Home / server / Questions / 981735
In Process
Bozho
Asked: 2019-09-04 09:15:23 +0800 CST

Windows Remote Viewing of Event Logs fails with "Access denied"

  • 772

I'm trying to connect to a remote windows server (2019) from a machine in the same domain and view its event logs. However, I'm getting "Access denied" in almost all ways I've triied. Below is a list of relevant details:

  • Event viewer's "Connect to another machine" works correctly
  • PowerShell Get-WinEvent fails with Access denied (with proper -Credential passed)
  • PowerShell Get-WmiObject -Class Win32_NTEventLogFile -ComputerName ... -Credential ... fails with access denied
  • after using winevt's EvtOpenSession, all subsequent calls fail with Access denied (which is epxected, as the check is lazily performed)

The following configuratons have been done:

  • the user is a service account and has been added to the following groups: Distributed COM users, Event log readers, Performance Monitor Users, Remote Management users
  • the firewall inbound rules to allow remote log management have been enabled
  • in the WMI configuration management, the user has been added to the WMI root with "Remote enable" and all other permissions

So, the question being - what am I missing on order to get winevt EvtOpenSession to work, as well as (optionally) Get-WinEvent and Get-WMIObject

windows

0 Answers