Server 2012 Foundation EventLog registry permissions

does know how add (what seems be) built-in security principal "eventlog" permissions of hkey_local_machine\system\currentcontrolset\services\eventlog ?

it had corrupted name (like s-1-etc.. ) , red mark against (and thinking "event log readers" group) so i removed add in. (i was looking give iis access logs.)

it there ok , in permissions (looking ok) for hkey_local_machine\system\currentcontrolset\services\eventlog\security.

if try add "eventlog" permissions complains "an object named "eventlog" cannot found". object type set all.

or can restore part?
there files in c:\windows\system32\config\regback 0kb , dated last week.
no backups done yet..

i've spent while buillding want rather not re-build.

tia.

hi simn,

the hklm\system\currentcontrolset\services\eventlog should this:

while hkey_local_machine\system\currentcontrolset\services\eventlog\security key should this:

when comes adding eventlog entry security, need to:

1. open regedit.exe administrator.
2. navigate hklm\system\currentcontrolset\services\eventlog\security key.
3. right click on security , choose permissions...
4. go advanced screen , click add button.
5. click "select principal" hyperlink.
6. use locations button change focus domain/forest computer/server.
7. use object types button make sure "other objects" category checked.
8. in name field, type "nt service\eventlog", check name , accept it.
9. ensure following options checked (under show advanced permissions): query value, enumerate subkeys, notify , read control.

cheers,
lain

Windows Server  >  Windows Server 2012 General