Archived Months
June 2003
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
December 2007
January 2008
February 2008
March 2008
April 2008
all groups > iis security > october 2006

Filter by week: 1 2 3 4 5

Extranet Authentication
Posted by Mike at 10/31/2006 1:58:01 PM
I'm currently building a new company website. (asp.Net) Our web server is a stand-alone in the DMZ. On the website, I'd like to have a place for employees to logon using their same internal, network username/password, so they don't need additional logon information. (We do expire passwords r...more >>


windows server 2003 firewall and IIS
Posted by WSB Corey at 10/31/2006 1:03:01 PM
ok after I install IIS windows fire wall is disabled and their is now way to enable it due to the Fire wall setting is grayed out. Any Ideas? Corey...more >>

Can you pass RemoteUser, LogonUser or AuthUser to J2EE application?
Posted by newpotato at 10/27/2006 7:13:31 AM
I am running IIS 6 on 2003 servers. If I configuration Integrated Windows Authentication, is it possible to pass one of the user headers to a J2EE application server on another 2003 box? TIA, newpotato ...more >>

Web Site Access requires UserID and Password - Resolved
Posted by baker_tony NO[at]SPAM hotmail.com at 10/27/2006 3:14:53 AM
I copied over a new Default.htm file to a web server one day, and all of a sudden whenever anyone went to our web site they were being prompted to enter userId and password! Directory access was set to anonymous. Way I fixed it was to: 1) right click Default.htm and bring up properties 2) Go...more >>

Certificate problem
Posted by George at 10/26/2006 5:46:02 PM
It is said that the name in "issue to" section in the certificate should be the same as the external server name of your web server. I have installed an enterprise CA and tried to creat a new certificate from the directory security in IIS. I noticed that the certificate will work no matter...more >>

Import Cert without pfx or pending request
Posted by DBLWizard at 10/26/2006 12:23:18 PM
Howdy All, My client had a web server die and we have stood a new one up. Now I am tring to get the cert installed to set the site up for SSL. I have the pvk and crt files but I do not have the pfx file. Also the machine the original request came from is the one that died. How can I get ...more >>

Monitor IIS for http and https ussage!
Posted by VincentP NO[at]SPAM uchicago.edu at 10/25/2006 8:57:01 AM
Can someone tell me how to monitor IIS to see if users are using http or https to access my site. Internet users should be using HTTPS, and users on the Intranet should use HTTP. How can I monitor this activity. Thanks...more >>

IIS 5.0 Manage for non-admin rights
Posted by rbfigueira at 10/25/2006 4:49:02 AM
I am running IIS 5.0 on Windows 2000 PRO. Our web developers needed to create or edit websites, for security reasons I cannot simply give them admin rights or the password to the admin account. For security reasons, we create the developers machines with non-admin profile. They do not have...more >>



IIS 6 Directory Services Mapping ACL Problems
Posted by drew.sullivan NO[at]SPAM gmail.com at 10/24/2006 7:08:25 AM
For the love of god, please help me. I can't afford to pull out any more hair. I have a small domain setup at my organization, all servers are windows 2003. We are trying to configure certificate based logins using the directory services method (not IIS certificate mapping). My issue is ...more >>

Cross server Integrated Auth not working with IIS 6
Posted by newpotato at 10/23/2006 9:36:07 AM
I have 2 W2K3 servers set up in a test domain. Server1 has both AD and IIS while Server2 only has IIS. I am using the Default Web Site on both IIS servers and have IWA checked for Directory Security. Anonymous Access is not allowed except on the aspnet_client directory. While logged into Serve...more >>

IIS cert renew
Posted by Zsolt Soczo at 10/19/2006 4:26:57 PM
Hello, my client's IIS certificate has expired. They got another one from a cert auth, without generating a new request in IIS. So, they got a cert without the private key. They have the expired cert with the private key. They want to glue them together. How can they accomplish this? Reg...more >>

403 Forbidden
Posted by fniles at 10/19/2006 1:02:00 PM
Our VB program downloads an XML file from a URL on our website to our client's machine using HTTP control. When it does that, it got the following error: "403 Forbidden - The ISA Server denies the specified Uniform Resource Locator (URL). (12202) Internet Security and Acceleration Server" I ca...more >>

