Enforce security and operational policies through baseline configuration analysis.Identify vulnerabilities that can be used by attackers to compromise Windows systems and get to your data.Netwrix StealthAUDIT can help you enhance the security of your Windows infrastructure and minimize the risk of a data breach. Note that I did this testing on Windows 2008 and Win 7, and I did not need to bounce IIS for any of these configuration changes to start working. For basic site usage, nothing more then Read access is really needed don’t give anyone Modify or Full Control access unless there is some special need. In my case, I gave Read access to my reports to Frank. (The set of base permissions can vary from OS to OS.) Also make sure that security principals like “Everyone” and “Authenticated Users” do not have any access.Ĥ.6 Last, you can now use the basic “Edit” button to add Read Only access for select users and groups. This will disable the ability for any domain users to simply authenticate to your site to view the reports, while allowing local administrators and members of IIS_IUSRS to log in and view reports. This simply copies the existing permissions back without inheritance this is very important as to not break the website for yourself and the system at large.Ĥ.5 Delete the permission for Users. When prompted with a warning, select ADD. First, we will break inheritance and then we will remove “Users” from having any access:Ĥ.1 Right-click the site select “Edit Permissions”Ĥ.4 Uncheck the box “Include inheritable permissions from this objects parent”. Reconfigure the permissions of the web site.

Enable the Windows Authentication option for your site:Ĥ. IIS Windows Authentication Feature of IIS.ģ.

If you don’t have Windows Authentication integrated in IIS, add this feature from Server Manager under “Roles / Services” for IIS”EX. If you have Windows Authentication installed for IIS, proceed to step 3.

Here are the steps: How to secure your IIS siteġ.Select your site and click “Authentication”, In the screenshot below, you can see that I have many IIS sites, including one named “Default Web Site”.Ģ. The answer is pretty simple: In order to secure an IIS site, all one needs to do is change the default permissions, enable Windows Authentication for user accounts, and disable Anonymous Authentication in IIS Manager.

Iis manager