145
IIS servers that host hundreds of sites can improve logging performance by enabling centralized
binary logging. Centralized binary logging enables all Web sites on an IIS server to write activity
information to a single log file. This can greatly increase the manageability and scalability of the IIS
logging process by reducing the number of logs that need to be individually stored and analyzed. For
more information on centralized binary logging, see the Microsoft TechNet topic, "Centralized Binary
Logging," located at:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/proddocs/server/log_binary.asp
.
When IIS logs are stored on IIS servers by default only server administrators have permission to
access them. If a log file directory or file owner is not in the
Local Administrators
group, HTTP.sys-the
kernel-mode driver in IIS 6.0-publishes an error to the NT Event log. This error indicates that the owner
of the directory or file is not in the
Local Administrators
group, and that logging has been suspended
for that site until the owner is added to the
Local Administrators
group, or the existing directory or log
file is deleted.
2.11.6.7
Manually Adding Unique Security Groups to User Rights Assignments
Most User Rights Assignments applied via the MSBP have the proper security groups specified in the
security templates that accompany this guide. However, there are a few accounts and security groups
that cannot be included in the templates because their security identifiers (SIDs) are specific to
individual Windows 2003 domains. User rights assignments that must be configured manually are
specified below.
Warning:
The following table contains values for the built-in
Administrator
account. Be careful not to
confuse
Administrator
account with the built-in
Administrators
security group. If the
Administrators
security group is added to any of the deny access user rights below, administrators will need to log
on locally to correct the mistake. In addition, the built-in
Administrator
account may have been
renamed based in some of the recommendations described in section 2.8. When adding the
Administrator
account, ensure the renamed account is specified.
Member Server
Default
Legacy Client
Enterprise Client
High Security
Deny access to this
computer from the
network
Built-in Administrator;
Support_388945a0;
Guest; all NON-
Operating System
service accounts
Built-in Administrator;
Support_388945a0;
Guest; all NON-
Operating System
service accounts
Built-in Administrator;
Support_388945a0;
Guest; all NON-
Operating System
service accounts
Important:
For all HP NAS server systems, administrators should only deny the Support_388945a0
account. NAS servers running only as IIS servers may also deny the Guest, and all NON-Operating
System service accounts.
Warning:
All non-operating system service accounts include service accounts used for specific
applications across an enterprise. This does NOT include LOCAL SYSTEM, LOCAL SERVICE or the
NETWORK SERVICE accounts which are built-in accounts the operating system uses.
2.11.6.8
Securing Well Known Accounts
Windows Server 2003 has a number of built-in user accounts that cannot be deleted but can be
renamed. Two of the most well known built-in accounts in Windows 2003 are
Guest
and
Administrator
. The
Guest
account is by default disabled on member servers and domain controllers.
This setting should not be changed. The built-in
Administrator
account should be renamed and the
description altered to help prevent attackers from compromising a remote server using a well known
account. Many variations of malicious code use the built-in administrator account in an initial attempt
