# Cannot read Security logs **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [November 16, 2017, 12:00am UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842 "2017-11-16T00:00:58Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![robert-blankenship](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robert-blankenship/32/11287_2.png) [@robert-blankenship](https://discuss.elastic.co/u/robert-blankenship)\ **Post date:** [November 16, 2017, 12:00am UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/1 "2017-11-16T00:00:59Z")
When I right click `winlogbeat` executable and select Run As Administrator, I get the following message in the log file: > WARN EventLog[Security] Open() error. No events will be read from this source. Accessis denied." I am able to view security logs both through the Event Viewer and the command line. Any ideas? When I select non-Security logs in the config, it works fine. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 16, 2017, 4:18pm UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/2 "2017-11-16T16:18:10Z")
The access restrictions on the Security log [are different](https://msdn.microsoft.com/en-us/library/windows/desktop/aa363658(v=vs.85).aspx) than other event logs. On a vanilla Windows install a process running as Administrator should be able to access the Security log. Have you tried running Winlogbeat as a service? ```auto PS C:\Users\me> Get-WinEvent -ListLog Security | Format-List -Property * FileSize : 1118208 IsLogFull : False LastAccessTime : 1/13/2015 9:26:10 AM LastWriteTime : 11/16/2017 7:52:42 AM OldestRecordNumber : 1 RecordCount : 1293 LogName : Security LogType : Administrative LogIsolation : Custom IsEnabled : True IsClassicLog : True SecurityDescriptor : O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573) LogFilePath : %SystemRoot%\System32\Winevt\Logs\Security.evtx MaximumSizeInBytes : 20971520 LogMode : Circular OwningProviderName : ProviderNames : {DS, LSA, SC Manager, Security...} ProviderLevel : ProviderKeywords : ProviderBufferSize : 64 ProviderMinimumNumberOfBuffers : 0 ProviderMaximumNumberOfBuffers : 16 ProviderLatency : 1000 ProviderControlGuid : ``` The above output shows the SecurityDescriptor that controls the access to the Security log. I'm curious if your is different? If so did someone modify the registry? See [CustomSD](https://msdn.microsoft.com/en-us/library/windows/desktop/aa363648(v=vs.85).aspx). ---
**Author:** ![robert-blankenship](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robert-blankenship/32/11287_2.png) [@robert-blankenship](https://discuss.elastic.co/u/robert-blankenship)\ **Post date:** [November 16, 2017, 10:42pm UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/3 "2017-11-16T22:42:19Z")
We get the following error when running that command: ```auto PS C:\Users\Administrator> Get-WinEvent -ListLog Security | Format-List -Property * Get-WinEvent : Could not retrieve information about the Security log. Error: Attempted to perform an unauthorized operation.. At line:1 char:1 + Get-WinEvent -ListLog Security | Format-List -Property * + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Get-WinEvent], Exception + FullyQualifiedErrorId : LogInfoUnavailable,Microsoft.PowerShell.Commands.GetWinEventCommand Get-WinEvent : There is not an event log on the localhost computer that matches "Security". At line:1 char:1 + Get-WinEvent -ListLog Security | Format-List -Property * + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (:) [Get-WinEvent], Exception + FullyQualifiedErrorId : NoMatchingLogsFound,Microsoft.PowerShell.Commands.GetWinEventCommand ``` We checked the registry for `HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Eventlog\\Security`, those permissions look fine. We also check the file permissions in `C:\Windows\System32\winevt\Logs`. Those all looked fine. This is a 2016 Windows AD server. We were logged in as the domain admin. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 16, 2017, 10:58pm UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/4 "2017-11-16T22:58:16Z")
The domain admin is most likely different than a local admin. The domain admin probably isn't a member of the Event Log Readers group. Winlogbeat is going to be running as the local service account if you use the provided install scripts. This account should be able to read from the Security log. ---
