Windows Server 2012 EventViewer Powershell Script error

This feels like a workaround, its too complicated for a simple and obvious security monitoring request but it works on w2012:

  • as an admin run regedit
  • nav to KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog
  • right click on 'Security'
  • click Permissions
  • add a group (like 'Event Log Readers')
  • select the group you added
  • check Read under Allow
  • exit regedit and add this group to users who need access
  • these users will need to log out and back in to activate

Yes others have found this before me http://powerkb.se/?p=614