无管理员权限下通过PowerShell创建Event Log源并写入的问题咨询

Let's break down your three questions clearly, with practical PowerShell examples and real-world context:

1. Can you create a new Event Log source via the registry using PowerShell? #

Absolutely. Event Log sources are registered in the Windows registry at HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application\ (for the Application log). You can create a new source by adding a registry key here, but there’s a critical caveat: regular users don’t have write access to this HKLM path by default. So you’ll need an admin to pre-configure permissions, or use elevated rights to modify the registry directly.

2. What PowerShell commands are needed, and how do permissions factor in? #

The process has two key parts: setting up permissions (admin-only) and creating the source (can be done by authorized users afterward).

Step 1: Admin grants write access to the registry path #

An admin needs to run this to let the "Users" group create new source keys under the Application log registry path:

$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application"
$acl = Get-Acl $regPath
$accessRule = New-Object System.Security.AccessControl.RegistryAccessRule(
    "Users",
    "CreateSubKey",
    "ContainerInherit",
    "None",
    "Allow"
)
$acl.AddAccessRule($accessRule)
Set-Acl $regPath $acl

Step 2: Create the Event Log source registry key #

Once permissions are set, you can create the source key and configure required metadata (like a message file for proper log formatting):

$sourceName = "OutlookSignatureScript"
$sourceRegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application\$sourceName"

# Create the registry key (Force overwrites if it exists)
New-Item -Path $sourceRegPath -Force | Out-Null

# Set the EventMessageFile to a system-provided file (ensures logs display correctly)
Set-ItemProperty -Path $sourceRegPath -Name "EventMessageFile" -Value "$env:SystemRoot\System32\EventCreate.exe" -Type String

# Optional: Define supported event types (Information, Warning, Error = 7)
Set-ItemProperty -Path $sourceRegPath -Name "TypesSupported" -Value 7 -Type DWord

Important: Without the admin setting permissions first, a regular user will get an "Access denied" error when trying to create the registry key.

3. Can you write to this source via PowerShell without admin rights? #

Yes! Once the source is registered, regular users can write to it using the Write-EventLog cmdlet—no elevated privileges needed. Regular users already have default write access to the Application log, so this works out of the box:

Write-EventLog -LogName "Application" -Source "OutlookSignatureScript" -EventId 1000 -EntryType Information -Message "Outlook signature setup completed successfully"

Quick Context Recap #

• The New-EventLog cmdlet requires admin rights because it validates system-wide event log configurations beyond just creating a registry key. Direct registry modification skips this validation, but as long as you set the EventMessageFile correctly, it’s reliable for basic logging.
• Regular users can always write to the Application log using existing sources, but creating new sources requires modifying HKLM—an action restricted to admins unless permissions are explicitly granted.

内容的提问来源于stack exchange，提问作者turbonerd