IIS Security Practices

From MgmtWiki
Revision as of 22:04, 21 July 2020 by Tom (talk | contribs)

Jump to: navigation, search

Full Title or Meme

Security practices to follow on IIS for good security.


  • Assuming IIS (or any web platform) is running as a front end web server, it should never be trusted with high value assets and assumed to be hackable. Still there are ways to make the hacks much less frequent.


Application Pool Identities

Starting with Server 2008 R2 IIS services will not longer run as network services but with virtual Application Pool Identities that have no entry local or domain accounts, and hence no "Current User" cert store or HKCU registry entries.