Skip to main content
CUI

STIG Rule - V-218790

Back to STIG Browser

V-218790

SV-218790r1067580_rule

Deprecated CAT II

This rule has been deprecated. Deprecated on 2026-04-07. It is no longer included in the current version of this STIG.

The log information from the IIS 10.0 web server must be protected from unauthorized modification or deletion.

From: Microsoft IIS 10.0 Server Security Technical Implementation Guide (V3R6)

Description

<VulnDiscussion>A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the system administrator (SA) and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity. Satisfies: SRG-APP-000120-WSR-000070, SRG-APP-000118-WSR-000068, SRG-APP-000118-WSR-000069</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

Check Procedure

This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. Open the IIS 10.0 Manager. Click the IIS 10.0 web server name. Click the "Logging" icon. Click "Browse" and navigate to the directory where the log files are stored. Right-click the log file directory to review. Click "Properties". Click the "Security" tab. Verify log file access is restricted as follows. Otherwise, this is a finding. SYSTEM - Full Control, This folder, subfolders and files Administrators - Full Control, This folder, subfolders and files Note: A "Web Administrators", etc., type group that is an approved group of administrators is also allowed, and must be given "Full Control, This folder, subfolders and files" permissions.

Fix Text

Open the IIS 10.0 Manager. Click the IIS 10.0 web server name. Click the "Logging" icon. Click "Browse" and navigate to the directory where the log files are stored. Right-click the log file directory to review and click "Properties". Click the "Security" tab. Set the log file permissions for the appropriate group(s). Click "OK". Select "Apply" in the "Actions" pane.

CCI Reference

CCI-000164
Created
2026-01-14 17:55:45
Last Updated
2026-03-12 19:55:53
Back to Browse
CUI