Follow Administrators can read and export every event log, but only from an elevated prompt. For everyone else, the built-in Event Log Readers group grants read access to most logs, locally and remotely, without admin rights. Add the account with net localgroup “Event Log Readers” <user> /add, then sign out and back in. A handful of channels set their own permissions; wevtutil gl <log> shows exactly who can read a given log.
Analysts, log collectors and IR partners all need event logs, and none of them should need to be local admins for it. This guide covers the least-privilege setup and the reasons “Access is denied” shows up even when you think you have rights.
Who can do what
| Action | Who, by default |
|---|---|
| Read and export most logs | Administrators (elevated) and Event Log Readers |
| Read the Security log | Administrators (elevated); Event Log Readers |
| Clear the Security log or change auditing | Accounts with “Manage auditing and security log” (Administrators) |
| Change a log’s size or retention | Administrators |
| Read logs from another machine | Same rights as locally, plus the firewall open for remote event log access |
Why admins still get “Access is denied”
User Account Control. A non-elevated session runs with a filtered token, without the Administrators group. Event Viewer and wevtutil then behave as if you were a normal user. Right-click, Run as administrator, and try again. It’s the most common cause by far.
Add an account to Event Log Readers
On one machine:
net localgroup "Event Log Readers" analyst /add
or in PowerShell:
Add-LocalGroupMember -Group "Event Log Readers" -Member "CORP\analyst"
Sign out and back in; group membership is read at logon.
Across a domain, use Group Policy (Restricted Groups, or Group Policy Preferences → Local Users and Groups) to put a domain group into Event Log Readers on every machine. On domain controllers, Event Log Readers is a domain-wide built-in group, so one change covers all DCs.
Check a specific log’s permissions
wevtutil gl Security
Look at channelAccess. It’s an SDDL string, and the part that matters looks like (A;;0x1;;;S-1-5-32-573): A means allow, 0x1 means read, and S-1-5-32-573 is Event Log Readers. If a channel’s SDDL doesn’t include that SID, Event Log Readers can’t read it. You can change a channel’s access with wevtutil sl <log> /ca:<SDDL>, but it’s easy to get wrong. Prefer group membership where you can.
Remote access
- Firewall. Event Viewer’s “Connect to Another Computer”, wevtutil /r: and Get-WinEvent -ComputerName use RPC. Enable the rule group on the target: Enable-NetFirewallRule -DisplayGroup “Remote Event Log Management”.
- PowerShell remoting (Invoke-Command) uses WinRM instead. That’s often already open where RPC isn’t.
- Windows Event Forwarding. To forward the Security log, add NETWORK SERVICE to Event Log Readers on the source machines. Without it, a subscription can look healthy and deliver no Security events.
A note on uploading EVTX
Having rights to export a log doesn’t make every destination fine. LogTotal doesn’t sanitize EVTX files yet. Treat an EVTX upload as handing over the raw file, or convert it to JSON first.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| Access is denied as an admin | Session isn’t elevated | Run as administrator |
| Access is denied in Event Log Readers | Membership not active yet, or the channel has custom permissions | Sign out and in; check wevtutil gl |
| The RPC server is unavailable | Remote event log firewall rules are off | Enable “Remote Event Log Management” on the target |
| WEF delivers everything except Security | NETWORK SERVICE isn’t in Event Log Readers | Add it on the sources |
| Can read the log, but the export fails | No write access to the target folder | Export somewhere you can write, e.g. C:\Users\<you>\ |
