IISHelp -- iis security

BigSam
12/22/2007 9:08:01 AM

A few months ago I removed the Virtual Directory IISHelp from the Default web
site on my IIS servers, as a recommendation in the Microsoft Baseline
Security Analyzer. All of this was part of the configuration of new W2k3
servers that we were migrating to.
Now one of our develoipers is having a hissy fit, saying he needs IISHelp
restored because 'There is code in the 500-100.asp that performs valuable
functions for our application like doing a database rollback when an error is
encountered.'
Orginally he said 'The 500-100.asp logs all errors encountered on our web
site. This is the only way we know that our customer's are experiencing
problems. Furthermore, since I modified this page to no return any pertinent
information to the customer, I have no way of knowing how to debug a web page
with errors.'

I think he's blowing smoke on the database rollback, but don't know for
sure. Our web pages are a combination of classic ASP & ASP.Net.
Is it possible to use IISHelp for a database rollback?
If there is, is it a good policy?

Roger Abell [MVP]
12/22/2007 6:18:52 PM

Take a look for yourself BigSam, as the file is still at
C:\WINDOWS\Help\iisHelp\common or similar in
your install if you only removed IIShelp vdir. You
will see that the dev is blowing smoke, unless there
had been a modified file. If it was a modified file,
then just install it as the page for handling those errs.
Your comment that the dev said they had modified it
so that it does not reveal info, etc. and that it is needed
for the debugging info it logs makes it sound pretty much
no longer the MS shipped file.

Roger

[quoted text, click to view]

iis security : IISHelp