5

We had some issues with a user connecting through OWA. This user used to be a server admin.

Upon checking today, all IIS logs have been removed up to and including sept 30 (the day the issues were diagnosed). We do have a back-up and of course all the passwords on the servers and accounts have been changed, and I've checked the system logs - there doesn't seem to be an IP matching that particular user's address.

The "security"-logs seem to have been purged, but there is no log event that the logs have been purged. There are also several other event logs (such as RDP) not showing the IP and dating well back into August. It seems like those logs are actually hitting their max size of 20MB and then doing some form of logrotate.

Of course, attempting to be an as good sysadmin as I can be, I'm a total controlfreak. Can anyone explain to me whether it's possible that Windows automatically purges logs every 3 months? Or can this be done webbased? (we only have OWA/ECP for Exchange 2013).

I also noticed that the physical server is running low on disk... Could that be a reason?

Dave M
  • 4,494
  • 21
  • 30
  • 30
QuintenVK
  • 173
  • 3
  • 5
    Or the reason could be that the annoyance consisted of your ex-admin doing some unspecified unauthorized things and removing the evidence... This is a very good reason to send at least auth logs off to another server instead of storing them all locally. – Jenny D Oct 03 '13 at 14:20
  • 2
    possible duplicate of [How do I deal with a compromised server?](http://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server) – Jenny D Oct 03 '13 at 14:21
  • If the (virtual) server had been accessed it would've been visible in the logs of the physical server (since someone had to log on through RDP there if they wanted to access it) - not the case. Furthermore, there's no erased RDP logs on the server where the logs were pruned either. Because of this I'm strongly believing that the server hasn't been compromised. – QuintenVK Oct 03 '13 at 14:28
  • `This user used to be a server admin.` as in used to be and still employed there or as in used to be and no longer works there? If they still work there, ask them point blank. If they don't they should have never had access to do what they did once they stopped being an employee (including even logging into OWA). – TheCleaner Oct 03 '13 at 14:30
  • Used to be an employee. Logging on to the OWA happened through a shared mailbox (so no files were accessed). The shared mailbox's password has been changed as well, obviously. – QuintenVK Oct 03 '13 at 14:36
  • Man, there are way better ways to do shared mailboxes in exchange than shared passwords. – Falcon Momot Oct 03 '13 at 19:41
  • I know, but that was the situation once I got there. This isn't even my full-time occupation on the job... Though I'm stressing several issues towards management. – QuintenVK Oct 03 '13 at 23:12

1 Answers1

1

Logs are automatically purged (on a time- or size-based rotation) because disk space is finite. Keeping every log entry forever would fill even the largest of disks quickly, and every operating system does some kind of log pruning.

While that answers your question, it doesn't solve your problem: Someone who should not have access to your servers clearly still does (at least through OWA).
I suggest reviewing How do I deal with a compromised server? as others have suggested, and deciding how to proceed based on the feedback given there.
I also strongly advise forcing a password change for all users - If this person is logging in to things as an ex-employee who knows what other shady bits they may be retaining (copies of everyone's passwords, mayhaps?).

After that you can start thinking about a real security policy for your company so the next time you fire someone you can be sure all access is properly revoked...

Community
  • 1
voretaq7
  • 79,345
  • 17
  • 128
  • 213
  • Thank you for your answer; I hadn't found anything about logs being automatically purged (at least not by IIS). On the matter of passwords: I have asked everyone to change their passwords indeed (and confirm it towards me, and yes i do test if they don't use default passwords anymore). I was, indeed, planning on a security policy. The company is getting better slowly but surely. – QuintenVK Oct 03 '13 at 19:00
  • @QuintenVK I'm not sure how log rotation is configured in Windows (I'm sure someone around here knows though) - it's also possible the logs WERE maliciously cleared by this individual. When in doubt I think you're justified in assuming the worst, especially with no logs proving otherwise.... – voretaq7 Oct 03 '13 at 19:12
  • Let me explain. The exchange server runs on hyper-V. There are event logs on the hyper-V machine, which don't show any records for RDP sessions around the time of pruning (note: the server is behind a firewall). The same goes for event logs on all the virtual machines. There are literally no traces to be found at all, while this guy isn't the most subtle type. – QuintenVK Oct 03 '13 at 19:14