Welcome to the Internet Information Services Lockdown Wizard

It is vital that you properly configure Internet Information Services (IIS) for security before putting it on the Internet. At a minimum, “properly configure” means that IIS should offer only the features and services that you need to offer, with any of the other services and features locked down. The Internet Information Services Lockdown Wizard (IIS Lockdown Wizard) is designed to help you properly configure IIS on your Windows server (NT 4.0 server or Windows 2000).

After using the IIS Lockdown Wizard, you must thoroughly test the server before putting it into production. If you find that the settings are not appropriate for your server, run the IIS Lockdown Wizard again and it will offer you the option to undo the changes that were made the previous time it was run.

Administrators can run the IIS Lockdown Wizard programmatically, allowing configuration across many servers through unattended scripts. For more information on running the IIS Lockdown Wizard unattended open the Word file, RunLockdUnattended.doc, in the directory containing the files for the IIS Lockdown Wizard.

Microsoft recommends using additional security resources such as hotfixes, security patches, and security checklists at the Microsoft TechNet Security Web site. This will help you achieve and maintain a secure server.


Select Server Template

The Select Server Template screen provides a list of IIS configuration templates with the names of additional software that works with IIS. Each template contains IIS configuration settings suitable for the software named. Selecting a template causes the IIS Lockdown Wizard to enable those IIS services required by the software. The other services are disabled.

Important Templates are provided as a first step to make it easy to lock down your server based on known product requirements. For some server environments, it may leave enabled functionality you do not require, for others it may disable functionality you need. After completing the Internet Information Services Lockdown Wizard, Microsoft recommends you read the UrlScan documentation, and tune the UrlScan.ini file to meet your specific needs. In addition, remember that no tool replaces the need for timely installation of service packs and hotfixes.

To view the IIS services that the selected template configures, click the View template settings check box. Clicking Next will bring up the Internet Services screen displaying the configuration of IIS that results from your selection of the server template. Leaving the View template settings check box empty will cause the Wizard to skip the screen that displays template settings.

If you need to configure the IIS Lockdown Wizard to run IIS with more than one of the services on the template list, you should select Other from the Server templates list and configure IIS as needed.

You can create custom server templates to run with the IIS Lockdown Wizard as needed. See “Creating a Custom Server Template” below.

Notes

  • To use the IIS Lockdown Wizard to configure IIS to work with Exchange Server, go to the Microsoft KnowledgeBase at the Microsoft Support Web site. Search on the title of the article (Windows/IIS Security Lockdown and Exchange) or the article number (Q309677).
  • To use the IIS Lockdown Wizard to configure IIS to work with SharePoint Portal Server 2001, go to the Microsoft KnowledgeBase at the Microsoft Support Web site. Search on the title of the article (“Using SharePoint Portal Server and the IIS Lockdown Wizard”) or the article number (Q309675).

Creating a Custom Server Template

Windows administrators can create custom server templates in the Iislockd.ini file for use with the IIS Lockdown Wizard. A custom server template appears in the IIS Lockdown Wizard as a configurable server template. Custom server templates can also be used when running Iislockd.exe unattended.

To create a custom server template

  1. Open Iislockd.ini in a text editor.
  2. In the [Info] section, type the name of the custom server template to the list of variables in either ServerTypesNT4 or ServerTypes as appropriate. In the source sample below, MyCustomServerTemplate is used for the custom server template.
  3. As a guide for the new custom server template, copy an existing server template, and then paste the server template at the bottom of Iislockd.ini.
  4. In the copied text, change the server template name denoted with square brackets to reflect the custom server template name entered in step 1. In the source sample below, the text is [MyCustomServerTemplate].
  5. Change the value for the label setting to describe the custom server template.
  6. Configure the server template feature settings to TRUE or FALSE.
  7. If you are installing UrlScan, change the value of the UrlScan_IniFileLocation setting to point to a custom UrlScan .ini file that this custom server template should use. A UrlScan .ini file from another server template can also be used.
  8. Save Iislockd.ini.

