Access to EventLog on remote computer

[bartlomiej.szafraniec]

Hello!
How I can gain access to event log on remote machine?
Computers are in the same network but they are not in domain, they are
only in the same workgroup.
I've tried MachineName property in EventLog class but I get
exception.
I know administrator password on remote computer but how can I say
EventLog class "log in to remote computer with this username and
password"?

I code under .NET Framework 1.1

Below sample code and the exception I get

Thanks in advance for help
Bartek

// some code
try
{
System.Diagnostics.EventLog log = new System.Diagnostics.EventLog();
log.MachineName = "lasulaptop";
log.Log = "Application";

int test = log.Entries.Count;
}
catch (UnauthorizedAccessException ex)
{
throw;
}

// some code
This is exception I get

System.UnauthorizedAccessException was caught
Message="Attempted to perform an unauthorized operation."
Source="mscorlib"
StackTrace:
at Microsoft.Win32.RegistryKey.Win32ErrorStatic(Int32 errorCode,
String str)
at Microsoft.Win32.RegistryKey.OpenRemoteBaseKey(RegistryHive
hKey, String machineName)
at System.Diagnostics.EventLog.GetEventLogRegKey(String machine,
Boolean writable)
at System.Diagnostics.EventLog.Exists(String logName, String
machineName)
at System.Diagnostics.EventLog.OpenForRead(String
currentMachineName)
at System.Diagnostics.EventLog.get_EntryCount()
at System.Diagnostics.EventLogEntryCollection.get_Count()
at

 

[Vadym Stetsyak]

Hello, (e-mail address removed)!

Are you able to connect to remote Event Log via mmc snap-in?

You can try to impersonate with the remote user and then access remote event log
To impersonate you will LogonUser and other win32 api:

( http://www.thecodeproject.com/csharp/cpimpersonation1.asp )
( http://www.pinvoke.net/default.aspx/advapi32.LogonUser )

--
Regards, Vadym Stetsyak
www: http://vadmyst.blogspot.com

 

[bartlomiej.szafraniec]

Acctualy no, I can't access over this snapin.
I also get the same error 'access denied'.
I've tried imersonate user but I get the same exception.
I disabled firewal on remote host but it also did not help.

Do you have any idea what I'm dining wrong?

Regards,
Bartek

 

[Tasos Vogiatzoglou]

Try to map the current username/password to the remote server. From a
quick pick at Reflector it does not seem to pass authentication tokens
while quering the remote eventlog.

Also check in the remote system if Remote Registry service is running
and the user has access to SYSTEM\CurrentControlSet\Services\EventLog
key registry.

Regards,
Tasos

 

[bartlomiej.szafraniec]

I found some solution. I can gain access to remote event log over
Windows Management Instrumentation.
I don't know if it is the best way to go but at least it works.

Thanks for help.

Regards
Bartek