2

I have a Service that should Log into Eventlog via Log4Net. This is not working, because I assume it to lack the permissions. Lately I had the same issue with an IIS App that was run by ApplicationPoolIdentity. To Fix this Issue, I had to grant IIS APPPOOL\DefaultAppPool Permissions to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog.

As the Service uses the Local Systemaccount, I wanted to grant it these permissions.

enter image description here

I get the following Error:

The following Object is invalid, because it is not part of the given Searchdomain: NT AUTHORITY\LocalService

Original Message in German:
Das folgende Objekt ist ungültig, da es nicht Teil der angegebenen Suchdomäne ist: NT AUTHORITY\LocalService

6
  • 1
    I can get Local Service to pass the Check Names test if I select "Entire Directory" in the "From this location:" field, and type "Local Service" (note the space between the words) in the "Enter the object names to select" field. Can you try that?
    – Doug Deden
    Jan 16, 2019 at 17:13
  • Also, can you clarify what account the service is using? You mention the Local System account in the second paragraph, but you are trying to grant permissions to the Local Service account.
    – Doug Deden
    Jan 16, 2019 at 17:16
  • @doug You are right. The Service User is called "Lokales System" which translates into LocalSystem or on some Webpages is called NT Authority\SYSTEM. But apparently i get the same error when adding these accounts. Maybe the names are different with the german language settings?
    – LuckyLikey
    Jan 17, 2019 at 6:00
  • Local System should already have Full Control access to that registry location. But if it does not, you can add it by entering System in the "Enter the object names to select" field. Can you edit your question to include screenshots of the error you get when trying it with the System account?
    – Doug Deden
    Jan 17, 2019 at 14:52
  • Well entering System worked. Don't know why NT Authority\SYSTEM wasn't found. Thanks a lot.
    – LuckyLikey
    Jan 17, 2019 at 15:11

1 Answer 1

1

Local System should already have Full Control access to that registry location. But if it does not, you can add it by entering system in the "Enter the object names to select" field. Then click on the Check Names button.

enter image description here

That will then validate what you entered, and, if successful, will change the display to an underlined and all-caps SYSTEM.

enter image description here

(I was able to do this with either my local workstation or Entire Directory selected in the "From this location" field.)

3
  • Thanks a lot. Do you know why it won't accept NT Authority\SYSTEM?
    – LuckyLikey
    Jan 21, 2019 at 6:21
  • 1
    I don't know why, but these two questions have answers that describe some of the concepts around NT Authority\System and LocalSystem. Perhaps those questions and answers will shed some light on your particular case. superuser.com/questions/1067246/… superuser.com/questions/471769/…
    – Doug Deden
    Jan 21, 2019 at 16:56
  • Awesome! It really helped growing my understanding of this topic. Thanks for sharing it here.
    – LuckyLikey
    Jan 22, 2019 at 5:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.