| Vuln ID | Severity | Asset | STIG | Title | Status | Doc Status | Assigned To | Actions |
|---|---|---|---|---|---|---|---|---|
| V-218790 | CAT II | SCHR-P3-DP-001 | Microsoft IIS 10.0 Server Security Techn... | The log information from the IIS 10.0 web server m... | - | |||
Check TextThis check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. Open the IIS 10.0 Manager. Click the IIS 10.0 web server name. Click the "Logging" icon. Click "Browse" and navigate to the directory where the log files are stored. Right-click the log file directory to review. Click "Properties". Click the "Security" tab. Verify log file access is restricted as follows. Otherwise, this is a finding. SYSTEM - Full Control, This folder, subfolders and files Administrators - Full Control, This folder, subfolders and files Note: A "Web Administrators", etc., type group that is an approved group of administrators is also allowed, and must be given "Full Control, This folder, subfolders and files" permissions. Fix TextOpen the IIS 10.0 Manager. Click the IIS 10.0 web server name. Click the "Logging" icon. Click "Browse" and navigate to the directory where the log files are stored. Right-click the log file directory to review and click "Properties". Click the "Security" tab. Set the log file permissions for the appropriate group(s). Click "OK". Select "Apply" in the "Actions" pane. Finding DetailsEvaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) was unable to determine a Status but found the below configuration on 03/05/2026: ResultHash: 47C2704EC787A78914769229C4FEA868D5EB6FA8 ~~~~~ Path: C:\inetpub\logs\LogFiles OverallState: Less restrictive than Expected [finding] Compliance: Not Compliant Unexpected rules... --------------------- State: LessRestrictive Compliant: False Identity: CREATOR OWNER Type: Allow Basic: FullControl Expected: N/A Advanced: AppendData, ChangePermissions, CreateDirectories, CreateFiles, Delete, DeleteSubdirectoriesAndFiles, ExecuteFile, ListDirectory, ReadAttributes, ReadData, ReadExtendedAttributes, ReadPermissions, TakeOwnership, Traverse, WriteAttributes, WriteData, WriteExtendedAttributes Expected: Inherited: C:\inetpub\logs AppliesTo: Subfolders, Files Summary: Unexpected Rule: A rule with rights 'FullControl' was found on the system but was not defined in the expectation. State: LessRestrictive Compliant: False Identity: NT SERVICE\TrustedInstaller Type: Allow Basic: FullControl Expected: N/A Advanced: AppendData, ChangePermissions, CreateDirectories, CreateFiles, Delete, DeleteSubdirectoriesAndFiles, ExecuteFile, ListDirectory, ReadAttributes, ReadData, ReadExtendedAttributes, ReadPermissions, TakeOwnership, Traverse, WriteAttributes, WriteData, WriteExtendedAttributes Expected: Inherited: C:\inetpub\logs AppliesTo: This, Subfolders, Files Summary: Unexpected Rule: A rule with rights 'FullControl' was found on the system but was not defined in the expectation. --------------------- CommentsLog file access is restricted only authorized system accounts have access to IIS log files. This is Not a Finding
Source: SCHR-P3-DP-001_IIS10Server_V3R6_20260305-132942.cklb
Scan Date: 2026-03-12T15:38:14.420977
Technology Area: Web Review
|
||||||||