The following sample shows how Iislockd.ini file appears after completing the previous steps:

[Info]
ServerTypesNT4=sbs4.5, exchange5.5, frontpage, proxy, staticweb, dynamicweb , other, iis_uninstalled
ServerTypes=MyCustomServerTemplate, sbs2000, exchange5.5, exchange2k, sharepoint_portal, frontpage, biztalk, commerce, proxy, staticweb, dynamicweb, other, iis_uninstalled
UnattendedServerType=MyCustomServerTemplate
Unattended=TRUE
Undo=FALSE

[MyCustomServerTemplate]
label="My Custom Server Template"

Enable_iis_http=TRUE
Enable_iis_ftp= TRUE
Enable_iis_smtp= FALSE
Enable_iis_nntp= FALSE
Enable_asp= TRUE
Enable_index_server_web_interface= FALSE
Enable_server_side_includes= FALSE
Enable_internet_data_connector= FALSE
Enable_internet_printing= FALSE
Enable_HTR_scripting= FALSE
Enable_webDAV= FALSE
Disable_Anonymous_user_system_utility_execute_rights= TRUE
Disable_Anonymous_user_content_directory_write_rights= TRUE
Remove_iissamples_virtual_directory=TRUE
Remove_scripts_directory=TRUE
Remove_MSADC_virtual_directory=TRUE
Remove_iisadmin_virtual_directory=TRUE
Remove_iishelp_virtual_directory=TRUE
UrlScan_Install=DISABLED
UrlScan_IniFileLocation=
AdvancedSetup =
UninstallServices=TRUE


Internet Services

The Internet Services screen displays the default IIS services configuration for the template you have chosen. Each of the four services displays one of the following settings:

  • Enabled Displays a check mark on a white background. You can disable this service by clearing the check mark from the check box.

  • Enabled, recommending disabled Displays a cleared check box with a white background. You can disable this service by leaving the check box unchecked.

  • Disabled, not selectable The check box is grayed out. You do not have the option of enabling this service when using the server template you’ve chosen.

The IIS Lockdown Wizard can be used to lock down any or all of four IIS services by clearing the selected check boxes on the Internet Services screen.

If you are running the IIS Lockdown Wizard on Windows 2000, you have the option of uninstalling the unselected services by clicking on the Uninstall unselected services check box. If you are running NT4, you cannot use the IIS Lockdown Wizard to uninstall unselected services. You should use Add/Remove Programs from Control Panel.

Important For any services enabled on your server, you should either disable them or take the necessary steps to secure them. Apply security patches and hotfixes in a timely manner. Check the TechNet Web site regularly for the most recent security fixes and updates.

Note If you use the IIS Lockdown Wizard to install UrlScan, and then later use the IIS Lockdown Wizard to undo the server configuration, UrlScan will be disabled. If you want to uninstall UrlScan, you need uninstall it using Add/Remove Programs in Control Panel.


Script Maps

IIS provides a technology called Internet Services Application Programming Interface (ISAPI) that allows new capabilities to be added to a Web server. Several of the advanced features in IIS are implemented using ISAPI and can be disabled through a process known as removing their script maps.

This page lets you disable any or all of the advanced features by removing the default script maps and installing new ones that cause the server to respond with a “File not found” error if a visitor to your site requests a disabled feature. When necessary, the IIS Lockdown Wizard takes action to prevent disabled features from being automatically restored.

Important Disabling script maps is not a substitute for up-to-date security. You still need to install the current service packs and hotfixes. Check the Microsoft TechNet Web site regularly for the most recent security fixes and updates.

  • Active Server Pages (.ASP) ASP is a technology that lets you build dynamic Web pages. ASP files are essentially programs that, when requested by a user, execute on the server and generate HTML pages. The resulting HTML is sent to the user.
    Microsoft recommends that you enable ASP only if you are hosting ASP files on your Web server, using Outlook Web Access (OWA), or using other services that require ASP.

  • Index Server Web Interface (.IDQ) This feature allows you to remotely administer Index Server via the Web, as well as allowing users to create custom Web-based queries for Index Server. The IIS Lockdown Wizard sets a Deny ACE on the associated DLL, so that even if the script mapping is restored, the DLL cannot be loaded into the IIS process. If this feature is disabled, you can still configure your Web site to allow standard, but not customized, Web-based searches using Index Server.
    Microsoft recommends that you disable this feature unless you perform remote administration of Index Server via the Internet, or you need to provide users with the ability to create customized Web-based searches of your Web content.

