Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am attempting to monitor changes to IIS server configuration with TripWire, and have noticed the IIS 6.0 MetaBase.xml file is frequently changed. I understand that IIS frequently backs up the MetaBase, but why would values for the various ACL and password entries change with each revision?

The values that change:

New revisions are triggered by simply opening iis.msc, even though none of the settings are changed.

share|improve this question
I know this doesn't answer the question why, but you can track metabase changes through Windows auditing instead of using TripWire: – boflynn Jul 2 '09 at 18:07
Thanks, good idea, I will try that. – Eric H Jul 3 '09 at 11:21
up vote 2 down vote accepted

It appears to be salting the vaues on each export.

These propeties are all "SECURE" properties (see and Microsoft makes an attempt to obscure them in the XML file.

The encryption appears to be "salted" with the timestamp, version number, or both (I can't get a clear description of the algorithm anywhere) of the XML file. It appears that the IIS management snap-in calls the IIsComputer.SaveData ( API and that, in turn, writes a fresh XML export with the newly-salted values.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.