Security Event Log Backup via script

[Omar]

There is a script which will backup the security event log and then clear it up as well with me. It is working fine when am on the administrator account but if I use the same script in a standard user account then it wont successfully run and this the problem that I am having with it. I have already assigned the following rights to my test user for Managing the Auditing and Security Rights, then Impersonate a client after authentication and also Backup file and directories as well, but that wont work. With the same test user the security evet log in the event viewer can ve viewed but cannot be saved and an error message is shown that says "A required privilege is not held by the client".

[Big Fish]

I have solved this issue, it was some permissions issue that the user needs to have which can be done by below method:

1. First of all go to member of backup operators group
2. After that you need to go to Manage Auditing and Security log via policy
3. Here the user must have Full permissions to the key that governs the Security Log: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security
4. Thats it

[Andrew]

You can try to download EventSave and install it in your pc by searching it on the net. This small tool can be used to schedule a job to automatically save all events to another file and clear each log afterwards. Independently of how often you run it, there will be one file created every month for each log, called year_month_computer_xxx.evt, where xxx is the name of the log (like, for instance, Security or System). More information can be found here - http://www.heysoft.de/en/software/eventsave.php?lang=EN