TMA-IIS-3.12
Ensure Server Header is removed
LowLevel 2Automatediis
Description
The server header headers specify the underlying technology used by the application. requestFiltering removeServerHeader must be true at server level (IIS 10 1709 or later). PowerShell 5.1 with the WebAdministration module; run elevated. CIS marks this recommendation Manual; the automated check implements its audit procedure.
How it is checked
Audit method: Shell command
shell
Import-Module WebAdministration -ErrorAction Stop; $c = Get-WebConfiguration -Filter 'system.webServer/security/requestFiltering' -PSPath 'MACHINE/WEBROOT/APPHOST'; if ($c.removeServerHeader -eq $true) { 'compliant' } else { 'noncompliant' }- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/security/requestFiltering -Name removeServerHeader -Value True
Properties
- Operating systems
- Any
- Tags
- iisinformation-disclosure
- Reference
- CIS Microsoft IIS 10 Benchmark v1.2.1 - 3.12 Ensure Server Header is removed
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target iis --level 2