Exception thrown when trying to register a new event source in Visual Basic

exampasserexampasser Member Posts: 718 ■■■□□□□□□□
This is the exception that I get thrown at me when I try to register a new event source: "The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security"


My code for registering a new event
"If Not EventLog.SourceExists("Firstapp") Then
EventLog.CreateEventSource("firstapp", "Application")
End If"

The walk around that I had to do was to right-rick and select run as administrator.
Is there a way for the Security log to not be searched when searching for an event source so a user would not have to use the run as administrator for running the program for the first time?

Comments

  • RobertKaucherRobertKaucher A cornfield in OhioMember Posts: 4,299 ■■■■■■■■■■
    Why don't you just handle the exception? Just catch that specific exception but do nothing as it is a known issue and your event source is not related to the security log.
  • exampasserexampasser Member Posts: 718 ■■■□□□□□□□
    Why don't you just handle the exception? Just catch that specific exception but do nothing as it is a known issue and your event source is not related to the security log.

    Good idea, I tried it but so far catching the exception just surprises the message and the event source is not registered but I might be doing something wrong as I haven't done exception catching in a while *Grabs VB handbookicon_study.gif
  • RobertKaucherRobertKaucher A cornfield in OhioMember Posts: 4,299 ■■■■■■■■■■
    exampasser wrote: »
    Good idea, I tried it but so far catching the exception just surprises the message and the event source is not registered but I might be doing something wrong as I haven't done exception catching in a while *Grabs VB handbookicon_study.gif

    Don't be affraid to post the code!

    I have been thinking about how to handle this. Are you able to write to the event log w/o running the app as admin? I don't think that is the case. What I would suggest is that when your app launches it determines if it is for the first time and you prompt to run as admin, set proper permissions on the custom log, and then everytime after you just run as a normal user.
  • exampasserexampasser Member Posts: 718 ■■■□□□□□□□
    Here is a portion of the code (it's a test application for experimenting with writing to the event log, I just did a general catch all exception):

    If Not EventLog.SourceExists("testapp") Then
    EventLog.CreateEventSource("testapp", "Application")
    End If
    Catch

    End Try
  • RobertKaucherRobertKaucher A cornfield in OhioMember Posts: 4,299 ■■■■■■■■■■
    exampasser wrote: »
    Here is a portion of the code (it's a test application for experimenting with writing to the event log, I just did a general catch all exception):

    If Not EventLog.SourceExists("testapp") Then
    EventLog.CreateEventSource("testapp", "Application")
    End If
    Catch

    End Try
    I did a little research and it looks like you will need to initially run as admin so as to set permissions properly.
  • exampasserexampasser Member Posts: 718 ■■■□□□□□□□
    Is there a way to make the program prompt for elevated administrator privileges?
  • RobertKaucherRobertKaucher A cornfield in OhioMember Posts: 4,299 ■■■■■■■■■■
    Yes, you should create a helper application that will run and do the dirty work for you. Use the principles in this article:
    Using UAC with C# – Part 1 | Ex nihilo nihil fit
  • exampasserexampasser Member Posts: 718 ■■■□□□□□□□
    Thanks, I'll try that out.
  • JDMurrayJDMurray MSIT InfoSec, CISSP, SSCP, GSEC, EnCE, C|EH, CySA+, PenTest+, CASP+, Security+ Surf City, USAAdmin Posts: 12,255 Admin
    Yes, the Windows Security event log is only accessible using Administrator privileges, and it needs to be accessed even if you are creating an event source in a different log.

    You normally create/remove an event source during the installation/removal process (installutil.exe) and not dynamically in code, unless the code always runs with admin privileges (e.g., a Windows service). Have your setup project create the event source and not your code. Running the installer will automatically display the privilege escalation box.
  • RobertKaucherRobertKaucher A cornfield in OhioMember Posts: 4,299 ■■■■■■■■■■
    How has this turned out? Any update? I'd like to see what you've got...
  • exampasserexampasser Member Posts: 718 ■■■□□□□□□□
    How has this turned out? Any update? I'd like to see what you've got...

    Sorry, I've been busy studying for finals this week as the semester is coming to an end, I'll work on it on Friday.
  • exampasserexampasser Member Posts: 718 ■■■□□□□□□□
    Apparently there is no RunElevated function in Visual Basic, I'll see if there is an equivalent function for VB.
  • exampasserexampasser Member Posts: 718 ■■■□□□□□□□
    Ok I figured it out, to have a program prompt for elevated privileges:

    Go to solution explorer, click show all files, click on the arrow next to project and open the manifest file.

    Modify the following line to this:
    <requestedExecutionLevel level="requireAdministrator" />

    Of course I don't want the pesky UAC to always pop up So I would simply have my main
    application point to another executable to perform the registration if it detects that it
    the event source has not been created.

    Supposedly you could create a custom manifest file according to many guides, however when I select add new item, application manifest does not exist as an option (Possibly that this option is not supported in Visual Basic, it is available in C# though).
Sign In or Register to comment.