ICal Account being created as @me domain

Hello All,
I have setup my iCal service on my OS X server. I have been trying to setup a user on my server in iCal. The steps I have take are the following:
1. Open iCal
2. iCal --> Preferences
3. Add and Account
4. Select CalDAV as account type and enter user details
5. Gives me a warning about not having SSL. ignore and continue
Say my account shortname is 'test'. It sets the account up as [email protected] My domain is completely different and DNS is working correctly.
This has been tested with a number of users.

Hi
1. WHether it is right or not, its difficult to say.. Because a lot of companies do it, based on their business needs
The COGS posts to a Balance sheet account @ PGI.... The flow of entries is as below in that case
At PGI: COGS-Transit account Dr and Inventory Account Cr
COGS-Transit is a Balance sheet account
At Billing:
Customer Dr
Sales Cr
COGS Dr
COGS Ttransit Cr
However, this then applies to all situations... This cant be project specific
If you want to go with this, assign a Balance sheet account in GBB-VAX/VAy and ask your SD consultant to set up the accrual keys for the above entry during billing
Br, Ajay M

Similar Messages

Accounts being created with administrative group rights

Hello,
The server is a Windows 2003 R2 Enterprise fully patched used for Shared Hosting purposes. It runs Hsphere control panel. I am trying to identify how the following hack is happening.
1) There are users being created with Administrative group rights.   Below is the EventViewer log for the user creation:
User Account Created:
    New Account Name:    username
    New Domain:    PCNAME
    New Account ID:    PCNAME\username
    Caller User Name:    PCNAME$
    Caller Domain:    DOMAINNAME
    Caller Logon ID:   (0x0,0x3E7)
    Privileges       -
Attributes:
    Sam Account Name:    username
    Display Name:   <value not set>
    User Principal Name:   -
    Home Directory:   <value not set>
    Home Drive:   <value not set>
    Script Path:   <value not set>
    Profile Path:   <value not set>
    User Workstations:   <value not set>
    Password Last Set:   <never>
    Account Expires:   <never>
    Primary Group ID:   513
    AllowedToDelegateTo:   -
    Old UAC Value:   0x2DAB2B0
    New UAC Value:   0x2DAB2B0
    User Account Control:   -
    User Parameters:   <value not set>
    Sid History:   -
    Logon Hours:   <value changed, but not displayed>
There exists entries as well where the primary group ID is changed to the Administrative group, but I am omitting such.
2) I tried to identify what Caller Logon ID:   (0x0,0x3E7) means. I found out from here:
http://blog.joeware.net/2013/01/14/2667/ that I can use LogonSessions.exe to identify it.
Output from LogonSessions.exe is pasted below (snippet):
[0] Logon session 00000000:000003e7:
    User name:    DOMAINNAME\PCNAME$
    Auth package: NTLM
    Logon type:   (none)
    Session:      0
    Sid:          S-1-5-18
    Logon time:   9/11/2014 12:41:53 PM
    Logon server:
    DNS Domain:
    UPN:
        4: System
      316: smss.exe
      364: csrss.exe
      392: winlogon.exe
      440: services.exe
      452: lsass.exe
      628: svchost.exe
      756: LMAgent.exe
      840: svchost.exe
     1000: spoolsv.exe
     1252: avagent.exe
     1268: camWMIAgent.exe
     1324: cissesrv.exe
     1380: cpqrcmc.exe
     1404: vcagent.exe
     1440: svchost.exe
     1480: HsQuotas.exe
     1740: inetinfo.exe
     1780: EmailAgent.exe
     1856: snmp.exe
     1884: sysdown.exe
     1920: smhstart.exe
     2192: svchost.exe
     2388: cmd.exe
     2396: hpsmhd.exe
     2444: cqmgserv.exe
     2464: cqmgstor.exe
     2484: HSphere.exe
     2596: wmiprvse.exe
     2676: cmd.exe
     2684: rotatelogs.exe
     2692: cmd.exe
     2700: rotatelogs.exe
     2732: searchindexer.exe
     2812: hpsmhd.exe
     2824: cqmghost.exe
     2852: svchost.exe
     3044: cmd.exe
     3052: rotatelogs.exe
     3080: cmd.exe
     3088: rotatelogs.exe
     5452: svchost.exe
     5596: GravitixService.exe
     7392: csrss.exe
     7232: winlogon.exe
     6888: csrss.exe
     9832: winlogon.exe
    10388: wawrapper.exe
    10352: cpqnimgt.exe
     9496: msiexec.exe
     6068: w3wp.exe
     4748: webalizer.exe
3) I also learned from http://support.microsoft.com/kb/243330/en-us that Sid:          S-1-5-18 means:
SID: S-1-5-18
Name: Local System
Description: A service account that is used by the operating system
That is all great info, but I am not sure I can put together what I have learned to attempt and get closer towards identifying how in the world users are being created and then being assigned administrative group rights.
I am a Linux person mostly, but I am comfortable following a properly explained thread regarding windows 2003 R2 Enterprise issues.
The server is fully patched and it is running Lumension security product. What's more, Norman Malware tracker, tdskiller.exe (Kaspersky) and McAfee rootkitremover.exe have been run without any apparent Malware/Virus infection
Hope someone with advanced admin skills can advise.
Thank you

