{"id":14,"date":"2004-09-02T13:14:00","date_gmt":"2004-09-02T13:14:00","guid":{"rendered":"http:\/\/markwilson.me.uk\/blog\/2004\/09\/securing-iis.htm"},"modified":"2007-05-22T00:01:07","modified_gmt":"2007-05-21T23:01:07","slug":"securing-iis","status":"publish","type":"post","link":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm","title":{"rendered":"Securing IIS"},"content":{"rendered":"<p><!--109491227432530268-->Whilst researching some IIS issues, I came across <a href=\"http:\/\/www.washington.edu\/computing\/support\/windows\/UWdomains\/IISsecchecklist.html\">a useful checklist for securing IIS<\/a> courtesy of the University of Washington.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Whilst researching some IIS issues, I came across a useful checklist for securing IIS courtesy of the University of Washington.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[],"tags":[110,43],"class_list":["post-14","post","type-post","status-publish","format-standard","hentry","tag-iis","tag-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Securing IIS - markwilson.it<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Securing IIS - markwilson.it\" \/>\n<meta property=\"og:description\" content=\"Whilst researching some IIS issues, I came across a useful checklist for securing IIS courtesy of the University of Washington.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm\" \/>\n<meta property=\"og:site_name\" content=\"markwilson.it\" \/>\n<meta property=\"article:published_time\" content=\"2004-09-02T13:14:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2007-05-21T23:01:07+00:00\" \/>\n<meta name=\"author\" content=\"Mark Wilson\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@markwilsonit\" \/>\n<meta name=\"twitter:site\" content=\"@markwilsonit\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mark Wilson\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/securing-iis.htm#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/securing-iis.htm\"},\"author\":{\"name\":\"Mark Wilson\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\"},\"headline\":\"Securing IIS\",\"datePublished\":\"2004-09-02T13:14:00+00:00\",\"dateModified\":\"2007-05-21T23:01:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/securing-iis.htm\"},\"wordCount\":22,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\"},\"keywords\":[\"Microsoft Internet Information Server\\\/Services\",\"Security\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/securing-iis.htm#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/securing-iis.htm\",\"url\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/securing-iis.htm\",\"name\":\"Securing IIS - markwilson.it\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#website\"},\"datePublished\":\"2004-09-02T13:14:00+00:00\",\"dateModified\":\"2007-05-21T23:01:07+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/securing-iis.htm#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/securing-iis.htm\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/2004\\\/09\\\/securing-iis.htm#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Securing IIS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/\",\"name\":\"markwilson.it\",\"description\":\"get-info -class technology | write-output &gt; \\\/dev\\\/web\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/#\\\/schema\\\/person\\\/98f61365e7c39d6be942174b8c4de468\",\"name\":\"Mark Wilson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\",\"width\":800,\"height\":800,\"caption\":\"Mark Wilson\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/www.markwilson.co.uk\\\/blog\\\/uploads\\\/image-4.png?fit=800%2C800&ssl=1\"},\"description\":\"A Chartered IT Professional, with recent experience in technology leadership, IT strategy and practice management roles, Mark Wilson is an Enterprise Architect in the Advisory and Management Group at risual. During a career spanning more than two decades, Mark has gained widespread recognition as an expert in his field including both industry and national press exposure. In addition to certifications from Microsoft, VMware, Red Hat, The Open Group and Axelos, Mark held a Microsoft Most Valuable Professional (MVP) award for three years and is now part of the MVP Reconnect programme. Mark is also well-known on social media and maintains an award-winning blog.