Webservice to an Out of process server
Posted by hankman at 10/19/2006 8:27:12 AM
WinXP Pro sp2 IIS 5.1 ASP.NET 2.0.50727 Visual Studio 2005 I wrote a simple (I thought) webservice that talks to a running application that has an activeX interface. Then I made a simple website to consume this web service. Everything works fine when running in the Visual Studio web dev...more >>

Web Applications located on a FileDiskImage not accessable with Internet Information Server ? (Delphi 2006 used to create web application)
Posted by Skybuck Flying at 10/19/2006 12:00:00 AM
Hello, As a programmer I would like to keep all my source code together on a FileDiskImage created with the FileDisk tool. ( http://www.winimage.com/misc/filedisk64.htm ) However when Internet Information Server tries to read/execute the web application a Server Error happens, can this ...more >>

WSE910 and 'Root element is missing.'
Posted by Ollie Riches at 10/18/2006 1:34:54 PM
I am having trouble with WSE3 and domain authentication\authorisation for a web service. When using a the 'NETWORK SERVICE' account for the application pool in IIS 6.0 the web service work perfectly correctly, we are able to call the web service end point and we can authenticate through our...more >>

Using a Domain ID for Anonymous User Account
Posted by JayhawkTuba at 10/18/2006 9:16:02 AM
When you use a Domain ID for your anonymous UserID, can IIS still manage the password?...more >>

Which Unrelated Services to Disable on an IIS 6.0 Server
Posted by JayhawkTuba at 10/18/2006 9:08:01 AM
Does anyone have a list of services that are unrelated to IIS that should be shut down? What I mean here is that these should be services that are not needed or required that can be shut down as a means of reducing potential vulnerability for the server as a whole. Thanks in advance....more >>

URL Authentication IIS 6.0
Posted by r.oosterholt NO[at]SPAM gmail.com at 10/18/2006 7:43:30 AM
I need to authenticate users agains an Active Directory (or rather ADAM)... I've red about a new feature in IIS 6.0: URL Authentication and I did manage to set-up a situation where users are authenticated by use of LDAP query: (&(objectCategory=user)(CN=*))) But, now comes the stange part, ...more >>

Switching from http to https
Posted by Kansas at 10/17/2006 12:20:02 PM
We just upgraded to Server 2003 and we run a program that now requires https. The certificate was installed to change the site along with the certificate to access the server. When trying to connect to the https site, I get a page cannot be displayed, cannot connect to server or DNS error. ...more >>

Install Wildcard Certificate
Posted by FastEddie at 10/16/2006 11:21:01 PM
I have the wild card certificate but can't seem to install it anywhere. From the SSL Diag I get: ServerComment = test.mantis-tgi.com ServerAutoStart = True ServerState = Server started #Could not impersonate server account SSLCertHash = 63 76 90 4b 71 d3 33 95 c9 92 a1 64 cc 05 89 c0 1c d3 5...more >>

http trace method
Posted by AG at 10/13/2006 3:26:02 PM
I had a security audit, and following was found: "http trace method enabled" Could somebody explain to me how to remediate this and what consequences if any i might have. Thank you....more >>

IIS/FrontPage Problems w/Forms
Posted by SCukier at 10/12/2006 3:42:01 PM
Hi all - I have created an Intranet site for my user's within my network. The Intranet is on a W2K3 server in a W2K domain. Within the site, I created a form using FP2003. My user's logon to the Intranet site without any prompting of passwords based upon the security I have set. However...more >>

Web site can't be browsed when logging out from IISv6.0 Server
Posted by B at 10/12/2006 8:04:02 AM
On IIS v6.0, when logged in as local administrator or Domain Administrator, I am able to browse the website. However, once log out, I am not able to browse the website (page can't be displayed). Can anybody help?? Here is the iislog. 2006-10-12 14:50:04 W3SVC1 NYIISLAB 10.19.11.36 GET /d...more >>

SSL Problem
Posted by Doug at 10/11/2006 8:25:50 PM
Hello. I have two separate Web sites running on one IIS server. We'll call them server A and server B. I purchased a verisign certificate for server A some time ago and it's been fine. I just purchased one for server B and set it up on server B. I was careful to use the fully qualified doma...more >>

firefox 1.5 & iis6.0
Posted by simisa at 10/11/2006 5:56:00 PM
Hello All I set a window authentication + permission for an active dir user in my extranet. os w2003r2 iis6 Everything work fine but today I received many feedbacks about firefox 1.5 and ie5.5, still not working! Do I have to set something in iis6 or is a client problem? I test...more >>

