Re: Windows Service - Event Log

Only Administrators (and localsystem) are allowed to write to HKLM and
descendants, Service accounts are not supposed to write to HKLM.

Services write to Event Logs all the time, and run under a variety of user
accounts. In fact, the majority of the Events in the Event Log are written
by Services. If you look in the Application and System Event Logs, for
example, you will see that almost all Events are written by Services.

That said, by default, members of the Administrators group and the Local
System account are the only accounts allowed to write to the Event Log on a
Windows 2003 server. On the other hand, a Service can certainly run under
the Local System Account, and an account other than the Administrators group
or the Local System account may be granted permission to create and write to
Event Logs as well.

--
HTH,

Kevin Spencer
Microsoft MVP
Professional Chicken Salad Alchemist

Big thicks are made up of lots of little thins.


"Willy Denoyette [MVP]" <willy.denoyette@xxxxxxxxxx> wrote in message
news:OxCE$AqmGHA.4536@xxxxxxxxxxxxxxxxxxxxxxx
Yes, but why do you want your service to write to this key?
Only Administrators (and localsystem) are allowed to write to HKLM and
descendants, Service accounts are not supposed to write to HKLM. If you
really need your service to write to HKLM, you need to run as
"localsystem".
Again if you grant a non privileged account write access to HKLM, you
severely compromise your system's security.

Willy.

"Tim Van Wassenhove" <timvw@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:uuAwDNpmGHA.4992@xxxxxxxxxxxxxxxxxxxxxxx
| On 2006-06-28, Willy Denoyette [MVP] <willy.denoyette@xxxxxxxxxx> wrote:
| >
| > "Tim Van Wassenhove" <timvw@xxxxxxxxxxxxxxxxxxxxx> wrote in message
| > news:e8Jsf8lmGHA.2280@xxxxxxxxxxxxxxxxxxxxxxx
| >| On 2006-06-27, pisquem@xxxxxxxxxxx <pisquem@xxxxxxxxxxx> wrote:
| >| > I am building an windows service that is to be deployed on a
windows
| >| > server 2003 and I want to have activity written to the event log, I
| >| > want its own log called ('CustomLog')
| >| >
| >| > Below is what I have so far...its builds fine but when I go to
start
| >| > the service i get the following error.
| >|
| >| When i tried that (on a default windows 2003 installation) i
experienced
| >| a problem with access rights. If i remember well, i had to give the
| >| 'network' user access rights to the registry keys..
| >|
| >
| > What registry key's?
|
| HKLM/System/CurrentControlSet/Services/Eventlog (or one of it's
| children).
|
|
| --
| Met vriendelijke groeten,
| Tim Van Wassenhove <http://timvw.madoka.be>




.

Relevant Pages

  • Re: Windows Service - Event Log
    ... writing to the registry (HKLM). ... | Services write to Event Logs all the time, and run under a variety of user ... | That said, by default, members of the Administrators group and the Local ... | the Local System Account, and an account other than the Administrators ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Windows Service - Event Log
    ... writing to the registry (HKLM). ... | Services write to Event Logs all the time, and run under a variety of user ... | That said, by default, members of the Administrators group and the Local ... | the Local System Account, and an account other than the Administrators ...
    (microsoft.public.dotnet.languages.csharp)
  • RE: Account Lockout (Event ID: 539) Alert message
    ... >Subject: Account Lockout Alert message ... >SBS box with a subject just like the subject of this post. ... > For more information about this event, see the event logs on the server ... >Logon Failure: ...
    (microsoft.public.windows.server.sbs)
  • Re: Services will not start, Unable to open event logs
    ... "timely fashion" error applies to services such as the server service. ... RPC service gives the error that the service is either disabled or has no ... Although there are some event logs in the event viewer I am unable to open ... unable to try things such as changing the log on account. ...
    (microsoft.public.windows.server.general)
  • Re: XP - Fast User Switching - NOT WORKING
    ... Clear the Event logs, and do a reboot. ... account, and then back to your account. ... Microsoft MVP [Windows XP Shell/User] ... an application or service was still using the registry during log off. ...
    (microsoft.public.windowsxp.help_and_support)