How can I monitor changes to IIS when neither FileSystemWatcher nor IIS-Configuration event log will report on System32 changes?

Question

We have to monitor changes to IIS 8.5 on 2012 R2, but...

The FileSystemWatcher Windows service I wrote works on anything except System32 subdirectories,
despite System having permissions on the inetsrv\config folder (cannot get Read permission on anything higher), and

The OOTB IIS-Configuration event log won't report manual changes to inetsrv\config\applicationHost.config 
     (e.g. via Notepad++).
	 

Doesn't make a difference where the FSW Windows service is installed. And IIS takes applicationHost.config changes immediately, without restart.

The business case is that Security said so. Any ideas?

Answer 1

Hi @Ronny Wombat ,

System32 is an important file on Windows&Windows Server, it stores many .dll files which systems running need. Microsoft doesn't recommend any one change the permission to affect its security.

If you change the permissions of this folder just to let FSW monitor the application host.config file, first I suggest you to give up using FSW. File permissions are the main reason.

IIS provides other ways to log changes to the applicationhost.config file. Using Configuration History with IIS 7 and IIS 8(In IIS 7.0 and above, we resolved this problem by creating a service that monitors for changes to the master configuration file, ApplicationHost.config, and periodically creates snapshots to later retrieve if necessary.）

It stores all history files in C:\inetpub\history.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best regards,
Bruce Zhang