Hi,
You mentioned that, “I am trying to identify how the following hack is happening”, would you please tell us that why did you think the event represent a hacking behavior?
In a Shared Server Hosting environment, the underlying hosting control panel tool (Hsphere in this case) should be creating only virtual FTP users with a specific group. So no users with Administrative group should be ever created. If this happens,
it constitutes a breach of server security=positive hacking attempt.
>how in the world users are being created and then being assigned administrative group rights.
In addition, would you please be more specific about this question? Did you find the event message on a domain joined machine?
I want to be able to understand in full how/what process is allowing users to be created with Admin rights. In other words, I want to know what IP was used to issue the command, if ASP.net was used (abused in this case), or anything else related to
it so that we can patch this particular hole.
Best Regards,
Amy

No accounts being created - 10.5.4 install

I recently tried an erase and reinstall of 10.5 server on a mac pro that I have acting as a stand alone server. The first time I installed I had no issues, just borked the config of DNS and I finally got some time to redo the install completely.
Well the install process went ahead with no issues, I choose the advance setup, filled in all the required network and admin information (but skipped the registration parts), and the server rebooted leaving me at the login prompt. Everything looks good.
I had trouble logging in - mainly I couldn't at all. I thought I was going crazy and miss-spelled the admin name (long and short) when creating the account. I rebooted from the install disc and went to the change password utility to check the name of the account and to reset the password. As it turns out the account was not available in the utility (it wasn't in the dropdown list, only root was there) so I fired up terminal to discover that no accounts were created by the setup process. The rest of the OS appears to be there and fine, but nothing in /Users.
I tried running dscl from the terminal app on the install disc, but it's not there!
*Any suggestions? Has anyone experience this before?* I tried searching for a couple hours and couldn't find an similar situations. I am currently running the install again and will choose standard instead of the advanced setup option (the VERY first install that I borked the settings on was done as standard and it worked fine...)
Thanks!

As expected Standard worked fine. Not sure what's up with the advance setup not actually setting anything up though.

Accounts being created for internet fraud.

Dear Skype Users!
The group of people using English and German languages for the creation of internet-sending-money fraud has been discovered working actively in Skype accounts. The signs of these people are constantly being renovated profiles of US Army generals and oficers, sometimes civil high-positioned representatives. They can be easily recognized with USA national flag as profile picture wallpaper, pictures in military uniforms of different army departments taken from oficial US authorities websites, slogans which use the name of God like "In God We Trust". However countries of origin for profiles are different or changing. The cheating procedure is going on as follows. They approach user's contact lists as pending request for the new users to be instructed how to move in Skype. When accepted they try to make out as much as possible about the treated person, distinguish age category and income level. Normally they choose young girls, housewives and elder women. After a couple of days they call without video, speak English with West Indian or American accent and choose the tactic according to target's age. Sometimes they offer the girl to marry himself, sometimes to receive a parcel with inheritage or a treasure. The marks how to discover the cheating offer is the amount of money value written first in numbers and immediatelly after in written letters in brackets like this: 1 000 000 $ (one million US dollars). Main point is the "client" should send out relatively small portion of money afterwards for flight to her future fiancee, for delivery of the parcel, bank deposit via special post and so on.
So, the moment such offer appears you should know what happens. I applied to Skype admin to help for elimination of these cheating schemes from the system. But without help of users who should block these people with "abuse" sign it will never be successful.
With respect and good wishes,
Elena
This post was transferred from its previous location to create its own new topic here; its subject and/or title has been edited to differentiate the post from other inquiries and to reflect the post's content.

