2

I want to read security audit logs from a network service. By default, Network Service does not have permission to read but it can if the account is added to "Event Log Readers". One of the examples is mentioned here.

However, I want to understand what would be security implications of this. Does it pose a considerable security threat?

Improve this question

1 Answer 1

Reset to default
1

The security implication of this would be that if an application which is running under Network Service is compromised, an attacker would be able to read those event logs.

The preferred way to handle this situation is to create a new login with similar permissions to network service, and to give that access to the event logs.

Improve this answer
2
  • Thanks, I wanted to know if there is any sensitive information in those logs which can be used for further exploitation? Also, the new login you are talking about, can it be created at the installation time programmatically?
    – Akshat
    Commented May 8, 2018 at 15:34
  • Whether there is sensitive information or not depends on the applications writing to the log and the security requirements of your environment. I cannot answer that question. But yes, you can create the new user programmatically during installation. See this powershell commandlet: docs.microsoft.com/en-us/powershell/module/…
    – Dan Landberg
    Commented May 8, 2018 at 21:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .