Accessing eventlogs remotely on W2K3 Server

dwr3ck_at_hushmail.com
Date: 12/30/03

  • Next message: Nick Duda: "RE: Disabling Cached Logon Credentials" 
    Date: Tue, 30 Dec 2003 10:50:43 -0800
To: focus-ms@securityfocus.com

    In shared web environments it is necessary to enable application owners
    to view the event logs on the IIS servers hosting their applications
    (minus the security log).

    This is easy to do in W2K server by having them use the run as command
    with the event viewer MMC from their machines with an account that has
    user privileges on the server (that DOES NOT have log on locally access
    etc).

    I have found one reference on the MS web site that indicates that you
    must be a local admin on the server to view event logs remotely.

    Has anyone else run into this? I need to provide real-time access but
    I cannot give the application owners local admin accounts. Also, enabling
    guest access to the logs is not an option.

    Concerned about your privacy? Follow this link to get
    FREE encrypted email: https://www.hushmail.com/?l=2

    Free, ultra-private instant messaging with Hush Messenger
    https://www.hushmail.com/services.php?subloc=messenger&l=434

    Promote security and make money with the Hushmail Affiliate Program:
    https://www.hushmail.com/about.php?subloc=affiliate&l=427

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Nick Duda: "RE: Disabling Cached Logon Credentials"

    Relevant Pages

    • Re: Problem in Exchange, not many info in logs, please help!
      ... Clear the event logs on the server and connect with a client that has the ... Default Offline Address List ...
      (microsoft.public.windows.server.sbs)
    • Re: GPO causing client security logs to fill?
      ... they receive an error indicating that "the security log is full and only ... It appears that the two most problematic computers are those that are ... and the other is a server for our accounting program. ... All event logs should be set to a decent size (about 20MB at minimum, ...
      (microsoft.public.windows.server.sbs)
    • Re: GPO causing client security logs to fill?
      ... Settings/Security Settings/Event Log/Maximum Security Log Size was not set ... It appears that the two most problematic computers are those that are ... and the other is a server for our accounting program. ... All event logs should be set to a decent size (about 20MB at minimum, ...
      (microsoft.public.windows.server.sbs)
    • RE: Accessing eventlogs remotely on W2K3 Server
      ... yes that really rocks - kiwisyslog is what you can use with ntsyslog for sending the logging info - all can be on windows and there is a free version that you can download and evulate ... We addressed this by configuring all of our event logs to log to a remote syslog server. ...
      (Focus-Microsoft)
    • Re: SBS2000 X225 Server
      ... Have you checked the Workstation event logs? ... Independent Experts (MVPs do not work for MS) ... And the server starts ...
      (microsoft.public.backoffice.smallbiz2000)