Securing IIS 6

8 Jul 2005 5:06 PM

TagaR

Hi,

Do I have to use URLScan or IIS lockdown on my W2k3 IIS 6?

I would also appreciate if there are links available that I can read to
secure my IIS.

Thanks
TagaR

9 Jul 2005 1:56 AM

My Last Sigh

URLScan is not pertinent to IIS 6. Mime tyupes are handled differently in
IIS 6.

Show quoteHide quote

"TagaR" <Ta***@discussions.microsoft.com> wrote in message
news:ED581E55-8AE1-477C-8B23-775DB6F2AB94@microsoft.com...
> Hi,
>
> Do I have to use URLScan or IIS lockdown on my W2k3 IIS 6?
>
> I would also appreciate if there are links available that I can read to
> secure my IIS.
>
> Thanks
> TagaR

9 Jul 2005 4:47 PM

Jeff Cochran

On Fri, 8 Jul 2005 18:56:23 -0700, "My Last Sigh"
<mylasts***@comcast.net> wrote:

>URLScan is not pertinent to IIS 6. Mime tyupes are handled differently in
>IIS 6.

URLscan doesn't deal with Mime types. It deals with HTTP requests.
And while many of the protections offered by URLScan in lower versions
of IIS aren't needed with IIS6, it does have uses for IIS6 users.

Jeff

Show quoteHide quote

>
>"TagaR" <Ta***@discussions.microsoft.com> wrote in message
>news:ED581E55-8AE1-477C-8B23-775DB6F2AB94@microsoft.com...
>> Hi,
>>
>> Do I have to use URLScan or IIS lockdown on my W2k3 IIS 6?
>>
>> I would also appreciate if there are links available that I can read to
>> secure my IIS.
>>
>> Thanks
>> TagaR
>

9 Jul 2005 11:03 AM

David Wang [Msft]

IIS6 comes in a secured and locked down configuration, so IIS Lockdown is
not necessary (nor does it even install) on IIS6.

URLScan is also not necessary for IIS6 because much of its features are
built into IIS6. See this URL for details:
http://www.microsoft.com/technet/security/tools/urlscan.mspx

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//

"TagaR" <Ta***@discussions.microsoft.com> wrote in message
news:ED581E55-8AE1-477C-8B23-775DB6F2AB94@microsoft.com...
Hi,

Do I have to use URLScan or IIS lockdown on my W2k3 IIS 6?

I would also appreciate if there are links available that I can read to
secure my IIS.

Thanks
TagaR

10 Jul 2005 8:43 PM

TagaR

Thanks.

Show quoteHide quote

"David Wang [Msft]" wrote:

> IIS6 comes in a secured and locked down configuration, so IIS Lockdown is
> not necessary (nor does it even install) on IIS6.
>
> URLScan is also not necessary for IIS6 because much of its features are
> built into IIS6. See this URL for details:
> http://www.microsoft.com/technet/security/tools/urlscan.mspx
>
> --
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no rights.
> //
> "TagaR" <Ta***@discussions.microsoft.com> wrote in message
> news:ED581E55-8AE1-477C-8B23-775DB6F2AB94@microsoft.com...
> Hi,
>
> Do I have to use URLScan or IIS lockdown on my W2k3 IIS 6?
>
> I would also appreciate if there are links available that I can read to
> secure my IIS.
>
> Thanks
> TagaR
>
>
>