still occurs.
>>

[Troy Hall]

Here's a link to a kb article explaining how to grant rights to the event logs
[url]http://support.microsoft.com/default.aspx?scid=kb;en-us;323076[/url]

[Jim Cheshire [MSFT]]

Hi Scott,

Thanks for your courtesy and decency.

If the event source has been successfully created, the post below to 323076
is likely the issue. Note that this is a new feature of Windows Server
2003.

Jim Cheshire, MCSE, MCSD [MSFT]
ASP.NET
Developer Support
[email]jamesche@online.microsoft.com[/email]

This post is provided "AS-IS" with no warranties and confers no rights.

--------------------

>From: Scott Zabolotzky <zabolots@ripco.com>
>Newsgroups: microsoft.public.dotnet.framework.aspnet.security
>Subject: Re: App can't write to EventLog on Windows Server 2003
>Date: Fri, 16 Apr 2004 18:47:00 +0000 (UTC)
>Organization: Ripco Communications Inc.
>Lines: 79
>Message-ID: <c5p9n4$3mq$1@e250.ripco.com>
>References: <c5oq1b$bcv$1@e250.ripco.com>

<UPcM#z8IEHA.2948@cpmsftngxa06.phx.gbl>

>NNTP-Posting-Host: shell2.ripco.com
>X-Trace: e250.ripco.com 1082141220 3802 209.100.225.144 (16 Apr 2004

18:47:00 GMT)

>X-Complaints-To: [email]usenet@ripco.com[/email]
>NNTP-Posting-Date: Fri, 16 Apr 2004 18:47:00 +0000 (UTC)
>User-Agent: nn/6.6.5
>Path:

cpmsftngxa10.phx.gbl!TK2MSFTNGXA05.phx.gbl!TK2MSFT NGP08.phx.gbl!newsfeed00.s
ul.t-online.de!t-online.de!border2.nntp.ash.giganews.com!nntp.gigan ews.com!e
lnk-atl-nf1!newsfeed.earthlink.net!bigfeed2.bellsouth.net! bigfeed.bellsouth.
net!news.bellsouth.net!cox.net!news-xfer.cox.net!gail.ripco.com!zabolots

>Xref: cpmsftngxa10.phx.gbl

microsoft.public.dotnet.framework.aspnet.security: 9637

>X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet.security
>
>I'm sorry but I guess I should have worded my original message
>a little better. When I said:
>
>"I have an app that writes to a custom event log (which is
>created at install time with a custom installer DLL)."
>
>I meant that the event source is created with a call to
>CreateEventSource("MySource","MyLog") during my installation
>process. The event source is definitely created because if I
>run the app as an admin I can write entries to MyLog just fine.
>It's definitely appears to be some sort of permissions problem.
>
>Any help you can provide would be greatly appreciated.
>
>Scott
>
>jamesche@online.microsoft.com (Jim Cheshire [MSFT]) writes:
>

>>You don't really need to alter any permissions. You just need to create
>>the event source. The location for that is:

>

>>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Serv ices\Eventlog

>

>>In there, you will have one key for Application, one for Security, and

one

>>for System. If you are writing to an event source of "MyApp" in the
>>Application log, you would need to create a new key under Application
>>called MyApp. Once you do that, the application should work fine.

>

>>Jim Cheshire, MCSE, MCSD [MSFT]
>>ASP.NET
>>Developer Support
>>jamesche@online.microsoft.com

>

>>This post is provided "AS-IS" with no warranties and confers no rights.

>

>>--------------------

>>>From: Scott Zabolotzky <zabolots@ripco.com>
>>>Newsgroups: microsoft.public.dotnet.framework.aspnet.security
>>>Subject: App can't write to EventLog on Windows Server 2003
>>>Date: Fri, 16 Apr 2004 14:19:23 +0000 (UTC)
>>>Organization: Ripco Communications Inc.
>>>Lines: 18
>>>Message-ID: <c5oq1b$bcv$1@e250.ripco.com>
>>>NNTP-Posting-Host: shell2.ripco.com
>>>X-Trace: e250.ripco.com 1082125163 11679 209.100.225.144 (16 Apr 2004

>>14:19:23 GMT)

>>>X-Complaints-To: [email]usenet@ripco.com[/email]
>>>NNTP-Posting-Date: Fri, 16 Apr 2004 14:19:23 +0000 (UTC)
>>>User-Agent: nn/6.6.5
>>>Path:

>>cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfe ed00.sul.t-online.de!t-onl

in

>>e.de!news-lei1.dfn.de!news-fra1.dfn.de!news2.telebyte.nl!border1.nntp.ash.

gi

>>ganews.com!nntp.giganews.com!newshosting.com!nx0 1.iad01.newshosting.com!ne

ws

>>-feed01.roc.ny.frontiernet.net!nntp.frontiernet.net !tdsnet-transit!newspee

r.

