Why am I getting unauthorized errors with Powershell get-winevent?

Question

I'm a domain admin equivalent, I've tried running in an elevated console (right-click> run as administrator), and I'm consistently getting errors when executing

get-winevent -logname application | where {$_.message -match "Faulting application"} | `
                                    select TimeCreated,message

I'll get three lines of result, then

Get-WinEvent : Attempted to perform an unauthorized operation.
At line:1 char:13 Get-WinEvent : Attempted to perform an unauthorized operation.
 + CategoryInfo          : NotSpecified: (:) [Get-WinEvent], UnauthorizedAccessException
 + FullyQualifiedErrorId : Attempted to perform an unauthorized operation.,Microsoft.PowerShell.Commands.GetWinEventCommand

This seems to be a new development, haven't gotten those errors before.

It's consistent - if I run it with -computername from another server, the pattern still goes 3 OK lines, then X errors, then 5 OK lines, etc.

Answer 1

Does it happen with other Event Logs? For instance what if you run the following to view login events with specific event IDs?:

Get-WinEvent -FilterHashtable @{logname='security'; id=@(4624,4634,4672,4648)}

If that works there may be some items in the application event log that you don't have access to. In that case you would have to use something like Process Monitor to find out why your access is being denied.

You may get better results using the FilterHashtable parameter to pass the filter criteria to the Get-WinEvent cmdlet. See http://ss64.com/ps/get-winevent.html for examples.

Answer 2

I can run this with a non-administrative user on a locked-down system. Check your permissions and audit policies for event logs in GPO. You may have it set so ONLY auditors can see the logs. Good luck troubleshooting if that is the case.

Answer 3

I had this issue with the Security log. No entries would be returned from a remote get-winevent -logname security. The user was able to access the remote security eventlog via eventvwr.msc.

The fix was a reg hack - add a permission to this key:

HKLM\System\CurrentControlSet\Services\eventlog\Security

I added the AD group of the user with read access and get-winevent worked perfectly after that.

Answer 4

My solution was to add the user / group to the local "Event Log Readers" Group. Log off, back in. Even if the user was already an administrator.

Answer 5

I found another scenario to trigger this error.

1. Is your Get-WinEvent call using the ComputerName parameter?
2. Is the destination address a DNS Alias (CNAME record)?

If the above items are true, try using the IP address instead.

That was the change that solved my problem.