"Event Log Readers" group for domain controllers

[etienne]

I noticed a Windows 2008 documentation and checked a local "Event Log Readers" group for Windows 2008 based member servers. The question that I have is, does this capability cover a Windows 2008 domain controller? I cannot see anything in Active Directory and was thinking if this capability can be extended to a DC or if SDDL string manipulation is still the only was to delegate log access? Thanks.

[Metaldigger]

When you will check the built-in container in AD then you will be able to see that they also exist in a domain.

[Amadeus1756]

Strange, I've just added a user to this group and I can't read the event log on the 2008 DC.
Can the OP confirm whether he got it working or not?

(just to clarify, I added a plain domain user to the "Event Log Readers" group - nothing else)

thanks