Tjyylli

I'm running Windows Server 2012 R2 and under that I'm running VMWare Workstation Pro. When Workstation is installed, the user Group __vmware__ is created for VMWare Workstation users. I've added my host machine (i.e. Windows Server 2012 R2) user account (a member of Users, not a member of Administrators) to the __vmware__ Group.

On the host I'd like to create event log entries in the Application event log while running as my user account related to the state of the virtual machines running under VMWare.

From a command window on the host, I type whoami all and get the following:

USER INFORMATION

----------------



User Name SID

========= ==============================================

mtemike  S-1-5-21-1052476717-3500785571-2838594007-1118





GROUP INFORMATION

-----------------



Group Name                                 Type             SID

                           Attributes



========================================== ================ ====================

========================== =====================================================

==========

Everyone                                   Well-known group S-1-1-0

                           Mandatory group, Enabled by default, Enabled group



BUILTINUsers                              Alias            S-1-5-32-545

                           Mandatory group, Enabled by default, Enabled group



BUILTINCertificate Service DCOM Access    Alias            S-1-5-32-574

                           Mandatory group, Enabled by default, Enabled group



BUILTINPre-Windows 2000 Compatible Access Alias            S-1-5-32-554

                           Group used for deny only



NT AUTHORITYINTERACTIVE                   Well-known group S-1-5-4

                           Mandatory group, Enabled by default, Enabled group



CONSOLE LOGON                              Well-known group S-1-2-1

                           Mandatory group, Enabled by default, Enabled group



NT AUTHORITYAuthenticated Users           Well-known group S-1-5-11

                           Mandatory group, Enabled by default, Enabled group



NT AUTHORITYThis Organization             Well-known group S-1-5-15

                           Mandatory group, Enabled by default, Enabled group



LOCAL                                      Well-known group S-1-2-0

                           Mandatory group, Enabled by default, Enabled group



Authentication authority asserted identity Well-known group S-1-18-1

                           Mandatory group, Enabled by default, Enabled group



MTE__vmware__                             Alias            S-1-5-21-1052476717-

3500785571-2838594007-1131 Mandatory group, Enabled by default, Enabled group, L

ocal Group

Mandatory LabelMedium Mandatory Level     Label            S-1-16-8192









PRIVILEGES INFORMATION

----------------------



Privilege Name                Description                    State

============================= ============================== ========

SeChangeNotifyPrivilege       Bypass traverse checking       Enabled

SeIncreaseWorkingSetPrivilege Increase a process working set Disabled





USER CLAIMS INFORMATION

-----------------------



User claims unknown.



Kerberos support for Dynamic Access Control on this device has been disabled.

Note that my user account is a member of __vmware__ and the the SID is S-1-5-21-1052476717-3500785571-2838594007-1131.

From an Administrator account, I edit the following registry key:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventLogApplication

And modify the CustomSD entry as follows:

O:BAG:SYD:(A;;0x3;;;S-1-5-21-1052476717-3500785571-2838594007-1131)(A;;0x2;;;S-1-15-2-1)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)

Here you can see that the __vmware__ Group has been granted Read and Write access to the Application event log.

Yet, when I attempt to create a log entry:

eventcreate /SO TestEventMsg /Id 1 /D "This is a test message" /T INFORMATION /L Application

I get an Access denied error.

What am I not doing correctly?

UPDATE 2016-12-03

I tried the user2304170's suggestion and this is what I got:

PS C:UsersNetadminDocuments> ./GrantEventLogAccess.ps1 -Account '__vmware__' -LogName Application

Failed to save configuration or activate log Application. Access is denied.

name: Application

enabled: true

type: Admin

owningPublisher:

isolation: Application

channelAccess: O:BAG:SYD:(A;;0x3;;;S-1-5-21-1052476717-3500785571-2838594007-1131)(A;;0x2;;;S-1-15-2-1)(A;;0xf0007;;;SY)

(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)

logging:

  logFileName: %SystemRoot%System32WinevtLogsApplication.evtx

  retention: false

  autoBackup: false

  maxSize: 20971520

publishing:

  fileMax: 1

PS C:UsersNetadminDocuments>

Puzzling stuff together on the internet I've created this little script for it:

<# 

    .SYNOPSIS   

        Add write permissions to the Windows Event Log for a specific AD object.



    .DESCRIPTION

        Add write permissions to the Windows Event Log for a specific AD object.



    .PARAMETER Account 

        Active directory object that needs write permissions.



    .PARAMETER LogName 

        Name of the log where we grant permissions



    .EXAMPLE

        ./script.ps! -Account 'Domain users' -LogName Application



    .NOTES

        CHANGELOG

        2016/09/12 Script born #>



Param (

    [String]$Account = 'Bob',

    [String]$LogName = 'Application'

)



Write-Verbose "Retrieving SID for account '$Account'"



$AdObj = New-Object System.Security.Principal.NTAccount($Account)

$SID = $AdObj.Translate([System.Security.Principal.SecurityIdentifier])

Write-Verbose "Found SID for account $($SID.Value)" 



$w = wevtutil gl $LogName

$channelAccess = $w[5]



if ($channelAccess.Contains('channelAccess:')) {



    $str = $channelAccess.Replace('channelAccess: ','')



    if ($str.Contains($SID.Value) -eq $false) {

        $newstr = $str +"(A;;0x3;;;"+$SID.Value+")"

        Write-Verbose "Adding '$newstr'" 

        wevtutil sl $LogName /ca:$newstr

        Write-Verbose "Update complete new value is"

        wevtutil gl $LogName

    }

    else {

        Write-Verbose "Update not needed"

    }

}

I haven't tested this in full but if you go to this registry key:

HKEY_LOCAL_MACHINESystemCurrentControlSetServicesEventlog

You can right-click on the Eventlog folder and give permissions to the user you want to allow access or you can choose the Event log.