Ensure 'unique application pools' is set for sites

MediaNivel 1Automatizadaiis

Descripción

Application Pool Identities allows Application Pools to be run under unique accounts without the need to create and manage local or domain accounts. It is recommended that all Sites run under unique, dedicated Application Pools. Fails when two or more sites share the same application pool. PowerShell 5.1 with the WebAdministration module; run elevated.

Cómo se verifica

Método de auditoría: Comando de shell

shell

Import-Module WebAdministration -ErrorAction Stop; $bad = @(Get-Website | Group-Object applicationPool | Where-Object { $_.Count -gt 1 }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Create a dedicated pool per site and assign it: Set-ItemProperty -Path 'IIS:\Sites\<site>' -Name applicationPool -Value <pool>.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: iisisolation
Referencia: CIS Microsoft IIS 10 Benchmark v1.2.1 - 1.5 Ensure 'unique application pools' is set for sites

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target iis