Permissions Changes on Windows Event Log Not Working (GPO Change)

permissionswindows-event-logwindows-registry

I'm trying to grant permissions to the Network Service account (SID S-1-5-20) on the event log "Microsoft-Windows-CAPI2/Operational" (see picture below). However I need to push this change on more than 1000 servers, and more are coming. So my solution has to be linked somehow to a GPO (I trying to avoid the usage of a script with the GPO for technical reasons).

CAPI2 event log

According the instructions from Microsoft, you have to:

  1. Create a new registry key named "CustomSD" under the concerned event log key in 'HKLM:\SYSTEM\CurrentControlSet\services\eventlog\custom_log'
  2. Create a string "CustomSD" with the proper permissions defined in the SSDL
    format: O:BAG:SYD:(A;;0x7;;;BA)(A;;0x2;;;AU)(A;;0x1;;;S-1-5-20)
  3. Restart the host and verify permissions

However, when I reboot the host and I check the permissions using the following commands, I can see that the new permissions are not applied:

wevtutil get-log "Microsoft-Windows-CAPI2/Operational"  OR
Get-WinEvent -ListLog "Microsoft-Windows-CAPI2/Operational"  | Format-List -Property *

SDDL permissions

Where I am confused is that only the following keys related to the main event logs are available in : 'HKLM:\SYSTEM\CurrentControlSet\services\eventlog\'

Registry log

And in my case I have tried to :

  • create a new registry key in 'HKLM:\SYSTEM\CurrentControlSet\services\eventlog\CAPI2" >> did not work

enter image description here

  • create the registry key in the following path
    'HKLM:\SYSTEM\CurrentControlSet\services\eventlog\application\Microsoft-Windows-CAPI2' since the name of the event log was present >> did not work
    Custom SD on CAPI

So my point is that I do not understand why the permissions are not updated. Am I doing something wrong ? I have also checked the following link but it seeems that it applies only on the event log available in 'HKLM:\SYSTEM\CurrentControlSet\services\eventlog\'.

Best Answer

Thanks to the great answer from @GregAskew, I was able to push event log permissions over GPO. My steps were:

  1. Create a new GPO and browse to the Registry settings (available in Computer > Preferences > Windows Settings > Registry) to update the "ChannelAccess" entry gpo registry
  2. Add the proper permissions in the SDDL format in the field Value data: Value data
  3. Enable the event log CAPI2 (deactivated per default) updating the registry key "Enabled" to 1 enabled
  4. As a result my GPO looks like that: GPO result

After the GPO is activated and applied, you can check on your target client the correct application of the permissions by browsing to the following path in the registry

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\<event log>

enter image description here

Related Topic