Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to create a user account who are able to view security log in event viewer but not as a administrator but just as a power user. I had been getting this error when I click the security log:Unable to complete the operation on "Security". A required privilege is not held by the client.

Method tried after some googling:

1.add both user account and computer account in Computer configuration/Windows settings/Local Policies/User Rights : Manage auditing and security log

share|improve this question

2 Answers 2

It looks like you should be able to edit the event log security settings with a little registry or group policy magic and SDDL. It's a bit hard to summarize, but Microsoft has a KB article that tells you what to do.

The most direct way is directly in the registry, in which case you need to edit the key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Security\CustomSD and specify the SDDL that does what you want.

Searching around is probably the best way to learn SDDL. I have found this article to be useful.

share|improve this answer
    
+1 - SDDL is annoying to parse. –  Evan Anderson Jul 18 '10 at 20:29

The above is helpful (very - I was looking for the SID/abbreviation for EVERYONE - which now i know = WD).

OP: The best way to do it is to create a new local group and get the SID for that group, then give the SID read access in the above registry:

(A;;0x1;;;[SID-HERE])

To test that this will work, try giving everyone READ access first:

(A;;0x1;;;WD)

Then change the WD to the SID of the user/group you create.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.