Skip to content

IIS

Internet Information Services is Windows' web server. If the README says the machine hosts a website, IIS stays; if not, remove the role. Either way, the defaults leak information and run with more privilege than they need.

Manage it

Internet Information Services (IIS) Manager (inetmgr), or appcmd.exe from C:\Windows\System32\inetsrv\.

Application pool identity

Each site runs inside an application pool, and the pool runs as an account. LocalSystem means a bug in the website is full control of the server.

inetmgr → Application Pools → select the pool → Advanced Settings → Process Model → Identity: ApplicationPoolIdentity (the default) or a dedicated low-privilege account.

appcmd list apppool /text:processModel.identityType

Should not say LocalSystem.

Directory browsing

When on, a URL with no index page shows a file listing. Attackers use it to find backups, config files, and scripts.

inetmgr → the server node (applies to all sites) → Directory Browsing → Disable. Repeat for each site to be sure.

appcmd list config /section:directoryBrowse

enabled="false".

Detailed errors

A detailed error page shows file paths, stack traces, and sometimes connection strings. Only local requests should see them.

Site → Error Pages → Edit Feature Settings → Detailed errors for local requests and custom error pages for remote requests.

appcmd list config /section:httpErrors

errorMode="DetailedLocalOnly". Detailed is the finding.

Require HTTPS

If the site handles logins or anything private, it should only serve HTTPS.

  1. Site → Bindings → Add → type https, pick a certificate.
  2. Site → SSL Settings → tick Require SSL.
appcmd list config "Default Web Site" /section:access

sslFlags="Ssl" or "Ssl, SslNegotiateCert".

Remove what isn't used

  • The default site, if the organization's site is a different one.
  • Sample and test applications.
  • Unused handler mappings (inetmgr → Handler Mappings), especially anything for scripting languages the site doesn't use.
  • Anonymous authentication on sites that need a login (Authentication → disable Anonymous, enable Windows or Forms).

FTP in IIS

If the README makes the machine an FTP server and it's the IIS FTP role rather than FileZilla, two server STIG items apply (WN22-00-000420, 000430). In inetmgr, select the FTP site → FTP Authentication → Anonymous Authentication: Disabled, so every transfer is tied to an account. Then check the site's Basic Settings → Physical path: it must be a dedicated folder such as C:\inetpub\ftproot or a data drive, never C:\ or C:\Windows. An FTP root on the system drive root lets an FTP user read the whole disk. Also under FTP SSL Settings, choose Require SSL connections so passwords aren't sent in clear text.

Not a web server

Uninstall-WindowsFeature Web-Server -Remove

Verify

appcmd list config /section:directoryBrowse
appcmd list config /section:httpErrors
appcmd list apppool /text:processModel.identityType

Example

appcmd list apppool /text:processModel.identityType returns LocalSystem for DefaultAppPool. Any file-upload bug in the site would give SYSTEM. Change the identity to ApplicationPoolIdentity and recycle the pool.

Try it

  1. Install IIS on a practice server, browse to it, turn on directory browsing, see the listing, turn it off.
  2. Set the application pool identity and check which account the worker process runs as in Task Manager.

Build it

An iis.ps1 that prints the settings on this page with Get-WebConfigurationProperty so you can see them all at once.

Next

DNS Server