locked
Remote Event Viewer access without local administrator RRS feed

  • Question

  • I am trying to give some developers access to read the Application log on our dev W2K8R2 servers. My theory is that they can load their local event viewer and connect to the server remotely. The problem is that they get access denied messages.

    From my research, the only thing I need to do on the remote server is enable Server Manager Remote Management. I have done this and verfied that administrators of the dev server can run Server Manager and Event Viewer against this server remotely. (So the firewall rules are in place) 

    When a developer (without admin rights on the dev server) tries to connect their local event viewer to the remote dev server they get this message:

    Event Viewer cannot open the event log or custom view. Verify that Event Log service is running or query is too long. Access denied (5)

    I hope I have missed some simple permission somewhere.

    To test my theory I opened Local Security Policy on the dev server and gave the developer accounts permission to "Manage auditing and security log". This does work, and the developer is able view the Security logs, but it does not give him access to the Application log.

    Anyone have any suggestions?

    Thanks

    Joel

    Wednesday, August 17, 2011 7:58 PM

Answers

  • Hi,

     

    With Windows Server 2008 target and source in the same domain, please add the domain user (without admin rights) to the "Event Log Readers" group on the target server. Then, from the source server, you can use the standard user credentials to access and read the event logs on the target.

     

    With Windows Server 2008 target and source in workgroup, local user account is used. You need to add the standard local user to the "Event Log Readers" group on the target server. Then, add a local user on source with same name and password as that on the target server. After that, from source server, you can use the standard user credentials to access and read the event logs on the target.

     

    For more information, please refer to the following link:

     

    Giving Non Administrators permission to read Event Logs Windows 2003 and Windows 2008

    http://blogs.technet.com/b/janelewis/archive/2010/04/30/giving-non-administrators-permission-to-read-event-logs-windows-2003-and-windows-2008.aspx

     

    Thanks.

    Nina


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by JBaltrusAZDHS Wednesday, August 24, 2011 10:00 PM
    Tuesday, August 23, 2011 9:01 AM

All replies

  • Hi,

     

    With Windows Server 2008 target and source in the same domain, please add the domain user (without admin rights) to the "Event Log Readers" group on the target server. Then, from the source server, you can use the standard user credentials to access and read the event logs on the target.

     

    With Windows Server 2008 target and source in workgroup, local user account is used. You need to add the standard local user to the "Event Log Readers" group on the target server. Then, add a local user on source with same name and password as that on the target server. After that, from source server, you can use the standard user credentials to access and read the event logs on the target.

     

    For more information, please refer to the following link:

     

    Giving Non Administrators permission to read Event Logs Windows 2003 and Windows 2008

    http://blogs.technet.com/b/janelewis/archive/2010/04/30/giving-non-administrators-permission-to-read-event-logs-windows-2003-and-windows-2008.aspx

     

    Thanks.

    Nina


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by JBaltrusAZDHS Wednesday, August 24, 2011 10:00 PM
    Tuesday, August 23, 2011 9:01 AM
  • Thank you Nina! I knew it had to be something easy that I overlooked.

    Joel

    Wednesday, August 24, 2011 10:00 PM
  • Hi Joel,

     

    Glad to hear that the issue has been resolved. Thanks for your feedback.

     

    Best Regards,

    Nina


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Thursday, August 25, 2011 1:59 AM
  • Hi All,

    I am looking for some script or software, which can be used to get event logs information of remote servers of 2008/2003. Is there any possibility to get such information.

    Best Regards,

    Gill 

    • Proposed as answer by Mike Butler1 Wednesday, August 13, 2014 6:02 PM
    Tuesday, September 17, 2013 11:48 AM
  • Howdy

    I've used LogParser from Microsoft for a few years and it works well for me.

    Wednesday, August 13, 2014 6:04 PM