http://blogs.msdn.com/ericfitz/archive/2006/03/01/541462.aspxA question I get asked frequently: what are the default ACLs on Windows event logs? Here's the answer, straight from the source code with only a little formatting help from me, and in more detail than you probably care to know. Windows 2000: Applicationen-USCommunityServer 2.1 SP1 (Build: 61025.2)http://blogs.msdn.com/ericfitz/archive/2006/03/01/541462.aspx#541657Thu, 02 Mar 2006 02:44:16 GMT91d46819-8472-40ad-a661-2c78acb4018c:541657Dana Epp's ramblings at the SanctuaryNote to self: Eric has a good post about the default ACLs on the Windows event log, as taken directly from the source code. Included is the Windows Server 2003 defaults, including the equivalent SDDL. Useful information to compare to my hardening codehttp://blogs.msdn.com/ericfitz/archive/2006/03/01/541462.aspx#543999Sun, 05 Mar 2006 18:08:10 GMT91d46819-8472-40ad-a661-2c78acb4018c:543999int for(ensic){blog;}Eric Fitz took the trouble to search the Windows sources for default access control lists of the various event logs. He posted his findings for Windows 2000, XP with Service Pack 2 and Windows Server 2003 in the Windows Auditing...http://blogs.msdn.com/ericfitz/archive/2006/03/01/541462.aspx#693465Wed, 09 Aug 2006 20:33:40 GMT91d46819-8472-40ad-a661-2c78acb4018c:693465Luminos Cerebrae