# Access Denied reading from Security log on Windows 2012

**URL:** <https://discuss.elastic.co/t/access-denied-reading-from-security-log-on-windows-2012/48445>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 26, 2016, 3:13pm UTC](https://discuss.elastic.co/t/access-denied-reading-from-security-log-on-windows-2012/48445 "2016-04-26T15:13:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![xiaozhuqq48](https://avatars.discourse-cdn.com/v4/letter/x/97f17d/32.png) [@xiaozhuqq48](https://discuss.elastic.co/u/xiaozhuqq48)\
**Post date:** [April 26, 2016, 3:13pm UTC](https://discuss.elastic.co/t/access-denied-reading-from-security-log-on-windows-2012/48445/1 "2016-04-26T15:13:29Z")

</div>

winlogbeat 1.2.1  
windows 2012  
configuration : most are the defaults. just the output for logstash.  
[  
winlogbeat:  
registry\_file: C:/ProgramData/winlogbeat/.winlogbeat.yml  
event\_logs:  
- name: Application  
ignore\_older: 72h  
- name: Security  
- name: System  
]  
In this way, the winlogbeat.exe can be started without getting any messages from Security. if Application and System are removed, then the winlogbeat will not be started.

But , in windows2008, the winlogbeat.exe can be started in both ways, and the three kinds of logs can be got.

Can anyone help?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 26, 2016, 3:30pm UTC](https://discuss.elastic.co/t/access-denied-reading-from-security-log-on-windows-2012/48445/2 "2016-04-26T15:30:34Z")

</div>

Can you provide the log output from Winlogbeat when it fails to start?

How are you starting Winlogbeat? What user are you starting Winlogbeat as? The Security log requires administrator privileges to read. If it's a permissions problem it should be logged.

---

<div class="post-metadata">

**Author:** ![xiaozhuqq48](https://avatars.discourse-cdn.com/v4/letter/x/97f17d/32.png) [@xiaozhuqq48](https://discuss.elastic.co/u/xiaozhuqq48)\
**Post date:** [April 27, 2016, 12:29am UTC](https://discuss.elastic.co/t/access-denied-reading-from-security-log-on-windows-2012/48445/3 "2016-04-27T00:29:24Z")

</div>

It seems to be a permission problem.

when i type in "winlogbeat.exe -e"

There is one output "WARN EventLog[Security] Open() error. No events will be read from this source. Accessis denied."

And PowerShell "get-eventlog" can't get any messages.But windows2008 can do it.

Do you happen to have the conresponding solutions on windows2012?

thanks.

---

<div class="post-metadata">

**Author:** ![xiaozhuqq48](https://avatars.discourse-cdn.com/v4/letter/x/97f17d/32.png) [@xiaozhuqq48](https://discuss.elastic.co/u/xiaozhuqq48)\
**Post date:** [April 27, 2016, 12:32am UTC](https://discuss.elastic.co/t/access-denied-reading-from-security-log-on-windows-2012/48445/4 "2016-04-27T00:32:16Z")

</div>

the user is "administrator"

---

<div class="post-metadata">

**Author:** ![xiaozhuqq48](https://avatars.discourse-cdn.com/v4/letter/x/97f17d/32.png) [@xiaozhuqq48](https://discuss.elastic.co/u/xiaozhuqq48)\
**Post date:** [April 27, 2016, 12:45am UTC](https://discuss.elastic.co/t/access-denied-reading-from-security-log-on-windows-2012/48445/5 "2016-04-27T00:45:55Z")

</div>

it's solved.

The winlogbeat.exe is runned as Administrator.

🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2016, 12:46am UTC](https://discuss.elastic.co/t/access-denied-reading-from-security-log-on-windows-2012/48445/6 "2016-05-18T00:46:00Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.