Question

  Asked: May 12 2008   8:17 AM GMT
  Asked by: Tbarish


windows server 2003 file auditing


Auditing, Windows Server 2003, Security audits, IIS, Internet Information Services

I activated auditing on the local security policy and then defined auditing on a file being accessed as part of our site through IIS. Even tons of people are accessing that script to view our site, no events are appearing in the event viewer about this activity.

Subscribe to Alerts! Get questions and answers delivered to your Inbox.


E-mail me updates on this question



   SUBSCRIBE

hidden modal window

Answer Wiki (Improve, edit or add to this answer)


 RATE THIS ANSWER
0
Click to Vote:
  •   0
  •  0



I think this happens because normally IIS has its own processes to access files and Windows 2003 doesn't audit IUSR_xxxxx and IWAM_xxxxxx users.
Try and change the access information to that file to another user with not too much privileges and try again; this should populate your logs with audit information.
Anyway if you are doing this for monitoring purposes this isn't the recommended solution.

A better solution would probably be to include some code within the website file which logs into a database and logs the hits there.

You could also setup the page to send a Microsoft Message Queue message so that if the database is down the data is still logged. This would require that some software be written to read the queue and process the data within the message.
  • AddThis Social Bookmark Button

Browse more Questions and Answers on Security and Microsoft Windows.

Looking for relevant Security Whitepapers? Visit the SearchSecurity.com Research Library.


Discuss This Answer


You must be logged-in to discuss a question. Log-in/Register