Exception thrown when trying to register a new event source in Visual Basic

This is the exception that I get thrown at me when I try to register a new event source: "The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security"

My code for registering a new event
"If Not EventLog.SourceExists("Firstapp") Then
EventLog.CreateEventSource("firstapp", "Application")
End If"

The walk around that I had to do was to right-rick and select run as administrator.
Is there a way for the Security log to not be searched when searching for an event source so a user would not have to use the run as administrator for running the program for the first time?

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

RobertKaucher

Why don't you just handle the exception? Just catch that specific exception but do nothing as it is a known issue and your event source is not related to the security log.

exampasser

RobertKaucher wrote: »

Why don't you just handle the exception? Just catch that specific exception but do nothing as it is a known issue and your event source is not related to the security log.

Good idea, I tried it but so far catching the exception just surprises the message and the event source is not registered but I might be doing something wrong as I haven't done exception catching in a while *Grabs VB handbook

RobertKaucher

exampasser wrote: »

Good idea, I tried it but so far catching the exception just surprises the message and the event source is not registered but I might be doing something wrong as I haven't done exception catching in a while *Grabs VB handbook

Don't be affraid to post the code!

I have been thinking about how to handle this. Are you able to write to the event log w/o running the app as admin? I don't think that is the case. What I would suggest is that when your app launches it determines if it is for the first time and you prompt to run as admin, set proper permissions on the custom log, and then everytime after you just run as a normal user.

exampasser

Here is a portion of the code (it's a test application for experimenting with writing to the event log, I just did a general catch all exception):

If Not EventLog.SourceExists("testapp") Then
EventLog.CreateEventSource("testapp", "Application")
End If
Catch

End Try

RobertKaucher

exampasser wrote: »

Here is a portion of the code (it's a test application for experimenting with writing to the event log, I just did a general catch all exception):

If Not EventLog.SourceExists("testapp") Then
EventLog.CreateEventSource("testapp", "Application")
End If
Catch

End Try

I did a little research and it looks like you will need to initially run as admin so as to set permissions properly.

exampasser

Is there a way to make the program prompt for elevated administrator privileges?

RobertKaucher

Yes, you should create a helper application that will run and do the dirty work for you. Use the principles in this article:
Using UAC with C# – Part 1 | Ex nihilo nihil fit

exampasser

Thanks, I'll try that out.

JDMurray

Yes, the Windows Security event log is only accessible using Administrator privileges, and it needs to be accessed even if you are creating an event source in a different log.

You normally create/remove an event source during the installation/removal process (installutil.exe) and not dynamically in code, unless the code always runs with admin privileges (e.g., a Windows service). Have your setup project create the event source and not your code. Running the installer will automatically display the privilege escalation box.

RobertKaucher

How has this turned out? Any update? I'd like to see what you've got...

exampasser

RobertKaucher wrote: »

How has this turned out? Any update? I'd like to see what you've got...

Sorry, I've been busy studying for finals this week as the semester is coming to an end, I'll work on it on Friday.

exampasser

Apparently there is no RunElevated function in Visual Basic, I'll see if there is an equivalent function for VB.

exampasser

Ok I figured it out, to have a program prompt for elevated privileges:

Go to solution explorer, click show all files, click on the arrow next to project and open the manifest file.

Modify the following line to this:
<requestedExecutionLevel level="requireAdministrator" />

Of course I don't want the pesky UAC to always pop up So I would simply have my main
application point to another executable to perform the registration if it detects that it
the event source has not been created.

Supposedly you could create a custom manifest file according to many guides, however when I select add new item, application manifest does not exist as an option (Possibly that this option is not supported in Visual Basic, it is available in C# though).