Questions[eventcreate](server)

I have also asked this question in a Microsoft Forum, but no answers there yet.

I am in the process of building out a Windows 2012 server to replace a legacy Windows 2008 server. I am testing a legacy batch script that logs informational or system events under different circumstances. However, the script is failing with the error "Access is denied".

I did some debugging and discovered the failure is with the EVENTCREATE line. Below is an example of the command and it's failure:

C:\SCRIPTS>EVENTCREATE /t WARNING /d "testing" /id 411
ERROR: Access is denied.

If I execute this command as myself (administrator) it works fine. But if one of the users executes it, it fails.

I did google around as well as check stackoverflow and it's sibling sites, and observed that this sort of behavior was reported when the /so parameter is used. However, I am not using the /so parameter.

I've confirmed that the user has access to the EVENTCREATE command. If they invoke it with /? they see the help contents for it.

Is there some sort of group policy permission setting I need to adjust? Something else?

Thanks in advance for your help.

I'd like to use eventcreate from a batch file to log the results of a file copy job (robocopy). What I'd really like to do is use the output of the file copy job as the description of the event (/D of createevent). The trouble is, there are multiple lines in the file copy output, and I've only been able to get one line into a local variable or a pipe command.

I've tried reading a local variable in from file, like

set /P myVar=<temp.txt

but it only gets the first line.

How can I write multiple lines to the description of an event from a batch file?

I've written a simple batch script that watches some services and regularly restarts them. I've used the eventcreate command to write to the Windows event log, which seems like a good way of logging my actions, but I notice that the 'category' field is always empty. Can I use this field to put some extra information in? There doesn't seem to be a parameter on eventcreate for it. Or is this reserved for some internal Windows data?