Writing to the Windows Event Log from ASP.NET with a custom app pool account
<p>I am trying to write to the windows event log from ASP.net. The app pool is running under a domain account rather than Network Service.</p>

<p>I've got everything working on my development environment, but there is a catch. Because the app pool runs as a domain account, I had to add <code>(A;;0x0002;;;AU)</code> to the <code>Application\CustomSD</code> registry key to allow Authenticated Users access to the event log. This is fine on my development box, but verbotten on the production server. (No registry tweaking, they say. Find another way.)</p>

<p>From what I've learned, the default event log on Windows Server 2k3 SP2 only allows logins with the <code>LOGON32_LOGON_INTERACTIVE</code>, <code>LOGON32_LOGON_BATCH</code>, or <code>LOGON32_LOGON_SERVICE</code> flags set on their user sessions.</p>

<p>Is there a way to add one of these flags to the app pool's login? IIS does not set the flags when it starts an app pool. I've looked at using <code>LogonUser</code> to create a temporary security context with the correct flags, but that requires storing a password somewhere and I want to avoid that if possible.</p>

<p><em>Any ideas on how to allow IIS to write to the event log using a custom app pool account without modifying the registry on Windows Server 2k3 SP2?</em></p>

<p>EDIT: I can't add the app pool account to the local admins group either, because of security restrictions.</p>

<p><em>Resources</em><br>
<a href="http://west-wind.com/weblog/posts/1572.aspx" rel="nofollow">Using programmatic Impersonation from an ASP.NET Page</a><br>
<a href="http://bethmassi.blogspot.com/2006/03/allowing-impersonated-accounts-to.html" rel="nofollow">Allowing impersonated accounts to write to your custom event log</a></p>
