accessing eventlogs on remote machine fails using system.management apis

microsoft.public.dotnet.framework

7 Dec 2006 12:06 PM

aseembansal

Hi,

I want to know what permissions do you require to query event logs
(using system.management APIs) lying on a remote computer.

I created a small sample to query event logs, but I get the following
error.

Unhandled Exception: System.UnauthorizedAccessException: Access is
denied.
(Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
errorCode, IntPtr errorInfo)
   at System.Management.ManagementScope.InitializeGuts(Object o)
   at System.Management.ManagementScope.Initialize()
   at System.Management.ManagementObjectSearcher.Initialize()
   at System.Management.ManagementObjectSearcher.Get()

Here are the details of my environment and the various options I tried.

1. Local as well remote computer are windows server 2003 with SP1.
2. Using EventViewer to view the event logs on remote computer shows an
error message box saying "Unable to complete the operation on
"Application". Access is denied.
3. Added my self in the Administrators group of that computer and it
worked. But I want to find out the minimum permissions required to
access the event logs from remote computer. So this is not an exciting
option unless and until this is the only option we have. So I removed
myself from administrators group.
4. Added 'FullControl' permission for myself on all the .evt files. But
observed the same above mentioned error.
5. Added myself to the security group on Root\cimv2 in 'WMI Control'
and
allowed everything, still it did not work.
6. Added myself to "Manage Auditing and Security Log" in local
policies\User Rights Assignment, still it did not work.

Can you please let me know whether it is possible to query event logs
remotely without being part of Administrators group. If yes, what all
permissions are required?

Regards
Aseem Bansal