Friday, February 08, 2008 11:31 AM
by
Rick
Configuring Windows to Audit Common Security Issues
There are numerous issues that I have seen come up regarding IIS not working properly, and many of those are due to improper permissions. Many of these issues can efficently be tracked down by using Event Viewer -> Security. However, the default installation of Windows does not set everything needed to properly take advantage of this. Here are some settings that I recommend changing which will make initial troubleshooting easier.
We are first going to change the Local Security Policy by enabling failures of some policies. Go to Administrative Tools -> Local Security Policy. When the Local Security Settings window comes up, expand Local Policy and select Audit Policy. Select the following three policies and check the box for Failure to log failures of those events:
Audit account logon events
Audit logon events
Audit object access
Next you also want to turn on auditing for all the partitions on the computer if you are using Windows Server. To do that open up Windows Explorer, right click on a partition, and choose Properties. Click the Security tab in the properties window, then click the Advanced button. Select the Auditing tab in the Advanced Security Settings window, then click the Add button. Enter everyone and click OK. In the Auditing Entry dialogue box, check the Failed box on Full Control. That will cause all the boxes in the Failed column to be checked. Select ok all the way back out. Now disk level auditing is enabled.
You can look for security issues first when you have problems and enough information should now be logged to better assist you.