Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the most efficient way to allow a specific user access to event logs?

I have come across a method to enforce permissions using local security policy and group policy, but it seems overly complex.

Is there a facility that makes granting a user access to the event logs easier?

Note that I do not have the User in any local security groups (such as Users, Power Users, or Administrators). It is a service user who is, you guessed it, my monitoring agent (NSClient++).

For future reference: Here you will find helpful SDDL definitions.

share|improve this question
Efficient doesn't mean secure. But you wanted it efficient: Make him an Administrator. – mailq Aug 25 '11 at 17:04
Efficient how? That adjective is pretty subjective with the leve of detail you have provided. Do you need to do this on a single computer, or one hundred computers? The group policy method seems like it would be great for a large set of computers. – Zoredache Aug 25 '11 at 17:11
@mailq: I like your style (because I'm a sarcastic "give them what they ask for" kind of person). – joeqwerty Aug 25 '11 at 17:29
All: This tangent, although ego supportive, isn't very useful, specifically since I've mentioned that the user isn't part of any local groups, clearly implying that security is a concern. The question in itself implicates that very granular security is wanted and needed. Efficient would mean: is there an easier way to handle all this heavy lifting. – mbrownnyc Aug 25 '11 at 17:42
@mbrownnyc: My humor (sarcasm) wasn't directed at you, so no offense intended. In addition, the user is a member of a local group (Users) by way of their membership in the Domain Users group, if the computer is joined to a domain. If the computer is not joined to a domain then the user is a direct member of the local Users group by default as it's not possible to add a user without automatic membership in this group, although it's possible to modify after the fact. – joeqwerty Aug 25 '11 at 18:45
up vote 1 down vote accepted

Using group policies would be the correct method of granting this right.

share|improve this answer
This is true, as you can create an ADM(x) that populates the HKEY_LOCAL_MACHINE\System\CurrentcontrolSet\Services\eventlog\Application\ CustomSD REG_SZ key with the SDDL. The policy would not be "fully managed," but it may be easier for someone who's dealing with an administrative hierarchy. I'm trying to get the above (edit the .inf method) working via "security policy" .inf in a domain-wide GPO… which seems like it will work once finished. – mbrownnyc Sep 16 '11 at 20:18

This MS Knowledge Base article describes how to do it via registry or Group Policy.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.