How to view Windows Event Log remotely with limited privileges

V

6

To debug some code, I would like to view the Windows event log of a remote machine (target is Windows2003). With mmc.exe I can add the event log for a remote machine, but only if I have sufficient permissions. For this remote machine, they do not want to give me permissions to log in remotely (or admin privileges for that matter). Is there a specific permission I can be given to view the event log and not much else?

Vernacularism answered 6/1, 2009 at 18:11 Comment(0)

D

3

On newer Windows versions (Windows 7, Windows Server 2008...) you can simply add the corresponding account to the built-in group Event Log Readers.

Source: Jane Lewis's Weblog on TechNet, Giving Non Administrators permission to read Event Logs Windows 2003 and Windows 2008

This source also describes an alternative if you need more fine-grained control.

(The OP asked for Windows 2003, where this method doesn't work, but as Windows Server 2003 is no longer supported, people might be interested in this method.)

Derange answered 8/6, 2016 at 17:12 Comment(0)

K

2

For the security log, users need the privilege "Manage auditing and security log"

For the system and applciation logs you should be able to read them as just a guest unless they have set the RestrictGuestAZccess value under the following registry keys: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\System HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application

Kovacev answered 6/1, 2009 at 18:27 Comment(0)

C

1

One Option is to get a local ID that is on the remote local admin group.

Next, from your system, map to a drive on the remote server using the new remote local ID.

Create a new MMC from the Windows Run start menu - by typing in MMC /a

Add the EventView Snap-in

When it prompts you for local or remote server - put in the Host name of the server that you mapped to.

Tip: Windows uses established secure connection - if it can. Hence the map a drive trick work VERY well.

Please Note: I use this trick with WMI query(s) - hence the query never fails do to a timeout issue.

Clansman answered 6/5, 2009 at 7:31 Comment(0)

S

1

Joshua Flanagan outlined a process to delegate rights through modifying the security descriptor of the event logs.

Stockwell answered 28/7, 2010 at 14:34 Comment(0)

C

0

Please add the domain user (without admin rights) to the "Event Log Readers" group on the target server. Then, from the source server, you can use the standard user credentials to access and read the event logs on the target.

Chainey answered 19/1, 2014 at 10:26 Comment(0)

T

-1

If you could enable web access to the server then you could use an eventlog viewer page that I published a while ago. This would allow the administrators to run the website with just enough permissions to see the eventlog without granting you an account to login...

Trauner answered 6/1, 2009 at 18:19 Comment(2)

The provided link is dead. – Intertidal 22/4, 2013 at 14:8

Can you not just update the link? Or is it a link to your blog which you don't care about anymore? – Intertidal 18/7, 2013 at 22:4

Recommended topics

Hot tags