UAC gives me fits!

Question

The code I am currently working on runs on Windows Server 2003, but needs to be able to write to EventLogs on multiple machines. I am coding in C#, using VS2008 Pro, and .NET Framework 3.5.

The code itself is relatively simple (thanks to the framework):

using (EventLog remoteEvtLog = new EventLog(LogName, HostName, EventSource))
{
    remoteEvtLog.WriteEntry(Body);
}

"LogName" is a string containing the name of the log to write to - in most cases "Application". "HostName" is a string containing the NetBIOS Name of the machine where the log entry should be written. "EventSource" is a string containing the name of the event sender (this is a utility used by multiple apps, so usually it will have the name of the consuming application). "Body" is a string containing the text to be written to the event log.

In most cases this works fine, but when the machine being written to uses UAC, any write which creates a new EventSource fails. This occurs even though the Security credentials used are members of the Administrators group - and I have not been able to find a way to specify the elevated priviledge level. Apparently, members of the Administrators goroup get two tokens - one limited, and one elevated, but as far as I can tell, the only way to specifiy the elevated token is through the UI - which is obviously a problem when remotely accessing the Logs.

Any ideas out there?

Answer 1

Your code is not supposed to create new event sources (the legacy auto-create behavior is unfortunate, but still wrong). If you need a separate event source for your application, then the installer for that application - which runs with elevated administrative privileges - should create it.