How can I create an event source without elevating privileges?

Question

I'm working on a C# program that will be used as a logon script. For diagnostic purposes, I would like to be able to write to the Application log. Unfortunately, all of the documentation that I've found states that it's impossible to create an event source without querying the Security log, which requires privilege elevation; this is obviously a no-go for a logon script.

Is there any way for me to create an event source without this elevation request? Alternatively, is there another location, or preexisting event source, that it might make more sense for me to use for logging purposes?

Answer 1

I don't think you can without elevation. There maybe some permissions you can change in the registry to allow you to, but that would need elevation, catch 22.

However there is nothing wrong with logging to a text file. As long as whoever is using the program knows this is where the logs will be then a text file will work just as well.

Answer 2

Under the covers, creating an event source requires writing to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog registry key, which is only writable by administrative users. Thus, any API built on top of this is going to require elevated permissions. Creating the event source would be something you would need to do after elevation.

But once you have created the event source, actually reporting an event does not require elevated permissions. If you could run an installer, your installer could request elevation and create the event source; and then your application just report events as any other application would. But I think this is kind of a no-go situation in a logon script.