March 21, 2008

Windows Event Log Security

Windows 2003 server restricts logging in windows event log. Here are steps to enable logging for any application:

1. Open registry editor using "REGEDIT" command.

2. Traverse through following keys:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\CustomSD

when you will click on "Application" at left pane you will see "CustomSD" and "Sources" in right pane as shown below. You have to changes values for "CustomSD" and "Sources".

clip_image001

3. First to update "CustomSD" - double click on "CustomSD" to get following edit window:

clip_image002

4. Copy "Value data" and save some where if we require it in the future. The copied value looks as below:

O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)

5. Replace above value with following and click OK:

O:BAG:SYD:(A;;0x0002;;;AU)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)

6. Once you done with "CustomSD" double click on "Sources" in same window. You will get edit window as shown below. Scroll till the end and add "mriwebservices" and "wsMRIWeb" as shown below without quotation marks and then click OK.

clip_image003

Once you done with above steps you will see actual exception from web service in event log.

For more details see following KB article.

http://support.microsoft.com/default.aspx?scid=kb;en-us;323076#XSLTH3154121122120121120120