**Author:** ![robert-blankenship](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robert-blankenship/32/11287_2.png) [@robert-blankenship](https://discuss.elastic.co/u/robert-blankenship)\ **Post date:** [November 16, 2017, 11:49pm UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/5 "2017-11-16T23:49:28Z")
Here are the CustomSD values in `HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Eventlog\\Security` for three different hosts. The first host is getting the `Get-WinEvent` error, and the other two work.: ```auto // Doesn't work O:BAG:SYD:(A;;CC;;;S-1-5-80-1717699148-1527177629-2874996750-2971184233-2178472682)(A;;CC;;;NS) ``` ```auto // Works O:BAG:SYD:(A;;CCLCSDRCWDWO;;;SY)(A;;CCLC;;;BA)(A;;CC;;;ER)(A;;CC;;;S-1-5-80-1717699148-1527177629-2874996750-2971184233-2178472682)(A;;CC;;;NS) ``` ```auto // Works O:BAG:SYD:(A;;CCLCSDRCWDWO;;;SY)(A;;CCLC;;;BA)(A;;CC;;;ER)(A;;CC;;;NS) ``` We are definitely in an administrator shell, i.e., right click on the Power Shell shortcut and select "Run As Administrator" when running the `Get-WinEvent` command on each host. Which API does `winlogbeat` use to grab the Security logs? Does `winlogbeat`, perhaps because of some dependency, actually need access to a functioning "Event Log Readers" group? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 17, 2017, 12:09am UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/6 "2017-11-17T00:09:41Z")
It uses [EvtSubscribe](https://msdn.microsoft.com/en-us/library/windows/desktop/aa385487%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396) and [EvtNext](https://msdn.microsoft.com/en-us/library/windows/desktop/aa385405(v=vs.85).aspx). Have you tried running Winlogbeat as a service? [Getting Started: Step 6 - Starting Winlogbeat](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-starting.html#winlogbeat-starting) I would expect this to work. Regarding running as the a Domain Administrator, does your GPO give the admin group the user right to ["Manage auditing and security log"](https://technet.microsoft.com/en-us/library/cc957161.aspx)? I believe this is where the [`SE_SECURITY_NAME`](https://msdn.microsoft.com/en-us/library/windows/desktop/bb530716(v=vs.85).aspx) privilege comes from that allows a user to access the Security log (as specified [here](https://msdn.microsoft.com/en-us/library/windows/desktop/aa363658%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396)). ---
**Author:** ![robert-blankenship](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robert-blankenship/32/11287_2.png) [@robert-blankenship](https://discuss.elastic.co/u/robert-blankenship)\ **Post date:** [November 17, 2017, 12:23am UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/7 "2017-11-17T00:23:41Z")
We do run it as a Windows service. I looked at the Windows "Services" GUI, and it was running as "Local System". We still saw the following error: > WARN EventLog[Security] Open() error. No events will be read from this source. Accessis denied." ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 17, 2017, 12:26am UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/8 "2017-11-17T00:26:59Z")
> [@robert-blankenship](#): > > When I right click winlogbeat executable and select Run As Administrator, I get the following message in the log file: Earlier you said that you ran it in a different manner. Perhaps you should stop it, clear the logs, start the service, and then check the logs to see if it is giving a "Access denied". ---
**Author:** ![robert-blankenship](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robert-blankenship/32/11287_2.png) [@robert-blankenship](https://discuss.elastic.co/u/robert-blankenship)\ **Post date:** [November 17, 2017, 12:41am UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/9 "2017-11-17T00:41:55Z")
We tried both 🙂 ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 17, 2017, 12:48am UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/10 "2017-11-17T00:48:57Z")
Is this problem occurring exclusively on the machines where `Get-WinEvent` fails? I haven't seen this problem before. The closest issue I have seen is when a user installed a security update and the `CustomSD` value became empty. They were getting access denied until they restored the CustomSD value. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 17, 2017, 12:52am UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/11 "2017-11-17T00:52:13Z")
I think I would probably fire up [Process Explorer](https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer) from Sysinternals and check to see if the winlogbeat.exe process has the `SeSecurityName`. And compare that to another machine where it is working. ---