\",\"sameAs\":[\"http:\\\/\\\/www.markwilson.co.uk\\\/\",\"https:\\\/\\\/www.instagram.com\\\/markwilsonuk\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/markawilson\\\/\",\"https:\\\/\\\/x.com\\\/markwilsonit\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCWHlZCoHRTocdvtrOJ2IL4A\"],\"url\":\"https:\\\/\\\/www.markwilson.co.uk\\\/blog\\\/author\\\/mark-wilson\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Securing IIS - markwilson.it","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm","og_locale":"en_GB","og_type":"article","og_title":"Securing IIS - markwilson.it","og_description":"Whilst researching some IIS issues, I came across a useful checklist for securing IIS courtesy of the University of Washington.","og_url":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm","og_site_name":"markwilson.it","article_published_time":"2004-09-02T13:14:00+00:00","article_modified_time":"2007-05-21T23:01:07+00:00","author":"Mark Wilson","twitter_card":"summary_large_image","twitter_creator":"@markwilsonit","twitter_site":"@markwilsonit","twitter_misc":{"Written by":"Mark Wilson"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm#article","isPartOf":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm"},"author":{"name":"Mark Wilson","@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468"},"headline":"Securing IIS","datePublished":"2004-09-02T13:14:00+00:00","dateModified":"2007-05-21T23:01:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm"},"wordCount":22,"commentCount":1,"publisher":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468"},"keywords":["Microsoft Internet Information Server\/Services","Security"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm","url":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm","name":"Securing IIS - markwilson.it","isPartOf":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/#website"},"datePublished":"2004-09-02T13:14:00+00:00","dateModified":"2007-05-21T23:01:07+00:00","breadcrumb":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/securing-iis.htm#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.markwilson.co.uk\/blog"},{"@type":"ListItem","position":2,"name":"Securing IIS"}]},{"@type":"WebSite","@id":"https:\/\/www.markwilson.co.uk\/blog\/#website","url":"https:\/\/www.markwilson.co.uk\/blog\/","name":"markwilson.it","description":"get-info -class technology | write-output &gt; \/dev\/web","publisher":{"@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.markwilson.co.uk\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":["Person","Organization"],"@id":"https:\/\/www.markwilson.co.uk\/blog\/#\/schema\/person\/98f61365e7c39d6be942174b8c4de468","name":"Mark Wilson","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1","url":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1","width":800,"height":800,"caption":"Mark Wilson"},"logo":{"@id":"https:\/\/i0.wp.com\/www.markwilson.co.uk\/blog\/uploads\/image-4.png?fit=800%2C800&ssl=1"},"description":"A Chartered IT Professional, with recent experience in technology leadership, IT strategy and practice management roles, Mark Wilson is an Enterprise Architect in the Advisory and Management Group at risual. During a career spanning more than two decades, Mark has gained widespread recognition as an expert in his field including both industry and national press exposure. In addition to certifications from Microsoft, VMware, Red Hat, The Open Group and Axelos, Mark held a Microsoft Most Valuable Professional (MVP) award for three years and is now part of the MVP Reconnect programme. Mark is also well-known on social media and maintains an award-winning blog.","sameAs":["http:\/\/www.markwilson.co.uk\/","https:\/\/www.instagram.com\/markwilsonuk\/","https:\/\/www.linkedin.com\/in\/markawilson\/","https:\/\/x.com\/markwilsonit","https:\/\/www.youtube.com\/channel\/UCWHlZCoHRTocdvtrOJ2IL4A"],"url":"https:\/\/www.markwilson.co.uk\/blog\/author\/mark-wilson"}]}},"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":568,"url":"https:\/\/www.markwilson.co.uk\/blog\/2005\/06\/implementing-secure-ftp-service-using.htm","url_meta":{"origin":14,"position":0},"title":"Implementing a secure FTP service using Microsoft IIS","author":"Mark Wilson","date":"Thursday 2 June 2005","format":false,"excerpt":"Readers of this blog may recall that, last year, my open FTP server was hacked. That experience taught me a valuable lesson and earlier today, I needed to establish a secure FTP server installation using Microsoft Internet Information Services (IIS) 5.0 (well, as secure as you can with a protocol\u2026","rel":"","context":"In \"FTP\"","block_context":{"text":"FTP","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/ftp"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":111,"url":"https:\/\/www.markwilson.co.uk\/blog\/2004\/10\/perils-of-running-unsecured-ftp-server.htm","url_meta":{"origin":14,"position":1},"title":"The perils of running an unsecured FTP server","author":"Mark Wilson","date":"Monday 4 October 2004","format":false,"excerpt":"Last week I got hacked. I'd opened up my previously stealthed firewall to: Access my home network when I'm at work; Allow one of my friends to post some large files to my FTP server. The trouble is that I hadn't been carrying out the best practices that I would\u2026","rel":"","context":"In \"FTP\"","block_context":{"text":"FTP","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/ftp"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":386,"url":"https:\/\/www.markwilson.co.uk\/blog\/2006\/05\/problems-accessing-virtual-server.htm","url_meta":{"origin":14,"position":2},"title":"Problems accessing the Virtual Server administration website on a Windows Server 2003 domain controller","author":"Mark Wilson","date":"Thursday 4 May 2006","format":false,"excerpt":"Although I have several computers at home, most of my server roles are running on a single PC. That means Active Directory (AD) domain controller (DC), DNS, DHCP, RIS, WSUS, and print services are all on one box (file services are on my NSLU2) so I figured that adding Virtual\u2026","rel":"","context":"In \"Microsoft Active Directory\"","block_context":{"text":"Microsoft Active Directory","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/active-directory"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":63,"url":"https:\/\/www.markwilson.co.uk\/blog\/2004\/02\/overview-of-microsoft-baseline.htm","url_meta":{"origin":14,"position":3},"title":"Overview of the Microsoft Baseline Security Analyzer","author":"Mark Wilson","date":"Monday 23 February 2004","format":false,"excerpt":"Like Microsoft Software Update Services, the Microsoft Baseline Security Analyzer (MBSA) is a security toolkit component born out of the Microsoft Strategic Technology Protection Program (STPP). MBSA v1.2 is available for download from the Microsoft website and provides a graphical and command line interface that can perform local or remote\u2026","rel":"","context":"In \"Microsoft\"","block_context":{"text":"Microsoft","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/microsoft"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1150,"url":"https:\/\/www.markwilson.co.uk\/blog\/2008\/08\/installing-php-5-on-iis-6.htm","url_meta":{"origin":14,"position":4},"title":"Installing PHP 5 on IIS 6","author":"Mark Wilson","date":"Thursday 7 August 2008","format":false,"excerpt":"I've run PHP with Microsoft Internet Information Services (IIS) before (running on a Windows XP laptop) and I seem to remember the installation being quite straightforward. Even so, tonight I was installing PHP 5.2.6 with IIS 6 (on Windows Server 2003 R2 Enterprise x64 Edition) and I ran across a\u2026","rel":"","context":"In \"Microsoft Internet Information Server\/Services\"","block_context":{"text":"Microsoft Internet Information Server\/Services","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/iis"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":565,"url":"https:\/\/www.markwilson.co.uk\/blog\/2004\/09\/monthly-columns-on-microsoft-technet.htm","url_meta":{"origin":14,"position":5},"title":"Monthly columns on the Microsoft TechNet website","author":"Mark Wilson","date":"Tuesday 14 September 2004","format":false,"excerpt":"Microsoft publishes a number of monthly columns on it's TechNet website, all of which provide interesting reading, and are useful information sources: Cable Guy (networking); Hey, Scripting Guy! and Tales from the Script (scripting) IIS Insider; Professor Windows; Security Management. Although not strictly a monthly column, there is also a\u2026","rel":"","context":"In \"Microsoft\"","block_context":{"text":"Microsoft","link":"https:\/\/www.markwilson.co.uk\/blog\/tag\/microsoft"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/posts\/14","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=14"}],"version-history":[{"count":0,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/posts\/14\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=14"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=14"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.markwilson.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=14"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}