  • Server-Side Includes (.SHTML, .SHTM, .STM) This feature enables the Web server to add text, graphic, or application information to a Web page before sending it to a user. For instance, a commonly used feature might be implemented in one file, and all Web pages that need that feature might perform a server-side include rather than implementing the feature individually.
    Microsoft recommends that you disable this feature unless Web pages on your site perform server-side includes. ASP implements an "Include" directive similar to SSI. If you use SSI scripts, Microsoft recommends that you convert the SSI scripts to ASP and enable Active Server Pages.

  • Internet Data Connector (.IDC) IDC is an older technology that performs database queries and displays the results within an HTML page. ASP replaces IDC. A tool is available to convert existing IDC scripts to ASP.
    Microsoft recommends that you disable this feature. If you have IDC scripts, you should convert them to ASP and enable ASP support.

  • HTR Scripting (.HTR) HTR is a first-generation scripting technology similar to ASP but with much more limited functionality. The only widely used HTR scripts are several that are included with IIS and enable logon passwords to be changed via a Web server.
    Microsoft recommends that you disable this feature unless you are using Outlook Web Access and password changes are required. If you have HTR scripts, you should convert them to ASP and enable ASP support.

  • Internet Printing (.printer) This feature allows you to send and manage print jobs on your network from across the Internet. The IIS Lockdown Wizard creates a local policy object that ensures the feature is permanently disabled.
    Microsoft recommends that you disable this feature unless you or your users need the ability to print documents on your network from across the Internet. If you choose to retain this function, you will need to enable Active Server Pages as well.


Additional Security

This page lets you take a number of additional actions to make your server more secure.

Remove Selected Virtual Directories

If the IIS Lockdown Wizard determines that the virtual directories for the feature exist and that they are mapped to the default locations, the IIS Lockdown Wizard deletes the virtual directories. It does not delete any data.

  • IIS Samples IIS provides a number of sample Web pages and scripts. These are for instructional use only, and should never be present on a production Web server. If there are no sample files on your Web server, the IIS Samples check box will be unavailable.
    Microsoft recommends that you remove sample files.

  • MSADC The MSADC virtual directory provides support for Web-based database operations via the Microsoft Advanced Data Connector and Remote Data Services. Web-based database services, if offered, should be carefully deployed to ensure that they cannot be abused by an attacker. If there is no MSADC directory on your server, the MSADC check box will be unavailable.
    Microsoft recommends that you remove the MSADC virtual directory, unless you use Remote Data Services (RDS) on this server to bridge Web clients to your database server. If you do use RDS on this server, you should ensure that you read Microsoft Security Bulletin MS99-025 , and secure the database.

  • IISHelp The IIS help files contain samples of Web pages and scripts. These are for instructional use only, and should never be present on a production Web server. If there are no IIS help files on your Web server, the IISHelp check box will be unavailable.
    Microsoft recommends that you remove the IIS Help files.

  • Scripts By default, IIS creates a virtual directory to house programs called scripts. Removing the directory ensures that the Web server cannot offer scripts, and improves security in two ways. First, it ensures that none of the default scripts are available for misuse. Second, it ensures that that an attacker who was able to gain some privileges on a Web server could not gain additional ones by adding scripts to the server and then executing them. If there is not a Scripts directory on your server, the Scripts check box will be unavailable.
    Microsoft recommends that you remove the Scripts virtual directory if your site does not require scripts. If your site does require scripts, consider moving them to a directory with a unique name in order to protect against automated attacks that blindly target the Scripts directory.

  • IISAdmin The IISAdmin folder contains scripts that can help administrators manage IIS. These scripts should never be present on a production Web server. If there is no IISAdmin directory on your Web server, the IISAdmin check box will be unavailable.
    Microsoft recommends that you remove IISAdmin files on production servers.

Set file permissions to prevent anonymous IIS users from performing these actions

  • Running system utilities (for example, Cmd.exe, Tftp.exe) By design, IIS allows the anonymous user account, (IUSR_<computername>) to access only directories that contain Web content. However, if this protection failed for any reason, an attacker would be able to run operating system utilities by virtue of the IUSR_<computername> account’s membership in the Everyone group. Selecting the Running system utilities (for example, Cmd.exe, Tftp.exe check box explicitly denies the IUSR_<computername> account the ability to run system utilities, and thus serves as an additional line of defense. When this check box is selected, the IIS Lockdown Wizard sets an ACE on all executable files in %windir% and its subfolders. The ACE denies execute privileges to all anonymous user accounts that have been configured on the server (including IUSR_<computername>), as well as all user accounts that are used for running Web applications (including IWAM_<computername>).
    Microsoft recommends that you prevent the IIS anonymous user account from executing system utilities.

