Ensure 'global authorization rule' is set to restrict access

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Verify an authorization rule specifying no access to all users except the Administrators group: To verify using AppCmd.exe enter the following command: %systemroot%\system32\inetsrv\appcmd list config - section:system.webserver/security/authorization OR To verify using PowerShell enter the following command: Get-WebConfiguration -pspath 'IIS:\' -filter 'system.webServer/security/authorization' OR At the web site or application level, verify that the authorization rule configured has been applied: 1. Connect to Internet Information Services (IIS Manager) 2.

How it is fixed

Fix method: Guidance or infrastructure patch

To configure URL Authorization at the server level using command line utilities: Enter the following command in AppCmd.exe to configure: %systemroot%\system32\inetsrv\appcmd set config - section:system.webServer/security/authorization /- "[users='*',roles='',verbs='']" %systemroot%\system32\inetsrv\appcmd set config - section:system.webServer/security/authorization /+"[accessType='Allow',roles='Administrators']" OR Enter the following command in PowerShell to configure: Remove-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/security/authorization" -name "." -AtElement @{users='*';roles='';verbs=''} Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/security/authorization" -name "." -value @{accessType='Allow';roles='Administrators'} OR To configure URL Authorization at the server level using IIS Manager: 1.