Dear Skype users,
Here is typical application from a frauder/scammer collected from communication after he/she sends a pending request for contact:
[20:23:38] *** Gen Scot Robinson would like to add you on Skype
Enter a message to introduce yourself.
Dear trusted friend,
Season Greetings and Good Tidings to you and your Family. With due respect to you and your entire family over there, I hope it’s well with you and your family.
My names are General David Anderson a United States Army General presently serves here in Syria as the current Commander, International Security Assistance Force (ISAF) and Commander, U.S. Forces Syria.
I am in desperate need of your assistance, I have summed up courage to contact you as my Brother, Sister and a friend, I am seeking your assistance to move the sum of (USD$ 22.7 Million) Twenty Two Million Seven Hundred Thousand United States Dollars to you as far as you will assured me that my share will be safe in your care until I complete my service here in Syria. This is no stolen money and there is no danger involved.
Some money in various currencies was discovered in barrel at a farm house in the current Syrian Civil War as a result of clashes between President Bashar al-Assad's government and rebel forces who want him out or step down [Link to BBC news article - 404 error - redacted by Moderator] and it was agreed by staff Sgt. Kenneth Buff, General David Miller, and I that some part of this money be shared among us before informing anyone about the discovery, this was quite illegal thing to do but I tell you what, no compensation will make it up for the risk we have taken our lives in this hell whole of which my colleague was killed by a road side bomb last week.
The above figure was given me as my share to cancel this kind of money became a problem for me, so with the help of a British contact working here and his office enjoys some immunity I was able to move the money to a security company in the United States as a diplomatic consignment. They are waiting for me to provide the name of the end receiver who they will deliver the parcel to, as a soldier I can not present myself as the direct owner of this funds it against our code of conduct we are not allowed to do business and the US Government is planting a close watch on all military personnel that is why I need you to help me receive this funds.
The moment I get a response from you. that you are willing to help me I will forward all the details of the security company in the United States to you, so that you can contact them for immediate release, I want you to tell me how much you will accept for helping me to receive this funds.
One more passionate appeal please do not discuss this issue with anyone, and please if you don't like this mail please destroy this message as any leakage of this information will be too bad for us soldiers here in Syria, this is the other reasons I will mention later has prompted me to reach you for help, I honestly want this matter to be resolved immediately please get back asap, my only way to communicate is by email: [e-mail removed for privacy and security]
I am willing to give you 30% out of the total funds. What is your own opinion?
My private email: [e-mail removed for privacy and security]
Yours in service,
Gen Scott Robinson

Accounts Being Created With My Email

I've just recieved about three emails saying that I have created three separate Skype accounts. I have not created these accounts, and it seems to be the work of spammers. Can they be deleted and prevent any forms of my email address from being able to create accounts?
I have recieved emails that say that michaelsquitieri1, michaelsquitieri12, and michaelsquitieri121 were all created from one email address.

you can contact customer service ([email protected]) tp report this incident and to request to unlink your email address from those unauthorized accounts.
CONTACT SKYPE CUSTOMER SERVICE | HOW TO RECORD SKYPE VIDEO CALLS | HOW TO HANDLE SUPICIOUS CALLS AND MESSAGES | WINDOWS PROBLEMS TROUBLESHOOTING | SKYPE DOWNLOAD LINKS
MORE TIPS, TRICKS AND UPDATES AT
skypefordummies.blogspot.com

How can I install Thunderbird without a "Special Account" being created

A new installation of Thunderbird is creating a "Special Account", the name of which I need to use for another account. I cannot change the name of the "Special Account" and the new account must use that name but TB will not accept two accounts with the same name. I have read an explanation of the special account and I do not need it or want it. I need to know how to prevent the creation of the special account. Is there some part of an earlier installation buried in the Registry or elsewhere which I need to delete? I have installed TB on other computers without this problem.

Yes, there is a local folder special account in every single installation that has ever occurred in Thunderbirds 10 years of existence.,
So perhaps you could explain what the issue is so we might be able to understand and advise on how to do what your trying to do.

How to get rid of automatically created Mail and iCal accounts on client?