  • Writing to content directories By design, IIS allows the anonymous user account IUSR_<computername> to only read Web content. However, if this protection failed for any reason, an attacker might be able to change the Web pages on the server, and thus deface the Web site. Selecting the Running content directories check box explicitly denies the IUSR_<computername> account write access to the directories that house Web content. When this check box is selected, the IIS Lockdown Wizard sets an ACE on all files and folders referenced by virtual directories—including files and folders that are located on remote computers. The ACE denies write privileges to all anonymous user accounts that have been configured on the server (including IUSR_<computername>), as well as all user accounts that are used for running Web applications (including IWAM_<computername>).
    Microsoft recommends that you prevent the IIS anonymous user account from writing to Web content directories.

Disable Distributed Authoring and Versioning (WebDAV)

WebDAV is a technology that allows authorized users to remotely create, deploy, manage, and share Web content. If your version of IIS does not support WebDAV, the Disable Web Distributed Authoring and Versioning (WebDAV) check box will be unavailable. When this check box is selected, the IIS Lockdown Wizard sets an ACE on the DLL that implements WebDAV functionality (Httpext.Dll), thereby preventing the DLL from being loaded into the IIS process.
Microsoft recommends that you disable WebDAV support unless you need it.

Note If you leave the Disable Web Distributed Authoring and Versioning (WebDAV) check box unchecked, WebDAV remains enabled, but UrlScan blocks WebDAV verbs in DenyVerbs, which effectively disables WebDAV. See the DenyVerbs section. Of the UrlScan help topic.


UrlScan

UrlScan is an ISAPI filter that screens and analyzes HTTP requests as Microsoft Internet Information Services (IIS) receives them. When properly configured, UrlScan is effective at reducing the exposure of IIS 4.0, IIS 5.0, and IIS 5.1 to potential Internet attacks.

Administrators may configure UrlScan to reject HTTP requests based on the following criteria:

  • The request method (verb)

  • The file extension of the resource requested

  • Suspicious URL encoding

  • Presence of non-ASCII characters in the URL

  • Presence of specified character sequences in the URL

  • Presence of specified headers in the request

In the event that a request is denied, UrlScan will log the action in the %windir%\system32\inetsrv\urlscan directory, along with the reason for the denial and information about the request – typically, the complete URL and IP address of the source of the request. When a denial occurs, IIS sends a "404 Object not found” response to the client. This simple response reduces the possibility of inadvertently disclosing information about the server to a possible attacker. Also, to further reduce the information sent to the client, the administrator has the option of deleting or altering the server header in the response.

UrlScan protects a server from attacks by filtering and rejecting HTTP requests for selected IIS service features. A default UrlScan.ini file is chosen based on your selection of a template and is placed in the %windir%\system32\inetsrv\UrlScan folder. The Dynamic Web server template is configured to accept requests for static HTML files – including graphics. The default UrlScan.ini file is configured such that UrlScan will reject the following types of requests:

  • CGI (.exe) pages

  • WebDAV

  • FrontPage Server Extensions

  • Index Server

  • Internet Printing

  • Server Side Includes

Each setting in UrlScan.ini contains comments describing the feature the setting is associated with. You will need to modify the default UrlScan.ini to accept HTTP requests for any of the IIS features listed above.

When using UrlScan with the IIS Lockdown Wizard the server template that you select chooses a UrlScan filter configuration that most closely matches your server environment. For some server environments, it may enable functionality that you do not require. For other server environments, it may disable functionality that you need. After completing the Internet Information Services Lockdown Wizard, Microsoft recommends that you use this UrlScan documentation to tune the UrlScan.ini file to meet your specific needs. For more information, see Running UrlScan.

Warning You cannot use the following files as a server template: urlscan_biztalk.ini, urlscan_commerce.ini, urlscan_dynamic.ini, urlscan_exchange5_5.ini, urlscan_exchange2000.ini, urlscan_frontpage.ini, urlscan_sbs2000.ini, urlscan_sharepoint_portal.ini, and urlscan_static.ini. These files are only data files that the Internet Information Services Lockdown Wizard uses to create server templates. A template will have the right configuration for the server type only if it was generated by the Internet Information Services Lockdown Wizard. Upon completion, the Internet Information Services Lockdown Wizard generates a server template, which you can access in %windir%\System32\Inetsrv\UrlScan\UrlScan.ini.

