How to Configure Least-Privilege Windows Event Log Access
Summary
A practical guide to granting read and export access to Windows event logs without local admin rights, checking channel permissions, enabling remote access, and troubleshooting common access and forwarding issues.
Key points
- The Event Log Readers group provides read access to most logs without local administrator rights; group membership takes effect after signing out and back in.
- Use wevtutil gl <log> to inspect channelAccess permissions; some channels have custom permissions.
- Use Group Policy to add a domain group to Event Log Readers across machines; the article notes that the built-in group is domain-wide on domain controllers.
- Remote Event Viewer, wevtutil /r, and Get-WinEvent use RPC and require the Remote Event Log Management firewall rules; PowerShell remoting uses WinRM.
- For Windows Event Forwarding to deliver Security events, add NETWORK SERVICE to Event Log Readers on source machines.
- Export permissions do not grant write access to the destination folder; the guide also advises treating EVTX uploads as raw files because LogTotal does not sanitize them.
Article Details
- Defense Focus
- Enable least-privilege access to Windows event logs for analysts, collectors, and incident-response partners, including remote access and Security-log forwarding.
- Detection Methods
- Check a channel's access control settings with `wevtutil gl <log>` and inspect the `channelAccess` SDDL for Event Log Readers read permission.
- When access is denied, verify that the session is elevated if using administrator rights, that group membership has taken effect after a new sign-in, and that the channel does not have custom permissions.
- For remote log access failures, check whether the Remote Event Log Management firewall rules are enabled on the target.
- If Windows Event Forwarding omits Security events, check whether NETWORK SERVICE belongs to Event Log Readers on the source machines.
- Data Sources
- Windows event logs, including the Security log
- Event-channel access settings (`channelAccess` SDDL)
- Windows Event Forwarding subscriptions and delivered events
- Remote event log access and firewall-rule status
- Platforms
- Windows
- Defensive Actions
- Grant read access through Event Log Readers rather than making analysts or collectors local administrators.
- Use Group Policy to add an appropriate domain group to Event Log Readers across machines; on domain controllers, the article says the built-in group is domain-wide.
- For Security-log forwarding, add NETWORK SERVICE to Event Log Readers on source machines.
- Enable the Remote Event Log Management firewall rule group on targets when remote access over RPC is required.
- Use `wevtutil gl <log>` to verify channel permissions; prefer group membership over directly changing a channel's SDDL.
- Export logs to a folder where the user has write access.
- Treat EVTX uploads as transfers of raw files; convert to JSON first if that is preferred.