windows server 2003 file auditing

5 pts.
Tags:
Auditing
IIS
Internet Information Services
Security audits
Windows Server 2003
I activated auditing on the local security policy and then defined auditing on a file being accessed as part of our site through IIS. Even tons of people are accessing that script to view our site, no events are appearing in the event viewer about this activity.

Answer Wiki

Thanks. We'll let you know when a new response is added.

I think this happens because normally IIS has its own processes to access files and Windows 2003 doesn’t audit <i>IUSR_xxxxx</i> and <i>IWAM_xxxxxx</i> users.
Try and change the access information to that file to another user with not too much privileges and try again; this should populate your logs with audit information.
Anyway if you are doing this for monitoring purposes this isn’t the recommended solution.

A better solution would probably be to include some code within the website file which logs into a database and logs the hits there.

You could also setup the page to send a Microsoft Message Queue message so that if the database is down the data is still logged. This would require that some software be written to read the queue and process the data within the message.

Discuss This Question:  

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following