Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to collect logs from remote windows machines (Windows Server 2008R2 and Windows 7) and I can't figure out a way to do so in such a way that I should still be able to accomplish this without having admin privileges on the remote machine.

  1. Is that possible?
  2. I am currently using Get-EventLog cmdlet in PowerShell. I can get the logs if I am the admin of the remote machine.
  3. All the machines are in a single domain.
  4. Using PowerShell3.

let me know if you need more details.

share|improve this question
    
why not change the ACL on the event logs so that a domain user or group can read it remotely. –  Knuckle-Dragger Mar 26 at 9:24
    
Trust me I have had that discussion with the client. He is hell bent to get the solution without making any modification to the current environment. –  Ma_Khan Mar 31 at 20:06

2 Answers 2

You can forward log events in Windows Server 2008 and Windows 7. This might be a better work around. You setup the machines to forward events to a central collector and then configure a central point to collect the event logs. A bit more info from MS is available here.. http://technet.microsoft.com/en-us/library/cc748890.aspx

The good part about collecting them centrally is that you can then use powershell as you wish to process the logs as needed locally on the collector..

I think without admin privileges, I think you are going to be hard presses to pull the event logs remotely. But maybe someone else has a better option? Maybe the SNMP service might allow read only public access?

share|improve this answer
    
Thanks Mike but I knew this solution. Sorry I forgot to mention in my question. However, the problem I face with this is my central location is a VM share, I don't how will Windows react if its unable to write to this share because of unavailability. Does it just loose logs of that time period or is there also a possibility of a crash? –  Ma_Khan Mar 31 at 20:09
    
I do not know, you would need to test it. My educated guess would be that the machines would hold onto the logs are forward them once the VM collector came back online. FWIW, there are software packages that do this type of work like Solarwinds Log and Event Manager. Dumping them all to a central location is going to be a mess no matter how you do it. Just because you can do it, doesn't mean you should. Not making changes to the environment is damn near impossible in trying to collect these logs. Using your Powershell access will likely be simpler instead. –  MikeAWood Apr 1 at 0:29

Create a service account to run this process and place it in the local "Event Log Readers" group on all the targets you intend to collect from. You could even use a GPO to have this account added (Computer Configuration/Policies/Windows Settings/Security Settings/Restricted Groups)

This question could go in a lot of other directions after this security issue is resolved. There are many 3rd party tools for log collection across an enterprise (Arcsight, Splunk, etc) or you may choose to roll your own with powershell.

share|improve this answer
    
Craig... the client has given me 1 VM with admin rights. I have standard user rights on other machines in the environment. Client doesn't want to add or edit anything else running in his environment. If he could modify the rights I already have a solution working for that scenario. –  Ma_Khan Mar 31 at 20:13
    
Ummm.... okay. Your situation seems to have changed from what you originally asked for where you wrote "I should still be able to accomplish this without having admin privileges on the remote machine." –  Craig620 Mar 31 at 20:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.