5.1 Ensure Default IIS web log location is moved

Information

IIS will log relatively detailed information on every request. These logs are usually the first item looked at in a security response, and can be the most valuable. Malicious users are aware of this, and will often try to remove evidence of their activities. It is therefore recommended that the default location for IIS log files be changed to a restricted, non-system drive.

Moving IIS logging to a restricted, non-system drive will help mitigate the risk of logs being maliciously altered, removed, or lost in the event of system drive failure(s).

Solution

Moving the default log location can be easily accomplished using the Logging feature in the IIS Management UI or AppCmd.exe. To change to D:\LogFiles using AppCmd.exe:
%systemroot%\system32\inetsrv\appcmd set config -section:sites - siteDefaults.logfile.directory:'D:\LogFiles'

Moving log file stores to a non-system drive or partition separate from where web applications run and/or content is served is preferred. Additionally, folder-level NTFS permissions should be set as restrictive as possible; Administrators and SYSTEM are typically the only principals requiring access.

Note: While standard IIS logs can be moved and edited using IIS Manager, additional management tool add-ons are required in order to manage logs generated by other IIS features, such as Request Filtering and IIS Advanced Logging. These add-ons can be obtained using the Web Platform Installer or from Microsoft's site. The HTTPErr logging location can be changed by adding a registry key

See Also

https://workbench.cisecurity.org/files/166

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9

Plugin: Windows

Control ID: bcda7a0ca23250150af380fb3e862c32d3b8910a8d69415eb1f02c89dbf1a9e2