[Winlogbeat] Document minimum permissions for Windows service user

[jguay]

Describe the enhancement:
At the moment, we document to install winlogbeat as service running by Local System account.

However there is no documentation for which permission to use with account with minimum permission or whether changing the account for the service is supported or not.

Describe a specific use case for the enhancement or feature:
From a quick test on Windows 2016, I needed to add “Manage auditing and security log” + “Logon as a service” permissions for the service to start correctly with a user which is not administrator.

[johncollaros]

This issue would seem pertinent to other beats such as metricbeat.
Our organisation is applying least privilege model securing our systems, and running as Local System account won't be possible. How can we find out what permissions are needed?

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

I think the minimum permissions is membership in BUILTIN\Event Log Readers. That will need to be tested before updating the docs. It is possible to modify the permissions of logs by changing their security descriptors using SDDL so if someone has done that then the default Event Log Readers group may no longer be sufficient for access.

[JumpyWizard404]

Hey guys if anyone is looking for information on this i managed to start the service after granting the account the following:

• “Manage auditing and security log” + “Logon as a service” via local GPO setting
• Full Control under two windows location: "C:\Program Files\Winlogbeat" and "C:\ProgramData\Winlogbeat"

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!