Re: URLSCAN.INI 0 Bytes in length

From: Jason Short (jason-nospam_at_nospam.org)
Date: 07/18/03


Date: Fri, 18 Jul 2003 04:40:40 -0400


OK, I have turned on auditing now for that file.

I just uninstalled and reinstalled the latest when SP4 seemed to kill it a
few weeks ago.

There are 10 websites running on this server (5 IP addresses). None are
very high traffic.

Mail Enable (most recent version with patches).

SQL Server 2000 (SP3).

Black Ice Server Version

I have another server identical to this one that I just set auditing on it
and am going to apply SP4 and see if I have any problems on it.

Jason

"Wei-Dong Xu [MSFT]" <v-wdxu@online.microsoft.com> wrote in message
news:LxlbDvNTDHA.2344@cpmsftngxa06.phx.gbl...
> Hi Jason,
>
> I'd suggest you check the event viewer and IIS logfiles. Perhaps we will
> find some information about this issue.
>
> I'd also suggest you use the audit tool to keep watching this file. You
can
> find the tool from the file's propeties->security->advanced->Auditing.
> Please add your account into the Auditing entries. If any event happens on
> this file, the event will be recorded into event viewer. This may give us
> more information on this issue.
>
> In addition, is your URLScan the latest version? It will be appreciated
you
> tell me more about your server and applications installed on it.
>
> Does this answer your question? Thank you for using Microsoft NewsGroup!
>
> Wei-Dong Xu
> Microsoft Product Support Services
> Get Secure! - www.microsoft.com/security
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>



Relevant Pages

  • Re: Deleted files
    ... > server but also have restrictions that will not allow the user to delete ... can event viewer see who deleted ... If you want to know who's doing what, look up auditing in the help tool. ...
    (microsoft.public.win2000.security)
  • Server Reboot from Bugcheck
    ... The computer has rebooted from a bugcheck. ... I am running W2K SP4, and the server is a Domain ...
    (microsoft.public.windows.server.general)
  • IP Loging
    ... what is the best way to make a win2000 server log the IP ... address on the event viewer, i enabled the security ... auditing on the server but i can olnly see the compute ...
    (microsoft.public.win2000.security)
  • Re: Auditing object access from network
    ... server with domain member clients accessing the target file structure via ... I want to audit file deletions in specific directories of a file server, ... NOT BY USERS ACCESSING FILES VIA THE NETWORK. ... Set up auditing ACLs for every entity in Active Directory, ...
    (microsoft.public.win2000.security)
  • RE: filenames changing
    ... Mal is right, let's turn on file auditing, and troll the security log ... the server resides, right-click on it and click Properties. ... On the Group Policy tab, select a GPO and click Edit (if there's no GPO ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)