Skip to content

Instantly share code, notes, and snippets.

@R41D3NN
Created March 30, 2017 16:58
Show Gist options
  • Select an option

  • Save R41D3NN/a7ec468ae76b04e7f488a38eac3f92eb to your computer and use it in GitHub Desktop.

Select an option

Save R41D3NN/a7ec468ae76b04e7f488a38eac3f92eb to your computer and use it in GitHub Desktop.
Very simple script to apply permissions to Windows Event Log.
$username = "IIS APPPOOL\Identity"
Function Set-PermissionsForEventLogSecurity($username)
{
$registryKeyPath = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security"
$acl = Get-Acl $registryKeyPath
$inherit = [System.Security.AccessControl.InheritanceFlags]"ContainerInherit, ObjectInherit"
$propagation = [System.Security.AccessControl.PropagationFlags]"None"
$registryRights = [System.Security.AccessControl.RegistryRights]"QueryValue",
[System.Security.AccessControl.RegistryRights]"EnumerateSubKeys",
[System.Security.AccessControl.RegistryRights]"Notify",
[System.Security.AccessControl.RegistryRights]"ReadPermissions"
$registryAccessRule = New-Object System.Security.AccessControl.RegistryAccessRule($username, $registryRights, $inherit, $propagation, "Allow")
$acl.AddAccessRule($registryAccessRule)
$acl | Set-Acl -Path $registryKeyPath
}
Function Set-PermissionsForEventLog($username)
{
$registryKeyPath = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog"
$acl = Get-Acl $registryKeyPath
$inherit = [System.Security.AccessControl.InheritanceFlags]"ContainerInherit, ObjectInherit"
$propagation = [System.Security.AccessControl.PropagationFlags]"None"
$registryRights = [System.Security.AccessControl.RegistryRights]"QueryValue",
[System.Security.AccessControl.RegistryRights]"EnumerateSubKeys",
[System.Security.AccessControl.RegistryRights]"Notify",
[System.Security.AccessControl.RegistryRights]"ReadPermissions",
[System.Security.AccessControl.RegistryRights]"SetValue",
[System.Security.AccessControl.RegistryRights]"CreateSubKey"
$registryAccessRule = New-Object System.Security.AccessControl.RegistryAccessRule($username, $registryRights, $inherit, $propagation, "Allow")
$acl.AddAccessRule($registryAccessRule)
$acl | Set-Acl -Path $registryKeyPath
}
Set-PermissionsForEventLog($username)
Set-PermissionsForEventLogSecurity($username)5
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment