| 1. Determine the web client account (anonymous account) for the web server. |
2. Note the group memberships of this account found under the Member Of tab.
3. Open the IIS Manager > Right click on the web site for review > Select properties > Select the Home Directory tab.
4. Note the Local path entry, this will be used later.
5. Ensure the Script source access, Write, and Directory browsing check boxes are unchecked.
6. Repeat step 2 for all sub directories (including virtual directories) and files of the web site being reviewed (Directory and File tabs, respectively).
7. Note the Local path entry for the virtual directories.
8. Navigate to the local paths found in steps 4 & 7 via Windows Explorer, or equivalent, and verify the permissions assigned to the anonymous account (normally IUSR_computername).
If the any of the web sites, their sub-directories (including virtual directories), or files has Script source access, Write, or Directory browsing enabled, this is a finding.
If the anonymous account is assigned greater than read & execute permissions to any of the local paths (including their content), this is a finding.
NOTE: If the Microsoft ‘everyone’ account has access to these directories, this is a finding.