I have recently setup an OS X 10.6 Server for our small office. I got the domain name wrong in the initial install and fixed this by doing a complete clean reinstall of OS X 10.6 server (now upgraded to 10.6.4).
The problem is that one of the OS X 10.6.4 clients had been setup to talk to the server prior to the rebuild. Now on this client, I cannot work out how to get rid of or change the automatically created server accounts in iCal and Mail - everytime you login, these are recreated using the old domain name (and of course don't work).
In Mail if you remove the server account (from Accounts in Preferences), it just pops back again. I even removed every trace of the old domain name from the apple.com.mail.plist file but when I re-open Mail that darned server account (with the old domain name) just pops up again.
In iCal its slightly different in that you can remove the account and it stays away while you have iCal open. But as soon as you close and re-open it, that server account just pops up again!
I thought it might be something to do with Kerberos and found a Kerberos file on the client which had the old domain name throughout it - I changed all these references to the new domain name, but still the same behaviour in Mail and iCal.
This is doing my head in. Any ideas?

I have the same problem. Every time that I open iCal on the client a new account is created and an error message shown that I cannot login. I can delete the wrong account in the iCal preferences. However, as soon as I restart, the account and the error message are back.
How do I "unbind" and "rebind" a client? I searched the "Mac OS X Server
Open Directory Administration Version 10.6 Snow Leopard" but the only reference to "binding" seems to be in the context of Active Directory which I don't have.
Any help is greatly appreciated.

Hot to get rid of automatically created Mail and iCal accounts on client?

I have recently setup an OS X 10.6.2 Server for our small office. I got the domain name wrong in the initial install and fixed this by doing a complete clean reinstall of OS X 10.6 server (then upgrade to 10.6.2).
The problem is that one of the OS X 10.6.2 clients had been setup to talk to the server prior to the rebuild. Now on this client, I cannot work out how to get rid of or change the automatically created server accounts in iCal and Mail - everytime you login, these are recreated using the old domain name (and of course don't work).
In Mail if you remove the server account (from Accounts in Preferences), it just pops back again. I even removed every trace of the old domain name from the apple.com.mail.plist file but when I re-open Mail that darned server account (with the old domain name) just pops up again.
In iCal its slightly different in that you can remove the account and it stays away while you have iCal open. But as soon as you close and re-open it, that server account just pops up again!
I thought it might be something to do with Kerberos and found a Kerberos file on the client which had the old domain name throughout it - I changed all these references to the new domain name, but still the same behaviour in Mail and iCal.
This is doing my head in. Any ideas?

I have the same problem. Every time that I open iCal on the client a new account is created and an error message shown that I cannot login. I can delete the wrong account in the iCal preferences. However, as soon as I restart, the account and the error message are back.
How do I "unbind" and "rebind" a client? I searched the "Mac OS X Server
Open Directory Administration Version 10.6 Snow Leopard" but the only reference to "binding" seems to be in the context of Active Directory which I don't have.
Any help is greatly appreciated.

Internal Order not being created in cProjects-Accounting Integration

Dear All,
We are working on cProjects 4.0 with ECC 6.0,
Trying to do Accounting Integration.
For only one Project I am able to create Internal Order,
But I am getting following error.
Cost/revenue rate YP002 is not valid in organization 00000000
Inspite of assigning these rates to the organization 00000000
For other projects, when I click on accounting:
I get following error
"Single-Obj.Controlling on InternalOrders 0188993B3E343947A046B554FD886E03 000006000032 does not exist"
When I go to Controlling Cockpit, I see this Internal Order not being created.
Have revisited all settings, project type, etc.
How do I go about this.
Kindly help,
Navendu

Dear All,
I was able to solve the one of the problem, with the following settings,
Assign Cost Elements & Activity Types:
Choose Organization, Start & End Dates, Cost and Revenue Elements, Currency.
The start and end date of the cost/ revenue did not fall within the start and end date of the Organization.
Regards,
Navendu Shirali

I have set up another account with a different email which is not mine. AN email has been sent to this email to verify the account, how do i stop this being created?

I have set up another itunes account by accident. I do not have access to this email as it must belong to someone else. An email verification to set up a new account has been sent to this email know. How do I stop this account from being created?

To change accounts on your Mac, go to System Preferences, sign out of the current account, then sign into the new account. When you sign out of the current account it will delete synced data from your Mac. Assuming your data (such as contacts, calendars, etc.) is in the other iCloud account, it will be synced to your Mac when you sign into this account.

How to delete events on iCal that were created many years ago with a MobileMe account?

I have never ending recurring events on iCal that I created years and years ago with my MobileMe account. I don't have access to that email anymore, unfortunately. Is there any way to get rid of these silly things?

Navi,
What Calendars are listed in your sources pane?
Where are they located?
Are you using iCloud?
Backup that specific calendar using Calendar>File>Export>Export..., and save the copy to your Desktop.
What happens if you attempt to delete that specific calendar?

