Security exception when writing to event log

[chris128]

I get the following error when I run my program on Windows 7 (x64) :

The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security

This is thrown on the following line:

EventLog.WriteEntry("MyAppName", "event log message text", EventLogEntryType.Error, 7881)

After doing a bit of research it seems that this is because the event source that my app is trying to use (so "MyAppName" in my example) does not already exist on the PC and you need to be an administrator to create a new event source... which seems a bit odd to me but apparently that is the way it works. So if I run the program once as admin, then run it again as a normal user it works fine because the event source already exists.
The problem is that this program needs to be run by non admin users - any thoughts on if/how I can do this? The program is going to be run on Windows XP machines only at the moment so I doubt I will have this problem when I actually roll it out, but I would like to make it compatible with Vista and Windows 7 if possible (I'm sure this will become a requirement in the future).

There must be some kind of workaround because I'm sure every program that ever needs to write to the event log in Windows 7 doesnt need to be run as admin the first time..

Cheers
Chris

[kleinma]

Maybe they don't need to be run as admin the first time, but generally any app that is going to create its own event log is probably going to be installed and not just xcopied. The installer is probably the creation point of the event log, and the installer will most likely be run (required to be run) as administrator anyway.

Are you going to have an installer for this app?

[Negative0]

I agree with Keinma. Your installer should be able to create the event log for you. I believe you can create it with a registry key, which would be pretty easy to add to an installer.

[chris128]

Problems is, it needs to be xcopy deployed
Here's a little background info: This app is going to be copied to every PC in our company (over 500 machines) via logon script - it will be copied to the user's Startup directory so that the next time they log in it will automatically start. The program is going to just sit in the system tray and wait for a network connection to be connected/disconnected, when that happens it will run a specific file. Most users are not local admin, and there is no way we will be manually installing this on 500+ workstations (spread over 30 different sites) so it needs to be done this way without any user intervention.

Open to suggestions!

[Negative0]

Does the logon script run as the user or is it run under the SYSTEM account on the machine?

[kleinma]

I would imagine the login script could write the reg key even if it just silently runs a .reg file, that is of course unless the login script runs with the same limited permissions, which is probably what Negative0 is getting at.

[chris128]

Yeah the logon script runs as the user (so non admin). One way I have thought of to get around this though is to use a Computer startup script (via group policy) as I believe that will be run as the local system account. So I could use that to copy my file to the relevant location and just write an event log entry using that same source - assuming you can write an event log entry from a vbs script anyway.

[kleinma]

You should at least be able to create the event log via the script, even if its just shelling a .reg file.

[chris128]

Hmm not as easy as it would seem. The standard way of creating an event log entry via vbscript does not let you specify a source (great huh) and as for manually creating the registry key, I'm not sure exactly what to create. I looked in the following location and found all of the other event log sources as subkeys within: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application but inside each of these subkeys, they have the following values (and sometimes more):
EventMessageFile REG_SZ
TypesSupported REG_DWORD

EventMessageFile points to a file that "contains the event log messages in different languages" and I have no idea how to create such a file Google isnt helping much either..

[chris128]

Actually scrap that, it seems you dont HAVE to have that EventMessageFile value in there (its just that every single source on my PC does have one..) - all you need to do is create a subkey under that Applications key and name it whatever you want your source to be
So I'm going to test with launching a VBS file that does this from a computer startup script and see how that goes. Thanks for the suggestions