Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My ASP.NET application needs to be able to write to the windows event log and read from the windows event log using WMI. I don't want the application account- currently NETWORK SERVICE, to be able to delete or modify event log entries.

Yeah, I konw that a malicious user would still be able to clear the event log by flooding it until it rolls over, but I can live with that.

EDIT: Another way to put the question-- is there any way I can have my app write to the windows event log (application, or custom log) and know the log entries weren't subsequently tampered with by the application that wrote the log entry?

EDIT: If the solution requires using something other than the default NETWORK SERVICE account to run, that's good too.

share|improve this question
Doesn't 'NETWORK SERVICE' have SeTakeOwnershipPrivilege? It can be used to override ACLs of everything. So it would be as pointless as protecting something from root :/ – grawity Jun 1 '09 at 15:25
On my XP and Win2003 boxes, only Administrators have SeTakeOwnershipPrivilege. I'm pretty sure NETWORK SERVICES isn't an administrator. And TechNet says no-… – MatthewMartin Jun 1 '09 at 16:31

I don't think you can get that granular on an event log. How about creating a custom event log for your app and logging to it?

share|improve this answer
I read the link and it said "You can delete any event log on your local computer or a remote server, provided you have the appropriate registry rights." But it doesn't say how to deny those right to "network services", so I'm back to where I was. – MatthewMartin Jun 1 '09 at 16:11
Right, but as grawity points out you're kinda limiting yourself in the use of the NETWORK SERVICE account. I was thinking you could at least minimizing the effects to other event logs by isolating them to your application specific log. That way even if a malicious user floods your log you'll still have an intact system log, application log, security log, etc... – squillman Jun 1 '09 at 16:17
Point well taken that an application should write to its own log. However, I'm not worried about those logs other, that's another administrator's job. It's tampering with the application log that is interesting. – MatthewMartin Jun 1 '09 at 16:34

Modifying the access rights of the NETWORK SERVICE account can potentially lead to Bad Things in the future. Even if it could be done in the way you want, at the very least it's another config step for any potential customer to do, and one that they may not be happy with. A golden rule is not to mess with built-in functionality.

In this case, NETWORK SERVICE writes other events from other apps and OS processes to the logs, and you don't want to break that, do you? I'm not trying to be rude here, but your app may not be the only one on the machine, so it needs to play nice.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.