Comments on: Writing to the Event Log from ASP.NET fails when running on Windows Server 2003 SP1

By: Peter Lewis

Peter Lewis — Fri, 09 Sep 2011 03:51:47 +0000

Hi, thanks for the very useful info. It’s new and news to me. One question: is a reboot needed after making the changes? I have made a change on a production server but it doesn’t seem to have effect. I can’t tell whether there’s an error in my change or whether the change is not taking effect yet.

Thanks.

By: www.google.com/accounts/o8/id?id=AItOawlScACVByeO5VTSN4zqUYfyJvA8ACOF-Ao

www.google.com/accounts/o8/id?id=AItOawlScACVByeO5VTSN4zqUYfyJvA8ACOF-Ao — Sat, 06 Feb 2010 07:27:48 +0000

Hi Friends,
I am new here and really enjoyed this article.
I got lots of information from here, and do keep us update.
With some more stuffs.

By: rickybadboy.blogspot.com

rickybadboy.blogspot.com — Sun, 20 Dec 2009 12:15:32 +0000

One addition for us was to set the .net impersonation=false in the webservice web.config before it could write to the log.

By: Arto Kainu

Arto Kainu — Wed, 16 Dec 2009 06:59:17 +0000

Hi James,
I just found your article because of having this kind of difficulties on Windows X P(SP3). I tried to find out the registry key but there’s no such key. So Win XP doesn’t have this at all? But still I’m not able to write to the event log from my asp.net application. Any ideas why is that?

– Arto

By: GR

GR — Mon, 27 Oct 2008 15:09:52 +0000

James,
Thanks for this posting it describes the issue & resolution clearly.
When I follow the steps for "(A;;0×3;;;AU)" it works fine. However I get an error when I use "(A;;0×3;;;NS)" which is a problem as our application (MOSS 2007) is running under the Network Service.

Any ideas why?
Thanks

By: Sherry

Sherry — Tue, 16 Oct 2007 20:32:53 +0000

Thanks so much for this useful post!!! It resolved my problem immediately… I’ve been scouring the net all week for a solution.

By: James Kovacs

James Kovacs — Mon, 28 May 2007 18:52:21 +0000

That’s correct, Stan. If you have impersonate="true" in web.config and anonymous enabled in IIS, the incoming user will be IUSR_. If possible, I would set impersonate="false" in this scenario, which would then cause writes to the event log under the Network Service. If that’s not possible, I would probably remove IUSR_ from the Guests group as I wouldn’t want to give the Guests group permission to write to the event log. Removing IUSR_ from Guests just means that ACLs applied to Guests no longer apply to IUSR_. You can always explicitly add those ACLs to IUSR_.

By: Stan Chu

Stan Chu — Tue, 22 May 2007 22:24:24 +0000

We’ve had the same problem and we have impersonation=true in our web.config.

The account that the application runs under is the IUSR_ account. This account by default belongs to the Guests group. The Guests group (as per the CustomSD setting) is denied access to access the eventlog. Figuring this out finally fixed the problem.

However, a question comes to mind. Is it better to change the permissions for the Built-in Guests group in CustomSD (to give the group access) or should we remove this IUSR_ account from the Guests group? I’m thinking the first one would better as the second would open up the IUSR_ account.

By: James Kovacs

James Kovacs — Wed, 07 Mar 2007 21:38:08 +0000

Good point, Steve, regarding turning off impersonation. With impersonation on, you will be writing to the event log as the incoming user. If you need to use impersonation, you could ACL the event log as above except use some group account that application users belong to rather than Network Service.

By: Steve Hall

Steve Hall — Wed, 07 Mar 2007 20:30:17 +0000

Hello James, thanks for the clear post. One addition for us was to set the .net impersonation=false in the webservice web.config before it could write to the log.