How to? EVENTLOG Command with simple User Rights not functional

Mar 17, 2021
Hello JPSoft Team,

Thank Your for a great Product on long Time.

Here my Problem.
I use for Take Command Scriptings most a simple User Account from local Windows Group User.
From Time to Time i must use any Funtion wich more Rights required. This can be funtional when im Set more Rights.
For use Write in a Windows-Application-Eventlog i have Set the Write Rights for User per follow Command

(show setting per "wevtutil get-log application", i have added (A;;0x3;;;S-1-5-32-545) Especialy the SID S-1-5-32-545 is for User)

wevtutil sl application /ca:O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)(A;;0x3;;;S-1-5-32-545)

After this Setting the Script under this Account cannt Write a Event with internal Command "EVENTLOG", but when use CMD Command EVENTCREATE in the same Script is this now funtional. Where is the Problem ?

(PS: in the same Context i have Problem on Reading Windows Service Status Function, only by use the internal Function is it not funtional)
Mar 17, 2021

Im Starting both Commands in the same TCC Shell and have differencial (Access-) Results. For me ist always better use the TCC internal Functions and Commands as the extenal Commands. Checking the Results ist internal always better.
May 20, 2008
Syracuse, NY, USA
Hmmm! Unelevated, this failed (access denied) the first time I tried it.

v:\> eventcreate /L Application /SO TCC /ID 666 /T INFORMATION /D "My dog has fleas."

After (only once) specifying /S <the local machine> and /U <me, an admin>, again unelevated, this now works in unelevated instances, even newly started ones.

v:\> eventcreate /L Application /SO TCC /ID 666 /T INFORMATION /D "My dog has fleas."

SUCCESS: An event of type 'INFORMATION' was created in the 'Application' log with 'TCC' as the source.
Mar 17, 2021
Using the external App EVENTCREATE is only a Workaround while the TCC internal Command EVENTLOG not become the same Access Rights to the Window Application Event Log. In my Environment is UAC disabled and the TCC running under a normal User Account. He become the Rights to make his Work. So from the same TCC Shell, the one (EVENTCREATE) can Write to the Application Event Log and the internal Command (EVENTLOG) cannot.

Im use this to Start (TCC) Scheduler Tasks per Event (and not per Timer) in Windows Application Eventlog.

So to Test this Situation, you must use a normal User Account. Give him Rights (wevtutil) to Write in Application Eventlog. Test this per CMD EVENTCREATE und than in TCC per EVENTLOG.
Similar threads
Thread starter Title Forum Replies Date
cgunhouse Eventlog Syntax issue Support 8
David McClelland eventlog options are positional Support 2
C Syslog/eventlog Support 1
T VIEW only works from command line Support 14
rconn News Take Command / TCC / CMDebug / TCC-RT v28 Released Support 0
T Take Command 28: Lua reports version 5.4.0 (5.4.3 expected) Support 0
Jay Sage WAD Possible Bug With OPTION Command With @FILE Support 5
rconn News Take Command / TCC / CMDebug / TCC-RT 27.01.24 uploaded Support 0
J Take command does not start on Windows 10 Support 3
vefatica `Back quotes` - command line vs. batch file Support 5
Jay Sage WAD Failure of Alias Command with /Z Option Support 14
Phileosophos Is there any way to open the Take Command options dialog from the command line? Support 8
Phileosophos Command-line Editing Shortkeys That Fail Support 6
fpefpe How to? free (internal) command Support 0
rconn News Take Command / TCC / CMDebug / TCC-RT 27.01.23 uploaded Support 0
T How to? retain command history across reboot? Support 6
rconn News Take Command / TCC / CMDebug / TCC-RT v27.01 Build 22 Uploaded Support 0
Jay Sage Bug With Flow Control and/or Command Grouping Support 2
Jay Sage Take Command Is Too Fast! Support 4
Jay Sage Comparison of IF with Command Group and IFF Support 6
D Open Windows 10 Photos app from command line Support 11
rconn News Take Command / TCC / CMDebug / TCC-RT 27.0.21 uploaded Support 0
rconn News Take Command / TCC / CMDebug / TCC-RT 27.0.20 uploaded Support 0
U Can not get/start Take Command gui Support 1
rconn News Take Command / TCC / CMDebug / TCC-RT 27.0.19 Support 0
S Increasing Font Point Size in Command Tabs Support 2
mfarah Fixed The DATE command produces the wrong error message. Support 1
vefatica Command name mix-up Support 3
FreezerBurnt "Missing SETLOCAL" when initializing Visual Studio Command Prompt. Support 9
E How to? Closing desktop created by DESKTOP command Support 10
rconn News Take Command / TCC / CMDebug / TCC-RT v27.0.18 Support 0
K Take Command fox XP? Support 7
Joe Caverly Documentation Replace internal command with LIBRARY command Support 0
fpefpe How to? command echo in title line/bar Support 2
U Command help on file names Support 5
vefatica Command line DO with no closing parenthesis? Support 9
vefatica Command history search is off Support 7
H How to? How can I say "if the command separator is not ~ then setdos /C~" Support 8
N Command execution slows down in TCC Prompt after a while Support 6
R Long commands retrieved from command history have blank line when wrapped Support 20
jpeni Take Command Language Examples Support 1
rconn News Take Command / TCC / CMDebug / TCC-RT 26.02.41 Uploaded Support 0
fpefpe winfr command Support 4
Dmitry L. Kobyakov Fixed The SETARRAY /R command works incorrectly with cyrillic files Support 2
M Selecting test "off by one" problem in Take command Support 4
Dmitry L. Kobyakov Documentation Error in the Help: the WINDOW command Support 0
R How to? Open Take Command at current folder Support 7
rconn News Take Command / TCC / CMDebug / TCC-RT 26.01.40 uploaded Support 0
C TEE command appending null characters to output Support 6
vefatica IDE external command syntax color? Support 1

Similar threads