Example code used to automate the process of auditing event log security descriptors.

EventLogAuditing.ps1

# Run the following from an elevated PowerShell session

# This hashtable will be used to store access rights granted to each group.
$PrincipalGrouping = @{}

# Enumerate all installed event logs
Get-WinEvent -ListLog * | ForEach-Object {
    $LogName = $_.LogName

    # Convert the security descriptor SDDL string to a security descriptor object.
    # Doing so will facilitate reasoning over access rights.
    $SecurityDescriptor = ConvertFrom-SddlString -Sddl ($_.SecurityDescriptor)

    # Enumerate over every "allow" access control entry (ACE)
    foreach ($ACE in ($SecurityDescriptor.RawDescriptor.DiscretionaryAcl | Where-Object { $_.AceQualifier -eq [Security.AccessControl.AceQualifier]::AccessAllowed })) {
        try {
            # Attempt to convert the ACE security identifier (SID) to a human-readable value
            $GroupName = $ACE.SecurityIdentifier.Translate([Security.Principal.NTAccount]).Value
        } catch {
            # Not all SIDs can be translated. Just store the SID string if this is the case.
            $GroupName = $ACE.SecurityIdentifier.Value
        }

        if (-not $PrincipalGrouping.ContainsKey($GroupName)) {
            # If the group name has not been encountered yet, create an empty object to contain all
            # the supported access rights.
            $Permissions = [PSCustomObject] @{
                LogFileRead          = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                LogFileWrite         = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                LogFileClear         = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                LogFileAllAccess     = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                Delete               = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                ReadControl          = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                WriteDAC             = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                WriteOwner           = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                GenericRead          = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                GenericWrite         = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                GenericExecute       = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                GenericAll           = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
                AccessSystemSecurity = (New-Object 'Collections.ObjectModel.Collection`1[System.String]')
            }
        } else {
            # The key for the specific group is already defined
            $Permissions = $PrincipalGrouping[$GroupName]
        }

        $PrincipalGrouping[$GroupName] = $Permissions

        # For each supported access right, if the group was granted access, 
        # add the event log name to the object.
        if (($ACE.AccessMask -band 0x00000001) -eq 0x00000001) { $PrincipalGrouping[$GroupName].LogFileRead.Add($LogName) }
        if (($ACE.AccessMask -band 0x00000002) -eq 0x00000002) { $PrincipalGrouping[$GroupName].LogFileWrite.Add($LogName) }
        if (($ACE.AccessMask -band 0x00000004) -eq 0x00000004) { $PrincipalGrouping[$GroupName].LogFileClear.Add($LogName) }
        if (($ACE.AccessMask -band 0x00000007) -eq 0x00000007) { $PrincipalGrouping[$GroupName].LogFileAllAccess.Add($LogName) }
        if (($ACE.AccessMask -band 0x00010000) -eq 0x00010000) { $PrincipalGrouping[$GroupName].Delete.Add($LogName) }
        if (($ACE.AccessMask -band 0x00020000) -eq 0x00020000) { $PrincipalGrouping[$GroupName].ReadControl.Add($LogName) }
        if (($ACE.AccessMask -band 0x00040000) -eq 0x00040000) { $PrincipalGrouping[$GroupName].WriteDAC.Add($LogName) }
        if (($ACE.AccessMask -band 0x00080000) -eq 0x00080000) { $PrincipalGrouping[$GroupName].WriteOwner.Add($LogName) }
        if (($ACE.AccessMask -band 0x80000000) -eq 0x80000000) { $PrincipalGrouping[$GroupName].GenericRead.Add($LogName) }
        if (($ACE.AccessMask -band 0x40000000) -eq 0x40000000) { $PrincipalGrouping[$GroupName].GenericWrite.Add($LogName) }
        if (($ACE.AccessMask -band 0x20000000) -eq 0x20000000) { $PrincipalGrouping[$GroupName].GenericExecute.Add($LogName) }
        if (($ACE.AccessMask -band 0x10000000) -eq 0x10000000) { $PrincipalGrouping[$GroupName].GenericAll.Add($LogName) }
        if (($ACE.AccessMask -band 0x01000000) -eq 0x01000000) { $PrincipalGrouping[$GroupName].AccessSystemSecurity.Add($LogName) }
    }
}

# Examples of inspecting granted permissions for unprivileged groups
$PrincipalGrouping['NT AUTHORITY\INTERACTIVE']
$PrincipalGrouping['NT AUTHORITY\Authenticated Users']
$PrincipalGrouping['Everyone']