Rotate your device back to portrait to use STIG Vault.

Home
Dashboard
Search
STIG Repository
STIG Compare
SCAP Repository
SCAP Compare
CCIs
Guides
Contact

Appearance

Palette

IIS 7.0 Server STIG

The IIS 7.0 Server STIG (V1 R19) has 25 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

25STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R19

CurrentPublished Fri Jan 24 2020

Access to web administration tools must be restricted to the web manager and the web managers designees.

IIS 7.0 Server STIG

Assessment Title

Rule Text

Description

Discussion Text

The key web service administrative and configuration tools must only be accessible by the web server staff. All users granted this authority will be documented and approved by the ISSO. Access to the IIS Manager will be limited to authorized users and administrators.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-2248

Rule

SV-46357r3_rule

Severity

medium

Rule Version

WG220 IIS7

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

1. Open the IIS Manager and select Properties.
2. Select the Shortcut tab, and then left-click Open File Location.
3. Right-click InetMgr.exe, then click Properties from the context menu.
4. Select the Security tab.
5. Review the groups and user names.

The following account may have Full control priviledges:
TrustedInstaller

The following accounts may have read & execute, and read permissions:
Administrators (non-elevated)
System
Users

Specific users may be granted read & execute and read permissions.  Compare the local documentation authorizing specific users, against the specific users observed in step 5.  If any other access is observed, this is a finding.

Implementation Procedure

Fix Text

Restrict access to the web administration tool to only the web manager and the web manager’s designees.

STIG check 12 of 25 in the IIS 7.0 Server STIG checklist

← Previous · V-2247Only administrators are allowed access to the directory tree, the shell, or other operating system functions and utilities.Next · V-2251 →Programs and features not necessary for operations must be removed.