How are different user names being created on my Apple ID accounts??

I can no longer access the Guest Account on my IMac running Snow Leopard. Guest account says I have the wrong pwd? Funny thing is I never gave it a pw! Once before I found the Guest Account configured in a lower layer IFrame with several missing programs from my personal account being used by it. No one else has physical access to my Imac, although I often see activity and references to Remote Desktop in my logs and source files.
Recently had to have a FirmWare PW removed from my IMac and I've never set the fw pw in the first place. After the firmware reset when I got home and turned it on first time, tells me it doesn't recognize my administrator /user pws? Can these strange but true issues be related? Am I hacked? If so how do I begin to untangle it all? I did go ahead and set the FW password this time as I don't want anyone else to set it for me and have to go through that ordeal again. Is this something I should do, or not? How else can I protect my IMac, from these rogue changes and settings/menu/program alterations that keep happening. these things seem to happen in spite of several virus, anti spam, security programs I've installed; or any other security steps I've always tried to follow to prevent being hacked.
Started to reinstall Snow Leopard from original disc this evening and Utility tab shows two other volumes installed, that's three total; one being Boot Camp, the other Untitled. I never installed any of these except SL from the original disc. It appears I neither have full access to these other 2 partitions as the i button only shows partial information. Also the verify permissions, users, etc buttons do not allow me to repair, or do anything with these other volumes. Now I'm afraid to try and use the os disc without someone's more knowledgeable guidance, and/or wisdom. I've already made 2 trips to local Apple Store, plus the 3 hour round trip to authorized tech center to get the FW pw reset, so I'm hoping someone on the forum might be able to help me out this time .. argh!

HI Suzie,
Not to alarm you, but it does seem somebody got nto your Mac Remotely.
Disconnect from the Internet & try reinstaliling the OS... can you afford to erase & install?
Do you have backups?
ClamXAV, free Virus scanner...
http://www.clamxav.com/
Free Sophos...
http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-mac-home-ed ition/features.aspx
http://www.sophos.com/products/enterprise/endpoint/security-and-control/mac/
Little Snitch, stops/alerts outgoing stuff...
http://www.obdev.at/products/littlesnitch/index.html

AD account logging to a remote domain controller for authentication

Hi,
I have a weird issue with an AD account using a different logonserver when authenticating to AD. A domain admin account uses the local site domain controller but another account is using a remote domain controller as logonserver. I'm using both account
to logon to the same server (CRM 2011). But when I issue the command "set l' from the command line, they shows different logonserver value.
My issue is the crm account is pointing to a remote domain controller (windows 2012 R2) which I don't want and should use the local site domain controller (windows 2008 R2). The reason being is that the CRM server is on a test network (isolated) and
when we test an upgrade of CRM addon product called Experlogix, the upgrade requires to get authenticated by AD but it fails and I think the logonserver is the issue. When the crm account is used on the test server it points not to the local site domain controller
but to the remote dc which is not in the test server.
Thanks for your help!!!
AA

Start by checking that your are sites and subnets are well configured.
Use dssite.msc and make sure that:
You have AD sites that represent your physical sites
All the subnets in use are created and moved to the correct AD site
Your DCs belong to the correct AD site
You can read more about the DC Locator process here: http://social.technet.microsoft.com/wiki/contents/articles/24457.how-domain-controllers-are-located-in-windows.aspx
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

How to "redo" iCal accounts

Seems like after upgrading to 10.5.3, I've started experiencing many different issues, several of which I have been following on these posts. I'm wondering if anyone knows a simple way to delete all iCal accounts to start from scratch (without having to reinstall OSX or anything like that). I'm at the point with my iCal Server situation that I'd like to just nuke the entire directory of calendars and have all my users start over again and create new calendars.
It's really quite frustrating, but hey, sometimes you have to clear the board and get a fresh start right?
Appreciate any help!

