Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am currently prototyping a setup, in which a Windows Server 2008 is configured as a central logging instance for Windows XP and Windows 7 clients via source initiated event forwarding. All computers are in the same domain.

I configured everything according to this DevCenter Article, but due to problems with the provided xml for the logging configuration I simply created a new abonnement (source initiated), put in the "domain computers" group and simply added all events to it. The resulting XML looks like this:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*</Select>
    <Select Path="Security">*</Select>
    <Select Path="Setup">*</Select>
    <Select Path="System">*</Select>
  </Query>
</QueryList>

As you can see, I want to log all events from all event loggers. However, when evaluating the logs on the logging server, all events from the security log stream are not forwarded to the central logging instance (e.g. when trying to run a program as another user and entering a wrong password). Other log streams like system or application work perfectly. I've worked through the validation-part of the article without seeing any problems. So far, I just tested the Windows 7 client, as Windows XP does not have event forwarding installed by default.

Any hints what I do wrong?

share|improve this question

6 Answers 6

up vote 2 down vote accepted
+50

For Windows Vista, 7 and 2008:

The Windows-Eventcollector service (wecsvc) on the source-computers, which forwards the events to the collector-computer(s) if you are using Source-initiated Subscription, runs as "Network Service" account. But the Network-Service account does not have access to the Security event log. The local group "Event Log Readers" has access to all logs. That means on each source-computer you need to add the "Network Service" account to the local "Event Log Readers" group so the Windows-Eventcollector service has access to the Security event log and so it can forward it to the collector-computer(s).

Using SDDL (Security Descriptor Definition Language) you can also redefine the permissions on the different event logs using wevtutil, but that is more complex, which means you could easily break something or cause unwanted effects if you don't read up on this and carefully formulate the SDDL before you do anything.

share|improve this answer
    
I think it's already running as a Network Service, but I'll double-check when I'm at the computer again - thx! –  Lars Feb 8 '12 at 13:34
    
Yes, the collector is running as Network Service, but by default the built-in "Network Service" account does not have access to the Security event log. You need to add the account to the local "Event Log Readers" security group so it can access that log and collect the events. –  lsmooth Feb 8 '12 at 14:36
    
I already had added the Central Logging Box' Computer Account to the log generating computer's admin group. I just added it to the suggested Event Log Readers group without any effect. The Windows-Log-Collector service on the Central Logging Box' is a network service as suspected. This still might be the root of the problem - could you edit your answer to a complete set of what permissions have to be set where? –  Lars Feb 9 '12 at 15:11
    
I updated my previous answer, maybe it's a bit clearer now. –  lsmooth Feb 9 '12 at 19:07
    
Then I understood you correctly - unfortunatly, it did not change the outcome. Could you join me in the chatroom chat.stackexchange.com/rooms/2473/… ? –  Lars Feb 13 '12 at 9:09

We've just followed this guide and like yourselves, we didn't get anywhere, until we added the delegated account for the event logs gathering to the domain admins, and we're no longer in ruins.

Next step, to find a more secure way of doing this!

share|improve this answer

The whole point of the local Network Service account is that it doesn't have elevated privileges on the local system, and other applications and services are dependent on the correct configuration of that account. Just look at the services console and sort by Log On As.

It might be a better approach to create a different account specifically for this purpose, and change the configuration of the Windows Log Collector service to run as this new account.

share|improve this answer
    
Thanks for the tip - but for now, I'd rather have any working configuration at all. I'll tight it down afterwards, when I know, what the problem was. ;) –  Lars Feb 13 '12 at 8:52

Is security logging enabled on the workstations? If not then there will be nothing to forward.

share|improve this answer
    
I do see the event logs of granted and denied logons on the machine itself. –  Lars Feb 7 '12 at 14:14

Probably a permissions issue with the security event log.

Try adding the the collector computer account to the Administrators group on one of the source computers to determine if that fixes the problem.

Note that on Windows 2008 and Windows Vista/7, there is a new group Event Log Readers that makes it easier to provide this level of access.

share|improve this answer
    
tried it, but no change in the behavior. I guess this would have affected the other log parts as well. –  Lars Feb 7 '12 at 14:27
    
It would not have affected the other logs because elevated permissions are required to access the security event log. –  Greg Askew Feb 7 '12 at 15:11
    
Hm, okay. As said, I did add the Collector Computer to the Administration Group of the Event Source Computer, but that did not change the behavior. Does it need to be added to a service user or something similar instead? –  Lars Feb 7 '12 at 19:05

It may be that the Path attribute in the Query block is filtering it. It should work without it:

<QueryList>
  <Query Id="0">
    <Select Path="Application">*</Select>
    <Select Path="Security">*</Select>
    <Select Path="Setup">*</Select>
    <Select Path="System">*</Select>
  </Query>
</QueryList>
share|improve this answer
1  
But then, how could System work? –  Massimo Feb 5 '12 at 21:49
    
good thinking - unfortunatly, it did not solve the problem. :/ –  Lars Feb 7 '12 at 14:13
    
addendum: Windows Server automatically fixed my change to include the Path=""-Part again. –  Lars Feb 7 '12 at 14:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.