DOCUMENT:Q115285 08-AUG-2001 [winnt] TITLE :New Auditing Feature for FTP Server PRODUCT :Microsoft Windows NT PROD/VER:3.5 OPER/SYS: KEYWORDS:kbnetwork ====================================================================== ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Windows NT Workstation version 3.5 - Microsoft Windows NT Server version 3.5 ------------------------------------------------------------------------------- SUMMARY ======= There is a new registry value "LogFileAccess" in Windows NT Workstation and Windows NT Server version 3.5 that enables the FTP server's creation of a LOG file. When this setting is enabled the FTP server will create a text file called FTPSVC.LOG located in the services current directory (usually %SystemRoot%\System32). The LOG file will contain three types of entries: ************** FTP SERVER SERVICE STARTING ************** FTP SERVER SERVICE STOPPING where: is the current date/time, such as "Fri Feb 13 17:49:21 1995" is the user's host IP address, such as "22.101.3.212" is the name of the user (or anonymous ID), such as "janedoe" is the action taken, either "opened", "created", or "appended" is the full path and filename, such as "e:\users\default\file.txt" Following is an example of what a FTPSVC.LOG file's contents might look like: ************** FTP SERVER SERVICE STARTING Fri Feb 13 15:50:25 1995 22.101.3.212 janedoe opened e:\nt.555\mstools\api32wh.ind Fri Feb 13 15:50:40 1995 22.101.34.22 johndoe created c:\users\johndoe\report.txt Sat Feb 14 12:20:05 1995 ************** FTP SERVER SERVICE STOPPING Sun Feb 15 15:54:31 1995 MORE INFORMATION ================ In order to enable the logging feature follow the steps outlined below: WARNING: Using Registry Editor incorrectly can cause serious, system-wide problems that may require you to reinstall Windows NT to correct them. Microsoft cannot guarantee that any problems resulting from the use of Registry Editor can be solved. Use this tool at your own risk. 1. Start REGEDT32.EXE and locate the following Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\FTPSVC\Parameters 2. From the Edit menu, choose Add Value. Enter LogFileAccess in the Value Name field. Select REG_DWORD for the Data Type. Enter 1 in the String field. Save your changes. 3. Exit REGEDT32. 4. Exit Windows NT and turn off your computer. 5. Restart your computer and Windows NT. The new FTP server logging should now be enabled. Additional query words: prodnt ====================================================================== Keywords : kbnetwork Technology : kbWinNTsearch kbWinNTWsearch kbWinNT350search kbWinNTW350 kbWinNTW350search kbWinNTSsearch kbWinNTS350 kbWinNTS350search Version : 3.5 ============================================================================= THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. Copyright Microsoft Corporation 2001.