I'm using this query to check for certain Exchange account changes on my Windows 2008 R2 AD primary:

wevtutil qe Security /q:"*[System/EventID=5136]" /f:text /rd:true /c:1

I'm making a batch file out of it in order to send the event's contents as an attachment via email with Task Scheduler, as outlined in this post: http://blogs.technet.com/b/jhoward/archive/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger.aspx

The problem: I can do wevtutil qe System all day long, but if I do wevtutil qe Security like I need, I need to be at an elevated command prompt (same domain admin user credentials, just CMD ran as admin). So when my scheduled task calls the batch file, even though the task has the option set to "run with highest privileges" under the SYSTEM account, it fails to run in an elevated prompt, meaning it runs into an error: "Failed to open event query. Access is denied."

So either one of these things can fix my issue:

  1. Open up the Security log to be like System log somehow, where you don't need an elevated prompt to access its contents using wevtutil

  2. Run the Scheduled Task action in an elevated prompt, somehow

  3. Some third thing I haven't thought of


Use an account that is a member of the Event Log Readers group.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.