IIS Security

Dear members, I need some inputs for the following scenario: (1) the java application (JAPP) running on Windows XP, which is part of an NT-Domain (2) the user (USER) on this box is logged in the NT-Domain (3) the JAPP access a server (SERVER) via HTTP / HTTPS ...

I have an IIS 6 server running multiple web sites via individual IPs.  All sites are WSS 3.0; some internal and some public facing.  I would like to write a URLScan rule to block the "_layout" directories from view by the ...