IIS log folder permissions not being inherited

Question

We have a Log folder set up on our web server, with permissions set for a specific AD group to be able to read it (developers who need to see error reporting, but who do not have administrator permissions to the box).

This works fine for logs that already exist, but whenever IIS creates a new sub folder (with the name pattern "W3SVCx"), the permissions from the parent folder do not inherit down. Instead, these folders are visible only to administrators.

How can we get IIS to write these logs with the correct inherited permissions, without giving administrator access to users who should not have it?

Answer 1

IIS creates the W3SVCx folders after the first request to a newly created site, it also sets the NTFS permissions on it regardless of the permissions of the parent folder and its inheritence settings. The permissions it sets are:

NT AUTHORITY\SYSTEM:(OI)(CI)(F)
BUILTIN\Administrators:(OI)(CI)(F)

I don't know of any way to tell IIS not to do this. You need to remember that after you set up a new site, hit it once and then set the permissions on the log folder.

If you set up many sites, use a script instead. I use PowerShell:

New-WebSite -Name "peter.superuser.com" -port 80 -id 106 -PhysicalPath "C:\inetpub\peter.superuser.com" -HostHeader peter.superuser.com
(New-Object System.Net.WebClient).DownloadString("http://peter.superuser.com")
start-sleep -seconds 1
& icacls.exe "C:\inetpub\logs\LogFiles\W3SVC106" /Q /grant "BUILTIN\Users:`(OI`)`(CI`)`(RX`)"

I first create the site, then hit the home page, wait a second and then set the permissions on the log folder.

If you don't know the Id of the site in advanced, use

$newId = (get-childitem IIS:\Sites | where{$_.Name -eq "peter.superuser.com"}).Id
& icacls.exe "C:\inetpub\logs\LogFiles\W3SVC$newId" /Q /grant "BUILTIN\Users:`(OI`)`(CI`)`(RX`)"

to get the Id after you created the site.

To use this you need to enable scripting for IIS, depending on your OS.

Answer 2

I use the following workaround on any new IIS 7/8 installation:

1. Set desired permissions on folder C:\inetpub\logs\LogFiles

2. Modify existing log folders to inherit permissions

   icacls C:\inetpub\logs\LogFiles\W3SVC* /inheritance:e
   

3. Pre-populate the first 99 log folders W3SVC1...W3SVC99 so that they inherit permissions before IIS even tries to create one of them. IIS does not modify permissions when a log folder already exists.

   REM cmd style
   for /l %%G in (1,1,99) do md C:\inetpub\logs\LogFiles\W3SVC%%G
   
   # PowerShell style
   1..3 | % { md C:\inetpub\logs\LogFiles\W3SVC$_ }   
   

It's not pretty, but it gets the job done.

Answer 3

I created my site using Powershell, so I added the following to create the exact folder based on the Site ID.

Import-Module WebAdministration
$iisAppName = "MySite"
$site = Get-ItemProperty IIS:\Sites\$iisAppName
$folderName = "W3SVC" + $site.id    #Create a folder based on the actual site id
$iisLogPath = "C:\MyLogFolder"
$folderPath = Join-Path $iisLogPath $folderName
New-Item -Path $folderPath -ItemType directory