Logs are not appearing in Windows Event viewer

Question

Hi I have an application that runs on .Net Framework 4.7. I am facing an issue while logging the events in windows Event Viewer.
Following are the observations.
Logs are not appearing in Windows Event viewer for a normal user(who does not have admin rights) until application is launched in admin mode at least once.

Step1: Install the Application for the first time.

Step2: Launched the application with normal user credentials and observe the Windows Event viewer.
Observation : Logs does not appears in Windows Event viewer.

Step3: Launched the application with admin user credentials and observe the Windows Event viewer.
Observation : logs appears in Windows Event viewer.

Step4: Launched the application with normal user credentials and observe the Windows Event viewer.
Observation : logs appears in Windows Event viewer.

Can anyone help on this ?

Answer 1

For the .Net Framework eventlog class to function certain information needs to be read from and written to the HKLM registry key. This requires administrator privileges. Consequently, when an application running as a standard user makes the attempt to write a message to the Application event log a security exception will be thrown and the attempt will fail. No entry will be written.

Test WinForms App -

Run as standard user -

After running the application with Administrator privileges the eventlog class can create the necessary entries in the registry when the attempt to write a message to the Application log is made. Subsequent execution as a standard user will successfully write messages to the Application log.

You must install your application such that the required entries are made in the registry during installation. So the real issue seems to be that your method of installation is inadequate or improper.

Answer 2

The information about registry entries can be found here - https://learn.microsoft.com/en-us/windows/win32/eventlog/event-sources.

The .Net Framework includes a class expressly designed for installers to use in order to configure the registry for event logging - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventloginstaller?view=netframework-4.8.

An example of the registry entry created by the EventLogInstaller class is -