Skip to content

IIS

Internet Information Services is Windows' web server. If the README says the machine hosts a website, IIS stays; if not, remove the role. Either way, the defaults leak information and run with more privilege than they need.

Manage it

Internet Information Services (IIS) Manager (inetmgr), or appcmd.exe from C:\Windows\System32\inetsrv\.

Application pool identity

Each site runs inside an application pool, and the pool runs as an account. LocalSystem means a bug in the website is full control of the server.

inetmgr → Application Pools → select the pool → Advanced Settings → Process Model → Identity: ApplicationPoolIdentity (the default) or a dedicated low-privilege account.

appcmd list apppool /text:processModel.identityType

Should not say LocalSystem.

Directory browsing

When on, a URL with no index page shows a file listing. Attackers use it to find backups, config files, and scripts.

inetmgr → the server node (applies to all sites) → Directory Browsing → Disable. Repeat for each site to be sure.

appcmd list config /section:directoryBrowse

enabled="false".

Detailed errors

A detailed error page shows file paths, stack traces, and sometimes connection strings. Only local requests should see them.

Site → Error Pages → Edit Feature Settings → Detailed errors for local requests and custom error pages for remote requests.

appcmd list config /section:httpErrors

errorMode="DetailedLocalOnly". Detailed is the finding.

Require HTTPS

If the site handles logins or anything private, it should only serve HTTPS.

  1. Site → Bindings → Add → type https, pick a certificate.
  2. Site → SSL Settings → tick Require SSL.
appcmd list config "Default Web Site" /section:access

sslFlags="Ssl" or "Ssl, SslNegotiateCert".

Remove what isn't used

  • The default site, if the organization's site is a different one.
  • Sample and test applications.
  • Unused handler mappings (inetmgr → Handler Mappings), especially anything for scripting languages the site doesn't use.
  • Anonymous authentication on sites that need a login (Authentication → disable Anonymous, enable Windows or Forms).

Not a web server

Uninstall-WindowsFeature Web-Server -Remove

Verify

appcmd list config /section:directoryBrowse
appcmd list config /section:httpErrors
appcmd list apppool /text:processModel.identityType

Example

appcmd list apppool /text:processModel.identityType returns LocalSystem for DefaultAppPool. Any file-upload bug in the site would give SYSTEM. Change the identity to ApplicationPoolIdentity and recycle the pool.

Next

DNS Server