Important Be mindful that no tool replaces the need for timely installation of service packs and hotfixes. For each feature you set UrlScan to accept requests for, you should search for relevant security patches at the Microsoft TechNet Web site.

Installing UrlScan

You can install UrlScan using one of the following procedures:

  • If you choose to enable UrlScan while using the IIS Lockdown Wizard, UrlScan will be installed for you.

  • You can open the execute file, IISLockd.exe, and the file will step you through the installation.

  • Take the following steps in the IIS snap-in to install UrlScan manually as a global filter. UrlScan may be installed as a site filter, but it is recommended that it be installed as a global filter so that its functionality applies to the entire server:
    1. Copy UrlScan.dll and UrlScan.ini into a local directory on the server.

    2. Open the IIS snap-in.

    3. Right-click the server name (not the site name) under Internet Information Services in the MMC, and then select Properties.

    4. Verify that WWW Service is displayed in the Master Properties drop-down list, and click the Edit button.

    5. Choose the ISAPI Filters tab, and then click the Add button.

    6. In the Filter Properties window, type UrlScan, and enter the full path to UrlScan.dll in the Executable box.

    7. Select OK to close each dialog.

    8. Restart IIS.

Note If you use the IIS Lockdown Wizard to install UrlScan, and then later use the IIS Lockdown Wizard to undo the server configuration, UrlScan will be disabled. If you want to uninstall UrlScan, you need uninstall it using Add/Remove Programs in Control Panel.

Running UrlScan

When properly installed, UrlScan will run automatically whenever IIS is started. To confirm the operation of UrlScan, locate the log file, UrlScan.log, in the directory that contains UrlScan.dll. Unless UrlScan is configured with logging disabled, the log file will be automatically created by UrlScan and contains a report of the configured options each time the server is started.

The initialization file, UrlScan.ini, specifies the operation of UrlScan. This file must reside in the same directory as UrlScan.dll. UrlScan reads UrlScan.ini at initialization time only (for performance reasons). You must stop and restart IIS before any changes made to UrlScan.ini become effective.

The default options built into UrlScan.dll specify a configuration that will reject all requests to the server. UrlScan.ini is required for UrlScan to pass requests to be served. The default UrlScan.ini provided contains the recommended settings to defend against known attacks against IIS servers at the time of writing.

UrlScan.ini contains the sections listed below.

Options Section

The Options section configures the main options of UrlScan.

UseAllowVerbs — Allowed values are 0 or 1. Default is 1. If set to 1, UrlScan reads the AllowVerbs section of UrlScan.ini and rejects any request containing an HTTP verb that is not explicitly listed. The AllowVerbs section is case sensitive. If set to 0, UrlScan reads the DenyVerbs section of UrlScan.ini and rejects any request containing an HTTP verb listed. The DenyVerbs section is not case sensitive.

UseAllowExtensions — Allowed values are 0 or 1. Default is 0. If set to 1, UrlScan reads the AllowExtensions section of UrlScan.ini and rejects any request in which the file extension associated with the URL is not explicitly listed. If set to 0, UrlScan reads the DenyExtensions section of UrlScan.ini and rejects any request in which the file extension associated with the request is listed. Both the AllowExtensions and DenyExtensions sections are case insensitive.

NormalizeUrlBeforeScan — Allowed values are 0 or 1. Default is 1. If set to 1, UrlScan does all of its analysis on the request URLs after IIS decodes and normalizes them. If set to 0, UrlScan does all of its analysis on the raw URLs as sent by the client. Only advanced administrators who are very knowledgeable about URL parsing should set this option to 0, as doing so will likely expose the IIS server to canonicalization attacks that bypass proper analysis of the URL extensions.

VerifyNormalization — Allowed values are 0 or 1. Default is 1. If set to 1, UrlScan verifies normalization of the URL. This action will defend against canonicalization attacks, where a URL contains a double encoded string in the URL (i.e. The string "%252e" is a double encoded '.' character because "%25" decodes to a '%' character, the first pass decoding of "%252e" results in "%2e", which can be decoded a second time into '.'). If set to 0, this verification is not done.

