Giving Application Pools Event Log Access

This topic only applies to Secret Server On-Premises.

Overview

When the database becomes inaccessible, Secret Server will try to log errors to the Windows event log. By default, network service and standard service accounts will not have permissions to the event log. Permissions must be added to specific event log registry keys.

Applying Windows Event Log Permissions

  1. Determine the account that is running Secret Server:

    1. Log on Secret Server.

    2. Go to Admin > Diagnostics.

    3. Look for any of the Thread Identity labels. These contain the identity of Secret Server (often NT AUTHORITY\NETWORK SERVICE or IIS APPPOOL\SecretServer or the service account set up for IWA. See Running the IIS Application Pool As a Service Account.

      You can also determine the identity by logging in and navigating to http://yoursecretserverurl/Installer.aspx. The first step of this page will tells you the application pool identity.

  2. Open the Windows registry editor on the machine running Secret Server (regedit at the command prompt or Window search text box).

  3. On the left, navigate to HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > EventLog.

  4. Right click the EventLog folder in your registry editor and select Permissions. A permissions dialog box appears.

  5. Click the Advanced button.

  6. On the Permissions tab, Click the Add button. A Permission Entry dialog appears.

  7. Click the Select a principal link. The Select User, Computer… dialog box appears.

  8. Find the account running Secret Server, such as Thycotic_Service (svc_thycotic@test.com).

  9. Click the OK button. The dialog box closes.

  10. In the Basic Permissions section of the Permission Entry dialog, click to select the Read check box.

  11. Click the Show advanced permissions link. The pane switches.

  12. Click to select the Set Value and Create Subkey check boxes in the Advanced Permissions section.

  13. Click OK buttons on the remaining dialogs to apply the permissions. You are returned to the main registry editor window.

  14. Navigate to HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > EventLog > Security, right-click and select "Permissions..."

  15. Right click Security folder and select Permissions. A permissions dialog box appears.

  16. Click the Add button.

  17. Find the account running Secret Server.

  18. Click the OK button.

  19. Click to select the Read check box in the Allow column.

  20. Click the OK button to apply the permission.

  21. If you are running Windows Server 2019 or above, use the same procedure to add Read permission to HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > EventLog > State.

You may need to run regedit as the system user when using more recent versions.

Required Registry Permissions

After setup, the following permissions appear in the registry:

HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > EventLog

Applies to key and subkeys

  • Read permissions:

    • Query Value
    • Enumerate Subkeys
    • Notify
    • Read Control

  • Set Value permission

  • Create Subkey permission

HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > EventLog > Security

Applies to key and subkeys

Read permissions:

  • Query Value
  • Enumerate Subkeys
  • Notify
  • Read Control

HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > EventLog > State

Applies to key and subkeys. Only applies to Windows Server 2019.

Read permissions:

  • Query Value
  • Enumerate Subkeys
  • Notify
  • Read Control