Writing to windows Event Log from within IE extension in Protected Mode - fails with Access Denied

Question

In a BHO running within Internet Explorer on Windows 7 with Protected Mode On, I'm trying to write to the windows event log. I'm writing to a source that already exists, and it's in the Application Log so I don't see why this would be blocked. However, my call to System.Diagnostics.EventLog.WriteEntry("MySource", "Some message") fails with an InvalidOperationException, with message "Cannot open log for source 'XXX'. You may not have write access.". The stack trace indicates it's at EventLog.OpenForWrite(String currentMachineName).

Turning Protected Mode Off makes it work fine.

Any reason this would not be allowed within Protected Mode, and any way I can register my BHO as being allowed to write to the event log, or otherwise make it work?

According to this post the call to OpenForWrite() results in a call to UnsafeNativeMethods.RegisterEventSource(this.machineName, this.sourceName);, but the docs for that didn't get me any further.

I'm using .net 2.0

thanks.

Cross-posted here: msdn_microsoft_ieextensiondevelopment

Answer 1

If you really need to write to the system log I would either:

• Create a service and send messages to it - if you will be logging something with any regularity I would do this. But who writes a bunch of messages to the system log?
• Launch a tiny application silently that is elevated to medium trust as a broker process

Let's go with option two. A few ways to do this but I will give you one idea. Write the data to be logged to a file or the registry in a low integrity location. Then launch a little application elevated to medium trust that picks up the data and writes it. Is this efficient? No. But if writing to the system log is a very rare event then this will yield the least overhead over time.

The service approach will be less obvious to the user but will take a little sliver of pie away from the computer's resources.

See Starting Processes from Protected Mode in Understanding and Working in Protected Mode Internet Explorer.