CODEWITHSUNDEEP
windowspowershell
naimaaannnn
naimaaannnn

Reputation: 66

Can't remotely fetch event viewer logs of the logname Security

I have been trying to get the event viewer logs of application, security and system and store the output into an xml file. While application and system work just fine I have been having problems with security.

Upvotes: 0

Views: 1083

Answers (1)

Scepticalist
Scepticalist

Reputation: 3923

The Security event log is secured to machine administrators only.

As you've added your account to the "Event Log Readers" group, you need to add the "BUILTIN\Event Log Readers" group to the following registry key permissions:

HKLM\System\CurrentControlSet\Services\Eventlog\Security

This key only

Query Value, Enumerate Subkeys, Notify, Read Control

On a domain you can do this using group policy to cover all machines:

Group Policy Object Editor: Computer Configuration > Policies > Windows Settings > Security Settings

Upvotes: 1

Related Questions