IIS Security - Week 21, 2005

IIS 6.0 Lock down tool

mitch - 20 May 2005 7:58 PM - 2 messages

Hi, Is there a IIS 6.0 lock down tool for Windows 2003 Server? If there is, where would it be located. Thanks. Mitch ...

Anonymous Login Failure

seeker5 - 20 May 2005 5:47 PM - 3 messages

I have two Windows Server 2003 machines running IIS. Both use anonymous login, both use the default anonymous user accounts, both are Domain Controllers. The problem is that one allows anonymous login without issue, while the other prompts for a user name and password. If you type in ...

Custom Errors

Andy Smith - 20 May 2005 2:48 PM - 4 messages

Hi there, Is it possilbe to redirect error pages (401, 404, etc), to a custom page using ASP/VBScript. I'd rather not use the custom errors tab in IIS as we have more than one web site running on the IIS server. ...

Cookie problem with ShowModalDialog and window.open

Jay Sullivan - 19 May 2005 8:01 PM - 2 messages

Hi, I have discovered an odd problem when using window.open from an IE window which was opened with ShowModalDialog. You would expect the new window to inherit the cookies from the same IE session which created the modal window, ...

Basic Authentication - Sometimes No Prompt

Smitty - 19 May 2005 6:55 PM - 2 messages

Why is prompting for ID/PW random? Server: Windows 2000, SP4, IIS 5.0, teamshare and SQL 2000. sub-site (Default web/cr) has Basic Authentication Checked, only. NTFS security for /cr folder allows Authenticated Users, Administrators, System and denys Anonymous ...

Integrated Windows Authentication on a member server

John - 19 May 2005 4:50 PM - 3 messages

I am getting ready to upgrade our domain from Windows 2000 to Windows 2003. I have a web server that is running Windows 2000 and is currently a DC which will not be upgraded. The Windows 2000 web server hosts our Intranet site ...

IIS and non starndard URL problem

kr - 19 May 2005 11:05 AM - 2 messages

Hi! I have found a problem with non standard url it`s: http://server/doc_name.asp?param=value <- it works fine but http://server/doc_namse.asp/param/value <- IIS looks for such a ...

Problem in connecting to ISAPI at medium and High levels

Ganesha - 19 May 2005 10:36 AM - 2 messages

Hi, I want to run ISAPI application in medium(pooled) or High(Isolated) level of application protection in IIS 5.0. When i run it in low level it runs without any problem. But when i run it in ...

AD Custom App Pool identity, Custom IUSR identity, and a lot more.

pj_servadmin - 18 May 2005 10:12 PM - 4 messages

I am probably going to misquote the microsoft rep I talked to (it was months ago), but here it goes: "In (mass vhost/webhosting/isp) type scenarios you should segregate all web applications that need high security by configuring custom App Pool ...

IIS 6 on Win2003 with SP1

Harrison Midkiff - 18 May 2005 9:11 PM - 4 messages

Hello: I am bringing a new IIS 6.0 server online with Windows 2003 and SP1. SP1 has the new Windows Firewall in it. After the server came online I tried to access one of its sites. I couldn't access the site and then noticed the ...

IIS / OWA

Andy Smith - 18 May 2005 4:51 PM - 2 messages

Hi there, This is a carry on from my Sessions/Cookies post... This is the setup I have: IIS running on W2K3 - IISSERVER Exchange 2003 - MAILSERVER I have an internal web site running on the IIS server which requires users ...

.cfg and .ini files cause 404

Phil - 18 May 2005 4:27 PM - 3 messages

how do you allow .cfg and .ini files in a web directory . .IIS 6 gives a 404 error . but you can change the extension and access them . .it is NOT a path problem . it appears as some sort of security measure. Can someone please ...

Kerberos & NTLM on IIS 6

Ethem Azun - 18 May 2005 9:11 AM - 5 messages

Hi, I have an IIS 6 on Win2003 registered on a domain. I'm running the following applications on this machine, - an ASP.NET Web App - Reporting Services Interface - Reporting Services Server All of the applications above use Windows Integrated Security. The ASP.NET ...

How to serve a certain file format in IIS6/2003

My Last Sigh - 17 May 2005 7:09 PM - 4 messages

I am having problems serving a file through http called myFile.vb_ I want to launch the file, but make it unknown to the browser. But it has to be known as a vb script file, because it launch some local file access ...

Sessions/Cookies?

Andy Smith - 17 May 2005 5:13 PM - 4 messages

Hi there, I have an internal web site running in a Windows Server 2003 Active Directory domain. I've set it to NOT allow annonymous access so that users are requested for their username/password when they access it. I've also got ...

restricted directory does not work

ren14 - 16 May 2005 10:50 PM - 4 messages

I'm having a problem with IIS 6.0. I'm trying to restrict certain directories on our web server to certain domain users and it's not working properly. I'm using Basic Auth with anonymous access disabled. ...

unable to authenticate to IIS 6

OM - 16 May 2005 8:39 PM - 10 messages

Hi, I just setup an IIS 6 server on one of the member server in my AD domain and created a virtual directory. I would like to be able to use webfolder and IE to access this virtual directory However, I can't seem to get the authentication working ...

authentication schemes

Krian - 16 May 2005 2:05 PM - 2 messages

With "passport" enabled on the IIS server, is it possible to limit to a specific set of passport users only instead of the whole community? Is it possible with just ISAPI extensions? ...