AllowHighBitCharacters — Allowed values are 0 or 1. Default is 0. If set to 1, UrlScan allows any byte to exist in the URL. If set to 0, UrlScan rejects any request where the URL contains a character outside of the ASCII character set. This feature can defend against UNICODE or UTF-8 based attacks, but will also reject legitimate requests on IIS servers that use a non-ASCII code page.

AllowDotInPath — Allowed values are 0 or 1. Default is 0. If set to 0, UrlScan rejects any requests containing multiple instances of the dot (.) character. If set to 1, UrlScan does not perform this test. Because UrlScan operates at a level where IIS has not yet parsed the URL, it is not possible to determine in all cases whether a dot character denotes the extension or whether it is a part of the directory path or filename of the URL. For the purposes of extension analysis, UrlScan will always assume that an extension is the part of the URL beginning after the last dot in the string and ending at the first question mark or slash character after the dot or the end of the string. Setting AllowDotInPath to 0 defends against the case where an attacker uses path info to hide the true extension of the request (for example, something like "/path/TrueURL.asp/BogusPart.htm"). Setting AllowDotInPath to 0 also causes UrlScan to deny any request that contains a dot in a directory name.

RemoveServerHeader — Allowed values are 0 or 1. Default is 0. If set to 1, UrlScan removes the server header on all responses. If set to 0, UrlScan does not perform this action. Note that this feature is only available if UrlScan is installed on IIS 4.0 or later.

EnableLogging — Allowed values are 0 or 1. Default is 1. If set to 1, UrlScan logs its actions into a file called UrlScan.log, which will be created in the same directory that contains UrlScan.dll. If set to 0, no logging will be done.

PerProcessLogging — Allowed values are 0 or 1. Default is 0. If set to 1, UrlScan appends the process ID of the IIS process hosting UrlScan.dll to the log file name (for example, UrlScan.1234.log). This feature is helpful for IIS versions that can host filters in more than 1 process concurrently. If set to 0, the log file will be UrlScan.log.

AlternateServerName — Allowed value is a string. Default is an empty string. If this setting is present (the string is not empty) and if RemoveServerHeader is set to 0, IIS replaces its default "Server:" header in all responses with this string. If RemoveServerHeader is set to 1, AlternateServerName has no meaning. This feature is only available if UrlScan is installed on IIS 4.0 or later.

AllowLateScanning — Allowed values are 0 or 1. Default is 0. If set to 1, UrlScan registers itself as a low priority filter. This allows other filters to modify the URL before UrlScan does its analysis (note that in addition to this switch, it is necessary to ensure that UrlScan is listed lower on the filter list in the MMC "ISAPI Filters" property sheet for the server). If this value is set to 0, UrlScan runs as a high priority filter. Note that Front Page Server Extensions requires that this setting be 1 and that UrlScan is low on the filter load order list, preferably last.

PerDayLogging — Allowed values are 0 or 1. Default is 1. If set to 1, UrlScan creates a new log file each day and appends a date to the log file name (for example, UrlScan.101501.log). If both PerDayLogging=1 and PerProcessLogging=1 are set, the log file name contains the date and a process ID in the name (for example, UrlScan.101501.123.log). Note that with PerDayLogging, a log is be created for the current day (and the log for the previous day is closed) when the first log entry is written for that day. If a day passes with no UrlScan activity, no log is created for that day. If this value is set to 0, then UrlScan opens a single file called UrlScan.log (or UrlScan.xxx.log, where xxx is the process ID, in the case of PerProcessLogging=1).

RejectResponseUrl — Allowed value is a string. The default is /<Rejected-By-UrlScan>. This string is a URL in the form "/path/file_name.ext". In the event UrlScan rejects a request, it will run the specified URL, which needs to be local to the Web site for the request being analyzed by UrlScan. The specified URL can have the same extension (for example, .asp) as the rejected URL.

UrlScan creates the following server variables that can be used by the specified URL in determining the nature of the rejected request and to allow flexibility in returning the actual response to the client:

HTTP_URLSCAN_STATUS_HEADER Contains the reason the request is being rejected.

HTTP_URLSCAN_ORIGINAL_VERB Contains the original verb from the request that is being rejected.

HTTP_URLSCAN_ORIGINAL_URL Contains the original URL from the request that is being rejected.

UrlScan appends the URL of the request that is being rejected as a query string to the location specified by RejectReponseUrl. If IIS is configured to log request query strings, the URL of the rejected request can be found in the IIS log in addition to the UrlScan log.

