winlogbeat/docs/getting-started.asciidoc: Document minimum permissions required for local user account

CHANGELOG.next.asciidoc

@@ -254,6 +254,7 @@ Setting environmental variable ELASTIC_NETINFO:false in Elastic Agent pod will d
 *Winlogbeat*
 
 - Make ingest pipeline routing robust to letter case of channel names for forwarded events. {issue}36670[36670] {pull}36899[36899]
+- Document minimum permissions required for local user account. {issue}15773[15773] {pull}37176[37176]
 
 *Functionbeat*
 

winlogbeat/docs/getting-started.asciidoc

@@ -150,6 +150,26 @@ Before starting {beatname_uc}, modify the user credentials in
 +{beatname_lc}.yml+ and specify a user who is
 <<privileges-to-publish-events,authorized to publish events>>.
 
+By default, the `winlogbeat` service runs as `Local System` account. If you want to run `winlogbeat` service as a local user account which is not an Administrator, follow the below steps. By following these steps, your local user account will be granted `Log on as a service` security policy and made part of group `Event Log Readers` to read the event log. (You can skip these steps if you want to continue running Winlogbeat as an Administrator.)
+
+. Open the Services Management console in Windows, if not already open by running this command:
+[source,shell]
+----------------------------------------------------------------------
+PS C:\Program Files\Winlogbeat> services.msc
+----------------------------------------------------------------------
+. Right-click on service named `winlogbeat` and select `Properties`
+. Under `Log On` tab, select `This account:` and browse for your local account user that you want to run `winlogbeat` service.
+. Enter local user account's password and click `Apply`.
+. Search and open `Local Group Policy Editor` in Windows search or run `gpedit.msc` from Powershell.
+. Navigate to path: `Computer Settings -> Security Settings -> Local Policies` and open `User Rights Assignment` under it.
+. Inside `User Rights Assignment`, add your local user account to the policy named `Log on as a service`. This should allow your local user account log on as a service.
+. Open `Local Users and Group Manager` by running `lusrmgr.msc` in Powershell.
+. Under `Users`, right-click on your local account user and open `Properties`.
+. Select `Member of` tab and click on `Add..`
+. Find and select the group named `Event Log Readers` and click `Apply`. This should allow your local account user to read the event log.
+
+NOTE: A force apply maybe required to apply the policy selected from `Local Group Policy Editor`. Run `gpupdate /force` from Powershell if you are having trouble starting up the `winlogbeat` service in next step.
+
 To start the {beatname_uc} service, run:
 
 // tag::start-step[]