**Author:** ![robert-blankenship](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robert-blankenship/32/11287_2.png) [@robert-blankenship](https://discuss.elastic.co/u/robert-blankenship)\ **Post date:** [November 17, 2017, 1:04am UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/12 "2017-11-17T01:04:23Z")
Thanks for the advice Andrew! We can try that. > Is this problem occurring exclusively on the machines where Get-WinEvent fails? > > I haven't seen this problem before. The closest issue I have seen is when a user installed a security update and the CustomSD value became empty. They were getting access denied until they restored the CustomSD value. We have run it on 3 machines. `winlogbeat` is working on 1 machine, and not on the other 2. The command only fails on the _non-functioning_ machine. So, plausibly, there is a connection the command failing and `winlogbeat` failing. ---
**Author:** ![robert-blankenship](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robert-blankenship/32/11287_2.png) [@robert-blankenship](https://discuss.elastic.co/u/robert-blankenship)\ **Post date:** [November 17, 2017, 1:14am UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/13 "2017-11-17T01:14:38Z")
One can decode the CustomSD from the command line: ```auto // From the broken host PS C:\Users\Administrator> ConvertFrom-SddlString "O:BAG:SYD:(A;;CC;;;S-1-5-80-1717699148-1527177629-2874996750-2971184233-2178472682)(A;;CC;;;NS)" Owner : BUILTIN\Administrators Group : NT AUTHORITY\SYSTEM DiscretionaryAcl : {NT AUTHORITY\NETWORK SERVICE: AccessAllowed (ListDirectory), : AccessAllowed (ListDirectory)} SystemAcl : {} RawDescriptor : System.Security.AccessControl.CommonSecurityDescriptor ``` ```auto // From the first functioning host: PS C:\Users\Administrator> ConvertFrom-SddlString "O:BAG:SYD:(A;;CCLCSDRCWDWO;;;SY)(A;;CCLC;;;BA)(A;;CC;;;ER)(A;;CC;;;S-1-5-80-1717699148-1527177629-2874996750-2971184233-2178472682)(A;;CC;;;NS)" Owner : BUILTIN\Administrators Group : NT AUTHORITY\SYSTEM DiscretionaryAcl : {NT AUTHORITY\SYSTEM: AccessAllowed (ChangePermissions, CreateDirectories, Delete, GenericExecute, ListDirectory, ReadPermissions, TakeOwnership), NT AUTHORITY\NETWORK SERVICE: AccessAllowed (ListDirectory), BUILTIN\Administrators: AccessAllowed (CreateDirectories, ListDirectory), BUILTIN\Event Log Readers: AccessAllowed (ListDirectory)...} SystemAcl : {} RawDescriptor : System.Security.AccessControl.CommonSecurityDescriptor ``` ```auto // From the second functioning host PS C:\Users\Administrator> ConvertFrom-SddlString "O:BAG:SYD:(A;;CCLCSDRCWDWO;;;SY)(A;;CCLC;;;BA)(A;;CC;;;ER)(A;;CC;;;NS)" Owner : BUILTIN\Administrators Group : NT AUTHORITY\SYSTEM DiscretionaryAcl : {NT AUTHORITY\SYSTEM: AccessAllowed (ChangePermissions, CreateDirectories, Delete, GenericExecute, ListDirectory, ReadPermissions, TakeOwnership), NT AUTHORITY\NETWORK SERVICE: AccessAllowed (ListDirectory), BUILTIN\Administrators: AccessAllowed (CreateDirectories, ListDirectory), BUILTIN\Event Log Readers: AccessAllowed (ListDirectory)} SystemAcl : {} RawDescriptor : System.Security.AccessControl.CommonSecurityDescriptor ``` ---
**Author:** ![robert-blankenship](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robert-blankenship/32/11287_2.png) [@robert-blankenship](https://discuss.elastic.co/u/robert-blankenship)\ **Post date:** [November 20, 2017, 8:20pm UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/14 "2017-11-20T20:20:32Z")
@andrewkroh I was able to get onto a test Windows system, and I tried the registry values out. It does look like the customSD of `O:BAG:SYD:(A;;CC;;;S-1-5-80-1717699148-1527177629-2874996750-2971184233-2178472682)(A;;CC;;;NS)` out. It did reproduce the issue; the Administrator user cannot access the log. _Deleting the registry value entirely seemed to have no impact on the system, and it restores access to the logs._ ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 20, 2017, 10:47pm UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/15 "2017-11-20T22:47:59Z")
Thanks for the update. Probably this will be helpful to next person that encounters a similar issue. And the `ConvertFrom-SddlString` util is quite useful to know about. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 18, 2017, 10:48pm UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842/16 "2017-12-18T22:48:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.