Wikis - Page Details

First published by i.biswajith (eMicrosoft Community Contributo)
When: 6 May 2011 1:15 AM
Last revision by Richard Mueller (cMVP, Microsoft Community Contributo)
When: 13 Sep 2013 8:23 AM
Revisions: 12
Comments: 2

Options

Can You Improve This Article?

Positively! Click Sign In to add the tip, solution, correction or comment that will help other users.

Report inappropriate content using these instructions.

How to Provide Access to Security Logs in Domain Controller

How Do I Provide Access To Security Logs in Domain controller?

Introduction

In this section we will learn how we can provide explicit read-only access to security log on a specific machine for a specific domain ID.

Method

Step 1: Login to the Domain Controller/ Machine on which the access needs to be granted.

Step 2 : Open registry editor, click “start à Run à (type “regedit” in the Run box) à Enter”

Step 3: After the “registry editor” opens navigate to “HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Security\CustomSD”

Step 4: Find the SID of the user ID (who would be granted access) using PSGETSID tool.

Step 5: Replace the existing CustomSD value with à A;;0xf0003;;;<User ID SID>

The new value is:

<O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0005;;;SY)(A;;0x5;;;BA)A;;0xf0003;;;<User ID SID>

But the best practice is to put a group SID and add user into that group.