So I have this ASP.NET application that insists on placing its temp files directly in the Windows directory. AND it doesn't use any kind of extension. So how do you allow this without making the windows folder vulnerable?
Here is an example of the event:
TESTMODE: The process 'C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe' (as user NT AUTHORITY\NETWORK SERVICE) attempted to access 'C:\WINDOWS\2Z1J1J1Q1Q8Q8Q8X'. The attempted access was a write (operation = OPEN/CREATE). The operation would have been denied.
Wow, crazy! Okay do this:
- create a new File Access Control rule
- set to Priority Allow
- choose your application (in my case, ASP.NET)
- check Read and Write
- create new File Set
- Directories matching: @windows
- Files matching: ????????????????
- but not: *.*
Okay so here is what this does. I compared all the events, and I noticed that the random file is always exactly 16 standard characters, with no extension. The question mark (?) is a single alphanumeric wildcard. By wildcarding the exact size of the string, but not allowing anything with a period (. for an extension), I now have a file set that matches what I need to exclude.
Hope that helps someone with a similar oddity.
Thank you Richard!
Great response. I have similar problem. The difference is that this actually never happens - the .Net application tries to write to that default location, but it does not succeeds, because of security restrictions, but the event is actually logged.
Do you know of a way to get around this?
Sure, I have a complete .NET module built from scratch to take care of this. But you probably don't need the whole thing - can you post a sample event?