Kia ora Fireball08,
I will describe what we had, and then what we did.
We needed a calander at work, we are dentists and needed a simple computerised appointment book. I bought Leopard server for that and we fired it up and away we went.
I installed server as the basic dumby setup, I didn't turn on any additional services other than ical, filesharing and ichat. It seemed to go OK running on a G4 dually tower and serving to one G4 macmini (the receptionist) and another G4 tower, and I use a printed daysheet, but had my calendar client was on my macbook.
We had 2 main calendars (the two dentists) and the receptionist, who was a delegat of both. Reception made all the appointments and had R/W access to the two calendars.
I did not turn on DNS (no one said at that stage I had too!) and we did not use kerebos.
To get the calendars working I had to put in the ip address of the server etc as we kept getting the cant find principals error when configuring the icals. The only problem was slow updating and a peculiar situation where the receptionists calendar had all the appts OK but my macbook had lots of gaps. So somehow her macmini was the only complete calendar.
Any way, this was all to get it ready for replacing the reception macmini with two intelmini's and installing server on a 2.66 ghz imac.
I was running out of time and had our local mac-dealer I.T. man install Leopard server but he could not get the ical part going, he configured DNS and all the other services but could not get the group webcalendar going even after installing 10.5.3. He got busy doing things that worked (far more satisfying I'm sure) so, I got the imac back and then with the OSX server book (Mac os x server essentials second edition) I tried to get it going and I did (I think! -- you can never be too sure!!).
In our situation it was due to DNS and iCal to begin with. When you do the dumby setup and name you server it gets called whateveryouwant.com. We gave ours a .com suffix. The computer was called, lets say fishbreath (the name of the drive/machine). The fully qualified domain name would be servername.com, in this case whateveryouwant.com.
This is where it seemed to go all weird, the nameserver host name was servername.suffix but according to the book, it should be computername.servername.suffix, so in our case it would be fishbreath.whateveryouwant.com. We set it so.
In serveradmin the iCal service/settings however had the ical server name as whateveryouwant.com only. I gave it the full name, fishbreath.whateveryouwant.com, I also changed the authentication to Any Method and restarted ical and away it went. In workgroup manager I also made sure each user was pointed to the iCal server in user/advanced, enable calendaring selecting the correctly named ical server, now fishbreath.whateveryouwant.com (previously just whateveryouwant.com)
By now our setup was 3 dentists (the main calendars) with 2 receptionists and a back office emac as delegates of the other three (still served off the G4 dualy) and about 6000 events, increasing by about 70 per day. Two of the dentists clients had complete calendars, and one receptionists had all three as did the back office, but my calendar on my macbook had holes in it and the other receptionist was incomplete.
We then went live with the imac installation. Having re-populated the new server with all the accounts, by hand there are only 9 user accounts, and re-populated the calendars with a ical backup from the complete receptionists account. It seemed to be OK but one receptionist computer would not refresh and we were getting the cog of pathetic failure. I could get things going by restarting iCal but it would grind to a halt 2 hours later, to the minute.
The error logs for DNS and iCal showed authentication errors. The authentication was set to any, but some clients were trying to use Kerebos, and the error was due to a certificate error or something.
I first exported the client calendars on the two complete dentists local machines and my one on the back office machine.
And following advice from the boards I opened directory(the application, not the utility) on each client selected preferences and in preferences selected password (some were set on Kerebos). Then deleted the ical accounts, on the user clients (not the server), in ical preferences and re-created them. And made sure network prefs had the ip of our server dns and the search domain name had the domain name of our server.
I then reimported the exported calendars back into the accounts and its been humming along since then. The ical log still has lots of errors but it works well, updates all clients and delegates when changes are made instantly, so we are happy. Our wiki and group web calendar is going now as well.
So to reiterate for us it was DNS, then iCal, then Utility Ap, then delete ical account on client and re-create it. I don't think I've forgotten anything, but I will check the settings tomorrow at work, Late Sunday night here, you can't expect too much!!
regards

Allow Non-Administrator accounts to create event sources and write to event logs

We are setting up BizTalk 2013 in Windows Server 2012 and one of the requirements is to allow the service account to create sources and write in event logs (Application) of the BizTalk servers. We have found what it seems to be a simple solution for this
without giving service accounts local admin rights.
Give Full control for the following registry keys to the service accounts or groups to allow creating of event sources and write to event logs:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security
Note: when changing permissions for EventLog key, the child keys will inherit the permissions by default except Security key which must be done manually.
Initial tests using a .net test app seems to work as expected. New event sources are being created in the event logs and writing to the event logs after that works perfectly.
The above method has been deployed in production and this is the most suitable solution for us.

Hi Keong6806,
Thanks a lot for posting and sharing here.
Do you have any other questions regarding this topic? If not I would change the type as 'Discussion' then.
Best Regards,
Elaine
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

ICal Account being created as @me domain

Similar Messages

Maybe you are looking for