There is a special value for RejectResponseUrl that can be used to put UrlScan into "Logging Only Mode." If you set the value of RejectResponseUrl to /~*, UrlScan performs all of the configured scanning and logs the results, however, it will allow IIS to serve the page even if it would normally be rejected. This mode is useful if you would like to test UrlScan.ini settings without actually rejecting any requests. Note that the log entries in the UrlScan log file will be clear that requests are not being rejected.

UseFastPathReject — Allowed values are 0 or 1. Default is 0. If set to 1, UrlScan ignores the RejectResponseUrl and return a short 404 response to the client in cases where it rejects a request. This is faster than allowing the full processing of the RejectResponseUrl, but if this option is used, IIS cannot return a custom 404 response or log many parts of the request into the IIS log (the UrlScan log file will still contain complete information about rejected requests).

AllowVerbs Section

The AllowVerbs section contains a list of HTTP verbs (methods). If UseAllowVerbs is set to 1 in the Options section, UrlScan rejects any request containing a verb not explicitly listed here. The entries in this section are case sensitive.

DenyVerbs Section

The DenyVerbs section contains a list of HTTP verbs (methods). If UseAllowVerbs is set to 0 in the Options section, UrlScan rejects any request containing a verb that is listed here. The entries in this section are case insensitive.

DenyHeaders Section

The DenyHeaders section contains a list of request headers. Any request containing a request header listed in this section will be rejected. The entries in this section are case insensitive.

AllowExtensions Section

The AllowExtensions section contains a list of file extensions. If UseAllowExtensions is set to 1 in the Options section, any request containing a URL with an extension not explicitly listed here is rejected. The entries in this section are case insensitive. Note that you can specify extension-less requests (for example, requests for a default page or a directory listing) by adding an empty extension using a dot and no trailing characters.

DenyExtensions Section

The DenyExtensions section contains a list of file extensions. If UseAllowExtensions is set to 0 in the Options section, any request containing a URL with an extension listed here is rejected. The entries in this section are case insensitive. You can specify extension-less requests (i.e. requests for a default page or a directory listing) by adding an empty extension using a dot and no trailing characters. You can specify extension-less requests (i.e. requests for a default page or a directory listing) by adding an empty extension using a dot and no trailing characters.

Files Created by UrlScan

UrlScan may create the following files in the directory that contains UrlScan.dll:

  • UrlScan.log Logs UrlScan activity, including initialization and shutdown, and details for any request that is rejected by UrlScan.
  • UrlScan.ini Contains the configuration options used by UrlScan.


Completing the Internet Information Services Lockdown Wizard

The IIS Lockdown Wizard has configured your server using the settings you’ve selected. You have just completed a very important step in securing your Web server.

Before putting your server into production, you should test it to ensure that the new settings are appropriate for your needs. If you find the new settings are not appropriate, or if you need to make additional configuration changes, run the IIS Lockdown Wizard again. The next time you run the IIS Lockdown Wizard, it will give you the option of undoing the latest changes that you made, or will let you overwrite the current settings with new ones.

Important Using the IIS Lockdown Tool is just one step in achieving and maintaining up-to-date security. You still need to install service packs and hotfixes in a timely manner. Check http://www.microsoft.com/security regularly for the most recent security fixes.


This Server Was Already Configured

When you try to start the IIS Lockdown Wizard and the This Server Was Already Configured page appears, you must undo the previous configuration before you can run the IIS Lockdown Wizard again.

Please note the following limitations when using Undo:

  • The Undo operation restores the system settings that were in effect immediately before running the IIS Lockdown Wizard. If you complete the IIS Lockdown Wizard, then make additional configuration changes to your server, and then run undo, the undo removes the changes that you made after running the IIS Lockdown Wizard, including any virtual root directories that you created. Therefore, it is important to test the system promptly after running the IIS Lockdown Wizard, and, if an undo is required, perform it immediately.

  • Undo cannot undo an uninstall of IIS services. If you chose to uninstall an IIS service during the previous run of the IIS Lockdown Wizard, you will need to use Add/Remove Programs in Control Panel to re-install IIS. Note: you should re-run the IIS Lockdown Wizard after re-installing IIS.

  • When the IIS Lockdown Wizard locks down a server, it creates a log file named Oblt-log.log and saves it in the directory that contains IISLockd.exe. This file contains information about every action the IIS Lockdown Wizard implemented on the system.