Internet Information Services (IIS) 6 Resource Kit

Enable Security Auditing

Microsoft® Windows® Server 2003 uses security and system logs to store collected security events. Before enabling the system and security logs, you need to enable auditing for the system log and establish the number of events you want recorded in the security log. You customize system log events by configuring auditing. Auditing is the process that tracks the activities of users and processes by recording selected types of events in the security log of the Web server. You can enable auditing based on categories of security events such as:

• Any changes to user account and resource permissions.

• Any failed attempts for user logon.

• Any failed attempts for resource access.

• Any modification to the system files.

The most common security ...