Best Practices For Securing IIS ??

[beefeater267]

Hi,

I recently opened up my web server to the world and checked the logs after 1 hour and saw what looks like security threats. (Random IPs trying to GET wierd files).

Does anyone have any best practices tips for securing IIS against attacks?

 

[Sheco]

use anonymous access on everything... and the account used for anonymous access is a local account with no privilages to the rest of your network, so that way if the account is compromised only the web server can be harmed. actually it is best if this local account only has permissions to the \inetpub directory and nothing else on the computer. also make sure to disable/delete the IISAdmin, IISHelp, and IISSamples virtual directories that are created often by default installation.

 

[ggriffit]

you should also have a look at the IIS Lockdown tool (

http://www.microsoft.com/technet/security/tools/locktool.mspx)