>>tds.net!gail.ripco.com!zabolots

>>>Xref: cpmsftngxa06.phx.gbl

>>microsoft.public.dotnet.framework.aspnet.securit y:9658

>>>X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet.security
>>>
>>>I have an app that writes to a custom event log (which is
>>>created at install time with a custom installer DLL). My app
>>>writes just fine to this custom log when running on Windows
>>>2000 Server but when I try to run it on Windows 2003 Server I
>>>get "Access denied" errors.
>>>
>>>I'm using impersonation in my app and if I log in with a
>>>user account that is in the "Domain Admins" groups it will
>>>work on 2003 as well.
>>>
>>>What permissions do I need to modify to allow "Domain Users"
>>>to be able to write to the EventLog from ASP.NET? Adding all
>>>users to the "Domain Admins" group is not an option.
>>>
>>>THanks...Scott
>>>
>>>p.s. I tried changing my app to write to the Application log
>>>rather than a custom log but the problem still occurs.
>>>

>
>

[Scott Zabolotzky]

Thanks for the pointer Jim. It looks like the article at

[url]http://support.microsoft.com/default.aspx?scid=kb;en-us;323076[/url]

will probably help. I just have to learn SDDL. Too bad it
couldn't be something simple!

Scott

[email]jamesche@online.microsoft.com[/email] (Jim Cheshire [MSFT]) writes:

>If the event source has been successfully created, the post below to 323076
>is likely the issue. Note that this is a new feature of Windows Server
>2003.

>--------------------

>>From: Scott Zabolotzky <zabolots@ripco.com>
>>Newsgroups: microsoft.public.dotnet.framework.aspnet.security
>>Subject: Re: App can't write to EventLog on Windows Server 2003
>>Date: Fri, 16 Apr 2004 18:47:00 +0000 (UTC)
>>
>>I'm sorry but I guess I should have worded my original message
>>a little better. When I said:
>>
>>"I have an app that writes to a custom event log (which is
>>created at install time with a custom installer DLL)."
>>
>>I meant that the event source is created with a call to
>>CreateEventSource("MySource","MyLog") during my installation
>>process. The event source is definitely created because if I
>>run the app as an admin I can write entries to MyLog just fine.
>>It's definitely appears to be some sort of permissions problem.
>>
>>Any help you can provide would be greatly appreciated.
>>
>>Scott
>>
>>jamesche@online.microsoft.com (Jim Cheshire [MSFT]) writes:
>>

>>>You don't really need to alter any permissions. You just need to create
>>>the event source. The location for that is:

>>

>>>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Ser vices\Eventlog

>>

>>>In there, you will have one key for Application, one for Security, and

>one

>>>for System. If you are writing to an event source of "MyApp" in the
>>>Application log, you would need to create a new key under Application
>>>called MyApp. Once you do that, the application should work fine.
>>>--------------------
>>>>From: Scott Zabolotzky <zabolots@ripco.com>
>>>>Newsgroups: microsoft.public.dotnet.framework.aspnet.security
>>>>Subject: App can't write to EventLog on Windows Server 2003
>>>>Date: Fri, 16 Apr 2004 14:19:23 +0000 (UTC)
>>>>
>>>>I have an app that writes to a custom event log (which is
>>>>created at install time with a custom installer DLL). My app
>>>>writes just fine to this custom log when running on Windows
>>>>2000 Server but when I try to run it on Windows 2003 Server I
>>>>get "Access denied" errors.
>>>>
>>>>I'm using impersonation in my app and if I log in with a
>>>>user account that is in the "Domain Admins" groups it will
>>>>work on 2003 as well.
>>>>
>>>>What permissions do I need to modify to allow "Domain Users"
>>>>to be able to write to the EventLog from ASP.NET? Adding all
>>>>users to the "Domain Admins" group is not an option.
>>>>
>>>>THanks...Scott
>>>>
>>>>p.s. I tried changing my app to write to the Application log
>>>>rather than a custom log but the problem still occurs.
>>>>

>>
>>