Permissions

While the module has extensive tests to verify access, here are the permission requirements.

Administrator

Only necessary if using WinEvent as an Alert Method where alerts are written to the Application Event Log.

Administrator permission is needed to register a new Source in the Application Event Log. Once the source is registered, Administrator permission is no longer needed. The command to register WebsiteFailedLogins as a source is as follows.

New-EventLog -LogName Application -Source WebsiteFailedLogins

Standard User

A standard user has enough permission to run this module as long as the following are met.

1. Read access to IIS log files.
2. Read & Exec permission of Logparser.exe

Scheduled Task

The recommended implementation is to run as a scheduled task. This requires the user account running the scheduled task to have the User Rights Assignment: Log on as a batch job (SeBatchLogonRight).