Does anybody know of a way I can check what permissions the Local System account has with the Application event log? There is no CustomSD at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application so I am just wondering how to check what permissions it has by default? Any help is much appreciated!
I am using Windows Server 2008.
If you run the following command: wevtutil gl application the security level on the event log is described using SDDL in the channelAccess section of the output.