STIGQter: STIG Summary: Microsoft IIS 10.0 Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

IIS 10.0 web server system files must conform to minimum file permission requirements.

DISA Rule

SV-218814r561041_rule

Vulnerability Number

V-218814

Group Title

SRG-APP-000340-WSR-000029

Rule Version

IIST-SV-000144

Severity

CAT II

CCI(s)

• CCI-002235 - The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Weight

10

Fix Recommendation

Open Explorer and navigate to the inetpub directory.

Right-click "inetpub" and select "Properties".

Click the "Security" tab.

Set the following permissions:

SYSTEM: Full control
Administrators: Full control
TrustedInstaller: Full control
ALL APPLICATION PACKAGES (built-in security group): Read and execute
Users: Read and execute, list folder contents
CREATOR OWNER: special permissions to subkeys

Check Contents

Open Explorer and navigate to the inetpub directory.

Right-click "inetpub" and select "Properties".

Click the "Security" tab.

Verify the permissions for the following users; if the permissions are less restrictive, this is a finding.

System: Full control
Administrators: Full control
TrustedInstaller: Full control
ALL APPLICATION PACKAGES (built-in security group): Read and execute
ALL RESTRICTED APPLICATION PACKAGES (built-in security group): Read and execute
Users: Read and execute, list folder contents
CREATOR OWNER: Full Control, Subfolders and files only

Vulnerability Number

V-218814

Documentable

False

Rule Version

IIST-SV-000144

Severity Override Guidance

Open Explorer and navigate to the inetpub directory.

Right-click "inetpub" and select "Properties".

Click the "Security" tab.

Verify the permissions for the following users; if the permissions are less restrictive, this is a finding.

System: Full control
Administrators: Full control
TrustedInstaller: Full control
ALL APPLICATION PACKAGES (built-in security group): Read and execute
ALL RESTRICTED APPLICATION PACKAGES (built-in security group): Read and execute
Users: Read and execute, list folder contents
CREATOR OWNER: Full Control, Subfolders and files only

Check Content Reference

M

Target Key

4052

Comments