"Jed" wrote:

> I'm porting several websites from IIS5 to IIS6. On IIS5, the sites all ran
> with parent paths allowed. To improve security, I plan on disabling parent
> paths on the IIS6 server. To help set up the new machine, I first *enabled*
> parent paths on IIS 6 by checking the "enable parent paths" box for "Web
> sites" in IIS Manager.
>
> The problem is that when I *uncheck* the "enable parent paths" box, parent
> paths still seem to be allowed. Specifically, images referred to by
> "../images/myimage.jpg" display fine and if I type
> "http://www.mydomain.com/subdirectory/../" I get the home page.
>
> I've checked each website in IIS Manager, and they all *say* that parent
> paths are disabled. I'm very confused.
>
> Does anyone know what's going on and how to fix it?
>
> Thanks,