SHPT-00-000440 - SharePoint must protect audit information from unauthorized deletion of usage and health logs.


If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.

To ensure the veracity of audit data the information system and/or SharePoint must protect audit information from unauthorized deletion.

SharePoint is an integrated product with comprehensive built-in auditing capabilities that works with the Windows system event log. Additional trace logs and usage logs are created by the application and are placed in a designated folder. Logs of actions taken by users of site content (editing, modifying, viewing, deleting, etc.) are stored in a SQL database.


Change permissions to the directory where usage data collection is stored.
1. In Central Administration, click Monitoring.
2. On the Monitoring page, in the Reporting list, click Configure usage and health data collection.
3. Obtain the Log file location for the Usage Data Collection Settings.
4. Navigate to the file location, right-click, and select Properties. View the Security tab.
5. Delete any groups or users other than the LOCAL SERVICE, WSS_ADMIN_WPG, WSS_RESTRICTED_WPG_V4, WSS_WPG, local Administrators group and SYSTEM group from the permissions list.

See Also

Item Details


References: 800-53|AU-9, CAT|II, CCI|CCI-000164, Rule-ID|SV-36598r2_rule, STIG-ID|SHPT-00-000440, Vuln-ID|V-28094

Plugin: Windows

Control ID: c55ff97a962ed1cbb64b66ed0afe1e332f7aa966158d753ddd78b9fbad55c990