Access to the EventSentry configuration is automatically restricted to members of the local Administrators group, or Domain Admins group on domain controllers. Members of the Users and/or Domain Users groups do not have permission to view or edit the EventSentry configuration.
The entire EventSentry configuration is stored in the registry, and you can authorize additional users by adding individual users or groups to the ACL of the registry. The configuration is stored in the following key:
You can change permissions by using "regedit.exe" on Windows Server 2003 and Windows XP, or "regedt32.exe" when using Windows 2000 or earlier.
In either case, you need to make sure that the user the EventSentry service runs under (LocalSystem by default) has full access to the EventSentry registry, otherwise the agent will not be able to function properly.