How to Enable Logs in "Microsoft-IIS-Configuration/Operational" in IIS

Question

Hi everyone,

I'm currently working on enhancing the security monitoring of my IIS server, and I came across the "Microsoft-IIS-Configuration/Operational" section in the logs within the event viewer.

I have a few questions:

1. How can I enable logging for this specific section?
2. What exactly is logged in the "Microsoft-IIS-Configuration/Operational" section? I’m particularly interested in understanding the details of the logs stored here and how they can be leveraged for security auditing and monitoring. Are these logs relevant for identifying potential configuration changes or security-related activities?
3. Where can I find detailed information or documentation about what exactly is logged in this section?

Any guidance or resources on how to activate and effectively use these logs for security auditing and monitoring purposes would be greatly appreciated.

Thanks in advance for your help!

Answer 1

Hi @Ali Refahiati ,

1. Open Command Prompt and enter the following commands.

• Lists additional logs available for IIS: wevtutil el | findstr -i IIS
• Configuration for the selected log: wevtutil gl Microsoft-IIS-Configuration/Operational
• Enable the selected log: wevtutil sl /e:true Microsoft-IIS-Configuration/Operational

When enabled, the default path for this log is C:\Windows\System32\winevt\Logs\Microsoft-IIS-Configuration%4Operational.evtx.

2. The Microsoft IIS Configuration Operational log captures the additional and removal of IIS modules. By enabling this logging, you’ll be able to detect any backdoor installations and unauthorized modifications to your system in real-time. This is a critical security measure that can help you safeguard your data and ensure the smooth operation of your web services. You can learn more about it from this Microsoft official blog.

Best regards,

Jinlei Shuang

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread