STIGQter: STIG Summary: Microsoft IIS 10.0 Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The log information from the IIS 10.0 web server must be protected from unauthorized modification or deletion.

DISA Rule

SV-218790r561041_rule

Vulnerability Number

V-218790

Group Title

SRG-APP-000120-WSR-000070

Rule Version

IIST-SV-000115

Severity

CAT II

CCI(s)

• CCI-000164 - The information system protects audit information from unauthorized deletion.

Weight

10

Fix Recommendation

Open the IIS 10.0 Manager.

Click the IIS 10.0 web server name.

Click the "Logging" icon.

Click "Browse" and navigate to the directory where the log files are stored.

Right-click the log file directory to review and click "Properties".

Click the "Security" tab.

Set the log file permissions for the appropriate group(s).

Click "OK".

Select "Apply" in the "Actions" pane.

Check Contents

This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.
Open the IIS 10.0 Manager.
Click the IIS 10.0 web server name.
Click the "Logging" icon.
Click "Browse" and navigate to the directory where the log files are stored.
Right-click the log file directory to review.
Click "Properties".
Click the "Security" tab.
Verify log file access is restricted as follows. Otherwise, this is a finding.
SYSTEM - Full Control
Administrators - Full Control

Vulnerability Number

V-218790

Documentable

False

Rule Version

IIST-SV-000115

Severity Override Guidance

This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.
Open the IIS 10.0 Manager.
Click the IIS 10.0 web server name.
Click the "Logging" icon.
Click "Browse" and navigate to the directory where the log files are stored.
Right-click the log file directory to review.
Click "Properties".
Click the "Security" tab.
Verify log file access is restricted as follows. Otherwise, this is a finding.
SYSTEM - Full Control
Administrators - Full Control

Check Content Reference

M

Target Key

4052

Comments