Re: IIS 6.0 COM App cant write to event log

From: Robb Murdock (rmurdock_at_luxortech.com)
Date: 10/30/03


Date: Wed, 29 Oct 2003 21:55:31 -0800

John:

Thanks for the heads-up.

I saw that article; but it's absoutely Greek to me. I
don't get the whole SDDL thing.

Any guidance on how to set this would be awesome.

Thanks,

Robb Murdock
rmurdock@luxortech.com

>-----Original Message-----
>Robb,
>
>Have a look at the CustomSD attribute for the Application
Event Log. This
>should allow you to modify the default Security
Descriptor applied for
>access to the individual default Event Logs. See this KB
for more info:
>
>http://support.microsoft.com/default.aspx?scid=kb;en-
us;323076
>
>Note I have not tried to modify this as yet but it's on
my short list of
>things to do to document how our app developers can
continue to log to the
>Event Log. If you are still having issues, drop me a
note and I'll try to
>follow up with you when I do test.
>
>John Alderson
>
>"Robb Murdock" <rmurdock@luxortech.com> wrote in message
>news:075401c39dcd$940c81d0$a401280a@phx.gbl...
>> Wei-Dong:
>>
>> I am not sure what you are suggesting here. The event
log
>> is used for more than just system administrators. If I
>> write a simple VB test app that uses App.LogEvent, I can
>> log in as the user that I am assigning to IIS and log an
>> event entry.
>>
>> The issue is that IIS, using the same login account
can't
>> write to the event log in IIS 6.0/Win2003 Server Web
>> Edition.
>>
>> All of this works fine on IIS 5.0/Win2K.
>>
>> Am I at a dead end; or is there somewhere else I can
look ?
>>
>> Thanks,
>>
>> Robb Murdock
>>
>>
>> >-----Original Message-----
>> >Hi Robb,
>> >
>> >Thank you for replying!
>> >
>> >In fact, event log is used for the system administrator
>> to maintain the box so that from your test, only the
>> administrators account group can write to
>> >event log. For more information about the right and
>> privilege for event logging, I'd suggest you can find
>> detailed event log security informaton from
>> >the article from Msdn.microsoft.com. Please go to:
>> >http://msdn.microsoft.com/library/en-
>> us/debug/base/event_logging_security.asp?frame=true
>> >
>> >Please feel free to let me know if you have any further
>> questions.
>> >
>> >Does this answer your question? Thank you for using
>> Microsoft NewsGroup!
>> >
>> >Wei-Dong Xu
>> >Microsoft Product Support Services
>> >Get Secure! - www.microsoft.com/security
>> >This posting is provided "AS IS" with no warranties,
and
>> confers no rights.
>> >
>> >
>> >.
>> >
>
>.
>



Relevant Pages

  • Re: Process serving application pool terminated unexpectedly
    ... Running it on w3wp might be more interesting, but this server has ... > IIS Crash/Hang Agent is not the same thing as IIS State. ... > When you are dealing with a crash, ... > These exceptions correlate in number and time with warnings in Event log. ...
    (microsoft.public.inetserver.iis)
  • iis 6 exception issue
    ... We have a customer who is experiencing several issues after migrating their ... make sense due to the security changes in iis 6 compared to 5. ... the domain service account, ... No errors are reported in the event log when an 'empty' executable is called ...
    (microsoft.public.inetserver.iis.security)
  • Re: How to restart OWA
    ... restart it-self). ... No where in the event log ID i see an error for IIS or OWA ... Then I get 1001 IMC is stopping followed by 1004 IMC is ...
    (microsoft.public.exchange.admin)
  • Re: IIS/SQL Crashing
    ... > Based on event log, there is probably a fatal error in your application ... > user-mode debug of the worker process memory space at the time of the ... >> time it seems that the IIS stop communicating with the SQL server. ... >> Robert Abela ...
    (microsoft.public.inetserver.iis.security)
  • Re: Process serving application pool terminated unexpectedly
    ... I'm running IIS Crash & Hang Agent on that box right now. ... These exceptions correlate in number and time with warnings in Event log. ... > sometimes on more than one pool (each domain has its own application ...
    (microsoft.public.inetserver.iis)

Quantcast