Re: (remotely/automatically) Detecting IIS changes?

From: Tom Kaminski [MVP] ((A@T))
Date: 03/20/03 

From: "Tom Kaminski [MVP]" <tomk (A@T) mvps (D.O.T) org>
Date: Thu, 20 Mar 2003 11:22:35 -0500

"Ralph" <ralphlos@hotmail.com> wrote in message
news:1d2901c2eef9$adf3ab10$a601280a@phx.gbl...
> Hi all, I'm working with a team which has been tasked with
> the goal of using a product such as TripWire to detect
> changes (both intentional and otherwise) within our IIS
> servers. Maybe someone can suggest a particular
> file/files/folders/registry keys to watch for changes in?
> I can only think of the global.asa file, but that's lately
> changed to my knowledge.
> For example, we'd like to be alerted when an
> administrator creates a new "Virtual Root" anywhere on the
> IIS box. This is often done hap-hazardly and the IIS admin
> team doesn't always report the creation of the site....so
> we'd like to come up with a way to monitor them....suggestions?

IIS stores most of it's config in the MetaBase at
\winnt\system32\inetsrv\metabase.bin, so that's what you'd have to watch. 

-- 
Tom Kaminski IIS MVP
http://mvp.support.microsoft.com/
http://www.microsoft.com/windowsserver2003/community/centers/iis/

Relevant Pages

  • (remotely/automatically) Detecting IIS changes?
    ... the goal of using a product such as TripWire to detect ... changes within our IIS ... administrator creates a new "Virtual Root" anywhere on the ...
    (microsoft.public.inetserver.iis.security)
  • Re: (remotely/automatically) Detecting IIS changes?
    ... > the goal of using a product such as TripWire to detect ... > changes within our IIS ... > servers. ... The first thing that comes to mind is the metabase. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Kerberos
    ... Just select the interface you wish to monitor and then click the "Capture" button. ... I enable Kerberos logging but I don't see any new entries in the Event Log. ... Make it work in IIS to get a sense on how it works ... I created a test.htm page and when i hit it, I check the security event log and it is still using NTLM. ...
    (microsoft.public.inetserver.iis.security)
  • Re: MOM and security for IIS
    ... > I am planning to install MOM to manage and monitor our system. ... > I see some options in MOM related to "IIS Hacking Control". ... using a firewall device with intrusion detection or alerting or scripting to ...
    (microsoft.public.win2000.security)
  • IIS Metabase
    ... Laut Knowledge Base Q201638 und TechNet will da der Performance ... Monitor Daten lesen, kann es aber nicht, da die entsprechenden Dienste ... Dazu muss sie natürlich den IIS ... wer oder was da auf die IIS Metabase zugreifen ...
    (microsoft.public.de.german.win2000.sonstiges)
Quantcast