Security for remote EventLog access?

[JV]

It's great that the CLR gives us this cool EventLog object for managing
event logs. And they even give you this cool property "MachineName" to
allow you to deal with event logs on a remote server.

But what access rights are needed by an application if it is to do this?
THAT information is hard to come by. I have yet to find a clear and concise
explanation. You have to piece together information from multiple pages.
And to complicate things even more, changes to Win2003 security complicate
this question.

Anyone know of a good writeup on this? Hey, Microsoft!

 

[Richard Grimes]

It's great that the CLR gives us this cool EventLog object for
managing event logs. And they even give you this cool property
"MachineName" to allow you to deal with event logs on a remote server.

Its good that they created a way to *read* the event log. Its just a
pity that they mad such a mess of *writing* to it. IMO it was simply a
lazy developer at Microsoft not understanding how the event log works.
They have trie to make ammends in Whidney, but the damage has already
been done, and in my opinion they may as well scrap the event log and
come up with something else.

But what access rights are needed by an application if it is to do
this? THAT information is hard to come by. I have yet to find a
clear and concise explanation. You have to piece together
information from multiple pages. And to complicate things even more,
changes to Win2003 security complicate this question.

As I said, I think the people involved don't understand the event log.

You need to have to be in the Administrators group on the remote
machine. That's simple to do if you are running under a domain account.
If you are in a workgroup there's a trick with XP - make sure that you
have an account on the remote machine with the same name and password as
your account and put that in the Administrators group. Also make sure
that you've got the appropriate ports open.

Richard