Starting / Stopping IIS 5.0...

External Since: Sep 02, 2003 Posts: 4

To anyone who can help -

Is there a way to generate an audit trail, for when IIS 5.0 is starts or
stops normally, that also includes info on where the request to start/stop
came from (ie if the request can from an executable, then be able to record
the name of the executable and the credentials used to run it).

I've already looked at the audit options that IIS itself offers (it can
record when it was started/stopped but doesn't say who or what made the
request).

Thanks in advance,
Shane

External Since: Dec 29, 2003 Posts: 9

Application event log will record the domain/username in its descript field. Source being IISCTLS with and Event Id 1 and 2.
HTH
KP