Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am attempting to monitor changes to IIS server configuration with TripWire, and have noticed the IIS 6.0 MetaBase.xml file is frequently changed. I understand that IIS frequently backs up the MetaBase, but why would values for the various ACL and password entries change with each revision?

The values that change:
AdminACL
AnonymousUserPass
LogOdbcPassword
WAMUserPass
UNCPassword

New revisions are triggered by simply opening iis.msc, even though none of the settings are changed.

share|improve this question
1  
I know this doesn't answer the question why, but you can track metabase changes through Windows auditing instead of using TripWire: adopenstatic.com/faq/IISMetabaseAuditing.aspx –  boflynn Jul 2 '09 at 18:07
    
Thanks, good idea, I will try that. –  Eric H Jul 3 '09 at 11:21

1 Answer 1

up vote 2 down vote accepted

It appears to be salting the vaues on each export.

These propeties are all "SECURE" properties (see http://technet.microsoft.com/en-us/library/cc775980%28WS.10%29.aspx) and Microsoft makes an attempt to obscure them in the XML file.

The encryption appears to be "salted" with the timestamp, version number, or both (I can't get a clear description of the algorithm anywhere) of the XML file. It appears that the IIS management snap-in calls the IIsComputer.SaveData (http://msdn.microsoft.com/en-us/library/ms524872.aspx) API and that, in turn, writes a fresh XML export with the newly-salted values.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.