Microsoft IIS
TMA-IIS-1.6
Ensure 'application pool identity' is configured for anonymous user identity
Description
To achieve isolation in IIS, application pools can be run as separate identities. IIS can be configured to automatically use the application pool identity if no anonymous user account is configured for a web site. This can greatly reduce the number of accounts needed for Web sites and make management of the accounts easier. It is recommended the Application Pool Identity be set as the Anonymous User Identity. Every enabled anonymousAuthentication section (server level and all locations) must have an empty userName so the application pool identity is used. PowerShell 5.1 with the WebAdministration module; run elevated.
How it is checked
Audit method: Shell command
Import-Module WebAdministration -ErrorAction Stop; $bad = @(Get-WebConfiguration -Filter 'system.webServer/security/authentication/anonymousAuthentication' -PSPath 'MACHINE/WEBROOT/APPHOST' -Recurse | Where-Object { $_.enabled -eq $true -and -not [string]::IsNullOrEmpty($_.userName) }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/security/authentication/anonymousAuthentication -Name userName -Value ''
Properties
- Operating systems
- Any
- Tags
- iisauthentication
- Reference
- CIS Microsoft IIS 10 Benchmark v1.2.1 - 1.6 Ensure 'application pool identity' is configured for anonymous user identity
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target iis