Reading Security Event Logs with Service Account

Try this: Go to Start > Run > secpol.msc > enter. The Local Security
Settings MMC will open. Go to Local Policies > User Rights Assignment > in

> Try this: Go to Start > Run > secpol.msc > enter. The Local Security
> Settings MMC will open. Go to Local Policies > User Rights Assignment > in
> the right pane will be Manage auditing and security log. If you add the
> account you created to that, it should be able to access the logs through
> any means, interactively or via scripting with WMI. If that works ok with
> your app, then set that in the GPO for the OU where the servers are. I would
> suggest creating a domain-level group and then giving that group the rights.
> Add the user account to that group afterwards.
>
> --
> Regards,
>
> Martin X.
> Microsoft Certified Systems Administrator: Messaging
> Philadelphia, Pennsylvania, USA
>
> I have a log aggregation application that uses WMI to monitor security event
> logs on Windows servers. The documentation says it requires a domain admin
> account or local administrator account for access to the security logs, but
> I
> would like to use the concept of "least privelege" and use a service account
> instead with only the minimum rights and priveleges needed. What would I
> need
> to grant to this service account on Windows Server 2003 SP1 and SP2 to allow
> the application to query the security event logs using WMI for all my
> servers
> (domain controllers, member servers, and workgroup servers)?
>
> Thanks!
>
>
>

> Try this: Go to Start > Run > secpol.msc > enter. The Local Security
> Settings MMC will open. Go to Local Policies > User Rights Assignment > in
> the right pane will be Manage auditing and security log. If you add the
> account you created to that, it should be able to access the logs through
> any means, interactively or via scripting with WMI. If that works ok with
> your app, then set that in the GPO for the OU where the servers are. I
> would
> suggest creating a domain-level group and then giving that group the
> rights.
> Add the user account to that group afterwards.
> --
> Regards,
> Martin X.
> Microsoft Certified Systems Administrator: Messaging
> Philadelphia, Pennsylvania, USA
> I have a log aggregation application that uses WMI to monitor security
> event
> logs on Windows servers. The documentation says it requires a domain admin
> account or local administrator account for access to the security logs,
> but
> I
> would like to use the concept of "least privelege" and use a service
> account
> instead with only the minimum rights and priveleges needed. What would I
> need
> to grant to this service account on Windows Server 2003 SP1 and SP2 to
> allow
> the application to query the security event logs using WMI for all my
> servers
> (domain controllers, member servers, and workgroup servers)?
> Thanks!
>

> Thanks, Martin. I have tried the following based upon several other posts
> from different forums and none of them have worked. My user is a service
> account in the Domain Users group.
> - Grant Manage auditing and security log
> - Grant Impersonate a client after authentication
> - Allow log on locally
> - Back up files and directories
> - Add user to Event Log registry hive with full permission
> Any other suggestions?
> "Martin X." wrote:
>> Try this: Go to Start > Run > secpol.msc > enter. The Local Security
>> Settings MMC will open. Go to Local Policies > User Rights Assignment >
>> in
>> the right pane will be Manage auditing and security log. If you add the
>> account you created to that, it should be able to access the logs through
>> any means, interactively or via scripting with WMI. If that works ok with
>> your app, then set that in the GPO for the OU where the servers are. I
>> would
>> suggest creating a domain-level group and then giving that group the
>> rights.
>> Add the user account to that group afterwards.
>> --
>> Regards,
>> Martin X.
>> Microsoft Certified Systems Administrator: Messaging
>> Philadelphia, Pennsylvania, USA
>> I have a log aggregation application that uses WMI to monitor security
>> event
>> logs on Windows servers. The documentation says it requires a domain
>> admin
>> account or local administrator account for access to the security logs,
>> but
>> I
>> would like to use the concept of "least privelege" and use a service
>> account
>> instead with only the minimum rights and priveleges needed. What would I
>> need
>> to grant to this service account on Windows Server 2003 SP1 and SP2 to
>> allow
>> the application to query the security event logs using WMI for all my
>> servers
>> (domain controllers, member servers, and workgroup servers)?
>> Thanks!
>>