URLScan creates log files that record rejected requests . Log files are located in the following folder:
%windir%\system32\inetsrv\urlscan
Log files are named using the following convention: URLScan<date>.log.