Ensure 'ETW Logging' is enabled

MediumLevel 1Automatediis

Description

Event Tracing for Windows (ETW) is a Windows feature that allows Administrators to send logging information to another location. This information is then compiled on the server and can be queried. siteDefaults logFile logTargetW3C must include ETW (File,ETW = both log file and ETW event). PowerShell 5.1 with the WebAdministration module; run elevated. CIS marks this recommendation Manual; the automated check implements its audit procedure.

How it is checked

Audit method: Shell command

shell

Import-Module WebAdministration -ErrorAction Stop; $c = Get-WebConfiguration -Filter 'system.applicationHost/sites/siteDefaults/logFile' -PSPath 'MACHINE/WEBROOT/APPHOST'; if ([string]$c.logTargetW3C -match 'ETW') { 'compliant' } else { 'noncompliant' }

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.applicationHost/sites/siteDefaults/logFile -Name logTargetW3C -Value 'File,ETW'

Properties

Operating systems: Any
Tags: iislogging
Reference: CIS Microsoft IIS 10 Benchmark v1.2.1 - 5.3 Ensure 'ETW Logging' is enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target iis