antmar904 Posted March 27, 2018 Share Posted March 27, 2018 Has anyone be able to successfully write to the "Security" event log in Windows 10? The example from the help file doesn't seem to work on my Windows 10 Pro box. Link to comment Share on other sites More sharing options...
BrewManNH Posted March 27, 2018 Share Posted March 27, 2018 Have you tried running the script with #RequireAdmin? The security log is access protected. If I posted any code, assume that code was written using the latest release version unless stated otherwise. Also, if it doesn't work on XP I can't help with that because I don't have access to XP, and I'm not going to.Give a programmer the correct code and he can do his work for a day. Teach a programmer to debug and he can do his work for a lifetime - by Chirag GudeHow to ask questions the smart way! I hereby grant any person the right to use any code I post, that I am the original author of, on the autoitscript.com forums, unless I've specifically stated otherwise in the code or the thread post. If you do use my code all I ask, as a courtesy, is to make note of where you got it from. Back up and restore Windows user files _Array.au3 - Modified array functions that include support for 2D arrays. - ColorChooser - An add-on for SciTE that pops up a color dialog so you can select and paste a color code into a script. - Customizable Splashscreen GUI w/Progress Bar - Create a custom "splash screen" GUI with a progress bar and custom label. - _FileGetProperty - Retrieve the properties of a file - SciTE Toolbar - A toolbar demo for use with the SciTE editor - GUIRegisterMsg demo - Demo script to show how to use the Windows messages to interact with controls and your GUI. - Latin Square password generator Link to comment Share on other sites More sharing options...
antmar904 Posted March 27, 2018 Author Share Posted March 27, 2018 Just now, BrewManNH said: Have you tried running the script with #RequireAdmin? The security log is access protected. Yes I have. I can write to all other logs (Applicaiton, System) but now Security. Link to comment Share on other sites More sharing options...
Moderators JLogan3o13 Posted March 27, 2018 Moderators Share Posted March 27, 2018 How about posting your code that isn't working, rather than us guessing? "Profanity is the last vestige of the feeble mind. For the man who cannot express himself forcibly through intellect must do so through shock and awe" - Spencer W. Kimball How to get your question answered on this forum! Link to comment Share on other sites More sharing options...
antmar904 Posted March 27, 2018 Author Share Posted March 27, 2018 Just now, JLogan3o13 said: How about posting your code that isn't working, rather than us guessing? As stated in my first post I was just using the example code from the help file just changing the Event Log to "Security". I do not get any errors in SciTE. #RequireAdmin #include <EventLog.au3> Example() Func Example() Local $hEventLog, $aData[4] = [3, 1, 2, 3] $hEventLog = _EventLog__Open("", "Security") _EventLog__Report($hEventLog, 4, 0, 2, "Administrator", "AutoIt3 generated event", $aData) _EventLog__Close($hEventLog) EndFunc ;==>Example Link to comment Share on other sites More sharing options...
Moderators JLogan3o13 Posted March 27, 2018 Moderators Share Posted March 27, 2018 14 minutes ago, antmar904 said: As stated in my first post I was just using the example code from the help file just changing the Event Log to "Security". I saw, but you have been around long enough to know as well as I how people modify or fail to copy the example correctly; always better to see what you're using. To the issue at hand, the Security log is locked down tighter than the Application log by design in current OS's; MS does not want this being written to by just any application out there. On the few occasions where I have had to do this I usually resort to PowerShell (which you can run from AutoIt if part of a larger script). Look at Write-EventLog. In order to write to the Security log, however, you will need to create a new source in the registry; this can be done with New-EventLog. Earthshine 1 "Profanity is the last vestige of the feeble mind. For the man who cannot express himself forcibly through intellect must do so through shock and awe" - Spencer W. Kimball How to get your question answered on this forum! Link to comment Share on other sites More sharing options...
Bilgus Posted March 27, 2018 Share Posted March 27, 2018 Did you read the helpfile for that very example? https://www.autoitscript.com/autoit3/docs/libfunctions/_EventLog__Report.htm Quote $hEventLog A handle to the event log. As of Windows XP SP2, this cannot be a handle to the Security log. BrewManNH 1 Link to comment Share on other sites More sharing options...
antmar904 Posted March 28, 2018 Author Share Posted March 28, 2018 15 hours ago, JLogan3o13 said: I saw, but you have been around long enough to know as well as I how people modify or fail to copy the example correctly; always better to see what you're using. To the issue at hand, the Security log is locked down tighter than the Application log by design in current OS's; MS does not want this being written to by just any application out there. On the few occasions where I have had to do this I usually resort to PowerShell (which you can run from AutoIt if part of a larger script). Look at Write-EventLog. In order to write to the Security log, however, you will need to create a new source in the registry; this can be done with New-EventLog. bummer, I am testing out our SIEM and can only use the Security event logs. Thanks again. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now