PowerShell日志文件文件系统权限

Question

I have written a function that writes log files for my scripts. The first time the function is used, it writes a log file in the directory and the name of the script. Every subsequent run, log messages are attached to the file.

So far, so good. Against all odds, other people are starting to use my scripts now! The scripts are mainly used by administrators with local admin rights on servers. But they all get errors when writing to the log file. To my understanding, when you access files with rights provided by the „Administrators“ group, you must be in elevated privilege mode. But I don't want that. I manually tried to assign modify to the „Users“ group, but then „Administrators“ seem to take precedence.

Anyone any idea what rights to set (and/or to revoke) and how to achieve this in PowerShell?

Answer 1

As Ansgar Wiecher comments, you should probably look into using the Event Log service instead.

With event logs, you only need elevated privileges the first time one of the scripts run, in order to create the log and register the event source, after that anyone can write to it:

function Write-MyLog {
  param(
    [Parameter(Mandatory = $true)]
    [string]$Message,

    [Parameter(Mandatory = $true)]
    [ValidateRange(1,65535)]
    [int]$EventId,

    [Parameter(Mandatory = $false)]
    [System.Diagnostics.EventLogEntryType]$EntryType = 'Information'
  )

  # Prepend PID and script path to message
  $PSBoundParameters['Message'] = '[{0}: {1}]{2}{3}' -f $PID,$MyInvocation.ScriptName,[Environment]::NewLine,$Message

  # Set event log target
  $PSBoundParameters['LogName'] = $logName   = 'LeosEvents'
  $PSBoundParameters['Source']  = $logSource = 'LeosScripts'

  if (-not (Get-WinEvent -ListLog $logName -ErrorAction SilentlyContinue)) {
    # Create event log and source if it doesn't exist already 
    # This is the only step that requires elevation, can be created via GPO if desired
    New-EventLog -LogName $logName -Source $logSource
  }

  # Write event log entry
  Write-EventLog @PSBoundParameters
}