On Error Resume Next

const HKEY_CURRENT_USER = &H80000001
const HKEY_LOCAL_MACHINE = &H80000002

'You can control these values     
strComputer = "."                                      'Local computer script is running on
strRegRoot = HKEY_LOCAL_MACHINE     'Hive you want to read or write to
strValueName = "CustomSD"                    'Value name that you want to change
strValType = "string"                                 'Data type of the value - functions are written to recognize "string" and "dword"

'each section below define the root key to make changes in     
strKeyPath = "SYSTEM\CurrentControlSet\Services\Eventlog\Application"
strRegValue = "O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x1;;;S-1-5-21-203831685-1093892477-926709054-95542)"
Call WriteRegKey(strRegRoot,strKeyPath,strValueName,strValType)
wscript.echo vbTab & "Application event log security updated"
 
strKeyPath = "SYSTEM\CurrentControlSet\Services\Eventlog\System"
strRegValue = "O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x1;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;LS)(A;;0x2;;;NS)(A;;0x1;;; S-1-5-21-203831685-1093892477-926709054-95542)"
Call WriteRegKey(strRegRoot,strKeyPath,strValueName,strValType)
wscript.echo vbTab & "System event log security updated"
wscript.exit 0

'--------------------------------------------------------------------
'    Functions
'--------------------------------------------------------------------
Function ReadRegKey(strRegRoot,strKeyPath,strValueName,strValType)
 Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

If ucase(strValType) = "DWORD" Then
 oReg.GetDWORDValue strRegRoot,strKeyPath,strValueName,strRegValue
ElseIf ucase(strValType) = "STRING" Then
 oReg.GetStringValue strRegRoot,strKeyPath,strValueName,strRegValue
end if

ReadRegKey = strRegValue
End Function
 
'-------------------------------------------------
Function WriteRegKey(strRegRoot,strKeyPath,strValueName,strValType,strRegValue)
 Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

If ucase(strValType) = "DWORD" Then
 oReg.SetDWORDValue strRegRoot,strKeyPath,strValueName,strRegValue
ElseIf ucase(strValType) = "STRING" Then
 oReg.SetStringValue strRegRoot,strKeyPath,strValueName,strRegValue
end if

End Function