IIS Active Directory Authetication
Posted by Marcus at 10/11/2006 9:19:02 AM
I have a customer that when they log into their SSL server it only allows local users to that server to log in. It does not allow Active Directory users to log in. I have checked the Website's security and Integrated Windows authentication is checked. Any idea why this is not working. Thanks!...more >>

Is posting from http to https secure?
Posted by leejturner NO[at]SPAM gmail.com at 10/11/2006 3:47:28 AM
Hi just a quick question. I have a webpage which sits at a http address. This page accespts a username and password from the user and then posts this information to an https (secure) page. Is this secure? Does it matter that the initial page is not https? Will the data be sent encrypted or sho...more >>

Password protecting a single page on IIS
Posted by Rob Gordon at 10/10/2006 6:01:28 PM
I am attempting to password protect a single html page on my website, so that only people I give the login/password to can access it. Where can I find some simple instructions on what I need to do, in order to lock down user access to a single page under IIS 6.0. I am running the server on...more >>

Cannot get logon prompted on web page on one machine
Posted by coocoonut NO[at]SPAM hotmail.com at 10/10/2006 11:33:20 AM
I'm getting the following error message when accessing one of our intranet site from one machine with IE6. All other machines with IE6 will get logon prompt when accessing the site but this one. On this machine, the logon window doesn't show. Please advise how to resolve this. Thank you! ...more >>

Problem with Impersonation / Delegation
Posted by Al at 10/9/2006 8:46:02 AM
I've tried setting up Impersonation with Delegation and I can't get it to work. When the IIS application is trying to connect to a remote SQL Server, I'm getting NTLM authentication instead of Kerberos, so causing my delegation to fail, and I can't see why. My test enviroment is a Virtual S...more >>

How do you get rid of IIS Anonymous Event Logs?
Posted by Freestar at 10/9/2006 6:42:01 AM
This may be an obvious question, but I am new to IIS administration. We have an Intranet site running on IIS on a w2k server. In the Security Event Log we are getting lots of 'Event ID 538 ANONYMOUS LOGON' messages. We want to get rid of these messages and have access logged by user name. ...more >>

Multiple websites in one IIS with Integrated Windows Authentication
Posted by ramram49 at 10/7/2006 10:41:15 PM
Hi, I have setting up two intranet web sites (say Site_A and Site_B) on the same IIS 6 server. Both serve internal staff only. For Site_A, I leave everything as default. For Site_B, I modified "Multiple identities for this Web site" as follows: IP Address: 130.20.1.20 TCP port: 80...more >>

SSLv3 with certificate issued by Intermediate certificae authority
Posted by TheDudi at 10/4/2006 2:11:03 PM
after enabelling SSLv3 (Require client certificate) , the authentication proccess fails. I know that while the SSL/TLS Handshake, the server send a certificateRequest message that prompt the client browser for a valid certificate. The CertificateRequest message include only Root CA certifi...more >>

Create Virtual Directory from DMZ to LAN
Posted by gstar at 10/3/2006 5:19:54 AM
Hi, I have a Windows 2000 server [IIS5] inside a DMZ with no access onto the LAN except required ports [SQL etc]. The LAN server is part of a Windows 2003 domain while the IIS machine is non-domain. I need to upload files from our website and after trying to create the Virtual Directory ran int...more >>

IIS 5.0 IWA - Really need tips to solve this issue
Posted by Padmaja T Chavali at 10/2/2006 12:08:02 PM
Hi, I am having an issue with IWA. This is the environment in which I am working in. Front end - Perl Page displayed on IE 6.0. Web Server - IIS 5.0 Windows 2k Default Web Server Properties: Directory Security tab: Annoynymous Access & Authentication Control: Integrated Windows A...more >>

IIS FrontPage Virtual Sever Administration Site Administration : 401.1 for individual sites
Posted by Carol Chisholm at 10/1/2006 7:22:15 PM
W2K3 R2 IIS 6.0 FrontPage extensions 5.0.6790 I have installed and can use the FrontPage extensions (sites published from FrontPage can see the extensions). I have a Microsoft Sharepoint Administrator item in my Administrative tools and in IIS. I can open this page and do things like extend...more >>


DevelopmentNow Blog