How to configure access auditing for storage and for configuration in ISA Server 2000 and in ISA Server 2004

This article describes how to configure Microsoft Internet Security and Acceleration (ISA) Server 2000 Standard Edition and ISA Server 2004 Standard Edition to audit changes that are made to the ISA Server storage container and to the ISA Server configuration.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

By default, ISA Server does not audit changes that are made to its storage container or to its configuration. However, you can configure ISA Server to perform basic auditing of any such changes. When auditing is enabled in ISA Server, an event is generated whenever a user creates, modifies, or removes an access rule. Additionally, an event is logged in the security log. This event provides a user account name, and it also records the time and the date when the change was made. To configure auditing, follow these steps. Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1. Enable auditing on the server where ISA Server is installed. To do this, follow these steps:
   1. Click Start, point to Settings, click Control Panel, double-click Administrative Tools, and then double-click Local Security Policy.
   2. Expand Local Policies, and then click Audit Policy.
   3. In the details pane, double-click Audit object access.
   4. Click to select the Success check box, and then click OK.
   5. Close the Local Security Settings dialog box.
2. Configure a system access control list (SACL) on the ISA Server policy storage container. To do this, follow these steps:
   1. Click Start, click Run, type regedt32 in the Open box, and then click OK.
   2. Locate and then click the following registry subkey:
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fpc
   3. On the Security menu, click Permissions.
   4. Click Advanced, click the Auditing tab, and then click Add.
   5. Click the Everyone group, and then click OK.
   6. In the Access list, click to select the Query Value check box under Successful.
   7. Click OK three times.
   8. Quit Registry Editor.
3. Configure a SACL on the folders that contain ISA Server files. To do this, follow these steps:
   1. Locate the ISA Server installation folder. By default, the folder resides in the following location:
      Drive:\Program Files\Microsoft ISA Server
   2. Right-click the Microsoft ISA Server folder, and then click Properties.
   3. Click the Security tab, click, Advanced, click the Auditing tab, click Add, click Everyone, and then click OK.
   4. In the Success and in the Failed columns, click to select all the available Access permissions check boxes.
   5. Click OK two times.
   6. Locate the WinDir\system32\drivers folder, where WinDir is the folder where Windows is installed.
   7. Right-click the Drivers folder, and then click Properties.
   8. Click the Security tab, click, Advanced, click the Auditing tab, click Add, click Everyone, and then click OK.
   9. In the Success and in the Failed columns, click to select all the available Access permissions check boxes.
   10. Click OK two times.
4. Important Complete step 4 only if you have ISA Server Enterprise Edition.
   
   Warning If you use the ADSI Edit snap-in, the LDP utility, or any other Lightweight Directory Access Protocol (LDAP) version 3 client, and you incorrectly modify the attributes of objects in the Active Directory directory service, you may cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, ISA Server 2000, ISA Server 2004, or both Windows and ISA Server. We cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be resolved. Modify these attributes at your own risk.
   
   Verify the SACL on the ISA Server for the Array Storage and for the Enterprise Storage containers by using the ADSI Edit utility that is located in the Windows Server 2003 Support tools folder:
   1. Start the ADSI Edit utility. This utility is included with the Windows Support Tools feature. To install these tools, right-click Suptools.msi in the Support\Tools folder on the Windows Server 2003 CD, and then click Install. Follow the steps in the Windows Support Tools Setup Wizard to complete the installation of the Windows Support Tools components. To start ADSI Edit, click Start, click Run, type adsiedit.msc in the Open box, and then click OK.
   2. Expand Domain NC, expand DC=YourDomain, expand DC=Root Domain, and then expand CN=System.
   3. Right-click CN=Fpc, and then click Properties.
   4. Click the Security tab, click Advanced, click the Auditing tab, make sure that the Everyone object is selected, and then click View/Edit.
   5. In both the Successful and the Failed columns, verify that the following permissions are selected:
      • Write All Properties
      • Delete
      • Delete Subtree
      • Modify Permissions
      • Modify Owner
      • All Validated Writes
      • All Extended Writes
      • Create Child Objects
      • Delete All Child Objects
      • Create msFPCGlobalSettings Objects
      • Delete msFPCGlobalSettings Objects
      • Create msFPCVendorParametersSets 0
      • Delete msFPCVendorParametersSets 0
      Note Additional permissions may already be selected on your server. These permissions represent the minimum recommended auditing settings for ISA server storage.
   6. Click OK three times.
   7. Quit the ADSI Edit utility.

After you follow these steps, the following events are logged in the security log when a user creates, modifies, or removes an access rule.

Note The event descriptions differ, depending on the policy modifications that the user makes. When a user opens the policy storage container to modify a policy, the following event is logged: When a user closes the policy storage container after changing a policy, the following event is logged: Both of these events are generated every time ISA Server writes to the access control policy. Because ISA Server writes to the policy in three different places for each user-defined access rule, six events appear in the security log when a change is made to the access control policy.