Permissions needed to read event log messages remotely?

Question

When running under a limited account, local event log messages are displaying fine, for remote computer I am getting this error:

The description for Event ID ( xxxxx ) in Source ( yyyyy ) cannot be found.
The local computer may not have the necessary registry information or message 
DLL files to display messages from a remote computer. You may be able to use the
/AUXSOURCE= flag to retrieve this description; see Help and Support for details.
The following information is part of the event: zzzzz.

Same remote computer works fine under domain administrator. I am currently experimenting with just the Event Viewer, by using Run As. Original issue is a PowerShell script which does Get-EventLog.

Are there any special permissions that need to be in place to able to read event log messages remotely? Supposedly there is a simple solution in Windows 2008 and higher, i.e. just add user to Event Log Readers group. Is there anything like that for Windows 2003?

Solution

I believe the issue is not so much that the user can't read the event log, but that the user can't read the event log message files which are used for these particular events.

My blog entry may help shed some light: http://www.eventlogblog.com/blog/2008/04/event-log-message-files-the-de.html.

On the remote system you would need to identify the message files which are used by the particular event source, and then ensure that the user who is running the powershell script has read permission to those files.

I haven't tried this, but it should work.

Comments

[Victor Zakharov]

@Ansgar: It applies to all log entries, not just some of them. I tried as Domain Administrator, and also as a limited account - and got different outcome. So by raising permission I got from non-working to working. And you are telling me this is not about permissions?..

[Lucky Luke]

@Ansgar doesn't seem to know what he's talking about in this case. You have clearly identified that this is a permissions issue.