Re: How to write Events into the security log

From: Joe Richards [MVP] (humorexpress_at_hotmail.com)
Date: 05/31/05


Date: Mon, 30 May 2005 20:57:10 -0400

I posted a bad link previously, I meant

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/reportevent.asp

It indicates that for XPSP2 you need to use something else

As of Windows XP SP2, this parameter cannot be a handle to the Security log. To
write an event to the Security log, use the AuthzReportSecurityEvent function.

Before this, you have to make sure you enable the appropriate privilege - off
the top of my head I believe it was SeSecurityPrivilege.

There are no other mechanisms to write to the event logs.

   joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net
Sudheer N wrote:
> I tried already using Registereventsource() and Reportevent() functions given 
> in the MSDN. The Registereventsource() function not returning the handle of 
> securitylog. It is giving error codes 5 and 6. It is not possible to write in 
> the securitylog eventthough i am having administrator privileges. I want to 
> write events into the securitylog for local and remote systems. I am using 
> the windowsxp. I know the functions which works only in Winnt systems.Those 
> are authzregistersecurityeventsource() and authzreportsecurityevent(). I want 
> any other way to write events into the security log. Because i must write 
> events into the security log of local and remote systems. Please help me.
> 
> "Joe Richards [MVP]" wrote:
> 
> 
>>http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/reporting_an_event.asp
>>
>>--
>>Joe Richards Microsoft MVP Windows Server Directory Services
>>www.joeware.net
>>
>>
>>Sudheer N wrote:
>>
>>>Hi,
>>>     I am Sudheer. I am a Software Engineer - Newly Joined.This is my first 
>>>post.  How to write events into the security log. It is not possible to write 
>>>events into the security log for local system having administrator 
>>>privileges. Please help me in this issue how to write security events into 
>>>the security log for remote and local systems. Please help me. 
>>>
>>


Relevant Pages

  • Re: Event Viewer Security log Access denied
    ... 2004 Windows MVP "Winny" Award ... > computer regarding the Security log in Event Viewer. ... > This occurred even if I logged on with the local administrator account. ...
    (microsoft.public.windowsxp.general)
  • Re: Event Viewer Security log Access denied
    ... 2004 Windows MVP "Winny" Award ... > computer regarding the Security log in Event Viewer. ... > This occurred even if I logged on with the local administrator account. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: administrator sign on
    ... I dont' think Windows audits this by default. ... Event log in the Security log, in the Computer Management MMC. ... also audit success of, say, logon events, and probably also system events, ...
    (microsoft.public.security)
  • Re: Audit the administrator account?
    ... In a Windows NT domain, the security log of the PDC can be configured to ... "Audit these events" and turn on auditing for "User and Group Management"... ... Event Log for the PDC for event ID 628. ...
    (microsoft.public.win2000.security)
  • Re: ? Delete/Remove Specific Entries From The Event Viewer Log
    ... Maybe you should be archiving the logs. ... .txt and .csv will not retain the binary data for each ... log on to a computer that is running Windows XP or Windows ... How To Prevent Auditable Activities When Security Log Is Full ...
    (microsoft.public.windowsxp.configuration_manage)