Write to Security Event Log in Windows 10

[antmar904]

Has anyone be able to successfully write to the "Security" event log in Windows 10?

The example from the help file doesn't seem to work on my Windows 10 Pro box.

[BrewManNH]

Have you tried running the script with #RequireAdmin? The security log is access protected.

[antmar904]

Just now, BrewManNH said:

Have you tried running the script with #RequireAdmin? The security log is access protected.

Yes I have.  I can write to all other logs (Applicaiton, System) but now Security.

[JLogan3o13]

How about posting your code that isn't working, rather than us guessing?

[antmar904]

Just now, JLogan3o13 said:

How about posting your code that isn't working, rather than us guessing?

As stated in my first post I was just using the example code from the help file just changing the Event Log to "Security".

I do not get any errors in SciTE.

 

#RequireAdmin
#include <EventLog.au3>

Example()

Func Example()
    Local $hEventLog, $aData[4] = [3, 1, 2, 3]

    $hEventLog = _EventLog__Open("", "Security")
    _EventLog__Report($hEventLog, 4, 0, 2, "Administrator", "AutoIt3 generated event", $aData)
    _EventLog__Close($hEventLog)
EndFunc   ;==>Example

 

[JLogan3o13]

14 minutes ago, antmar904 said:

As stated in my first post I was just using the example code from the help file just changing the Event Log to "Security".

I saw, but you have been around long enough to know as well as I how people modify or fail to copy the example correctly; always better to see what you're using.  

To the issue at hand, the Security log is locked down tighter than the Application log by design in current OS's; MS does not want this being written to by just any application out there. On the few occasions where I have had to do this I usually resort to PowerShell (which you can run from AutoIt if part of a larger script). Look at Write-EventLog. In order to write to the Security log, however, you will need to create a new source in the registry; this can be done with New-EventLog.

 

[Bilgus]

Did you read the helpfile for that very example?

https://www.autoitscript.com/autoit3/docs/libfunctions/_EventLog__Report.htm

Quote

$hEventLog

A handle to the event log. As of Windows XP SP2, this cannot be a handle to the Security log.

 

[antmar904]

15 hours ago, JLogan3o13 said:

I saw, but you have been around long enough to know as well as I how people modify or fail to copy the example correctly; always better to see what you're using.  

To the issue at hand, the Security log is locked down tighter than the Application log by design in current OS's; MS does not want this being written to by just any application out there. On the few occasions where I have had to do this I usually resort to PowerShell (which you can run from AutoIt if part of a larger script). Look at Write-EventLog. In order to write to the Security log, however, you will need to create a new source in the registry; this can be done with New-EventLog.

 

bummer, I am testing out our SIEM and can only use the Security event logs.  Thanks again.