Re: IIS 6 Write to the Event Log

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 03/26/05

  • Next message: Steven Burn: "Re: Block sites linking to my site"
    Date: Sat, 26 Mar 2005 01:07:32 -0800
    
    

    Actually, this is not an IIS issue. The NT Event Log got locked down, so you
    will have to give the appropriate user identity access. It depends on the
    application framework you use -- by default, IIS applications use the
    impersonated remote identity. ASP.Net uses the process identity unless
    configured to impersonate. Other applications/frameworks may have different
    rules, so you'll have to read documentation or figure it out somehow.

    Regarding the NT Event Log Lockdown (and many other security changes on
    Windows Server 2003, non-exhaustive):
    http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncode/html/secure06122003.asp

    -- 
    //David
    IIS
    http://blogs.msdn.com/David.Wang
    This posting is provided "AS IS" with no warranties, and confers no rights.
    //
    "JT" <jtaylor1024@gmail.com> wrote in message
    news:1111771915.605929.127880@f14g2000cwb.googlegroups.com...
    I have an anonymous access web service that is running as
    IUSR_machineName.  This application is set up in IIS 6 running in an
    application pool under the network service account.  I understand that
    this network service account is low privledged.
    My question is: What do I have to do to change the network service
    account to allow my application to write to the nt event log?  I have
    allowed network service full control on the event log registry keys and
    sub keys but it still isn't writing.  I get an error saying can't open
    event log for source (0).
    One interesting thing though is that I have custom soap extensions and
    they can write to the log fine.  However, once it gets into the
    webservice methods I cannot write to the log anymore.  This is the same
    dll, same class and the event log source is already present.
    

  • Next message: Steven Burn: "Re: Block sites linking to my site"

    Relevant Pages

    • Re: Process serving application pool terminated unexpectedly
      ... Running it on w3wp might be more interesting, but this server has ... > IIS Crash/Hang Agent is not the same thing as IIS State. ... > When you are dealing with a crash, ... > These exceptions correlate in number and time with warnings in Event log. ...
      (microsoft.public.inetserver.iis)
    • iis 6 exception issue
      ... We have a customer who is experiencing several issues after migrating their ... make sense due to the security changes in iis 6 compared to 5. ... the domain service account, ... No errors are reported in the event log when an 'empty' executable is called ...
      (microsoft.public.inetserver.iis.security)
    • Re: How to restart OWA
      ... restart it-self). ... No where in the event log ID i see an error for IIS or OWA ... Then I get 1001 IMC is stopping followed by 1004 IMC is ...
      (microsoft.public.exchange.admin)
    • Re: IIS/SQL Crashing
      ... > Based on event log, there is probably a fatal error in your application ... > user-mode debug of the worker process memory space at the time of the ... >> time it seems that the IIS stop communicating with the SQL server. ... >> Robert Abela ...
      (microsoft.public.inetserver.iis.security)
    • Re: Process serving application pool terminated unexpectedly
      ... I'm running IIS Crash & Hang Agent on that box right now. ... These exceptions correlate in number and time with warnings in Event log. ... > sometimes on more than one pool (each domain has its own application ...
      (microsoft.public.inetserver.iis)