Programs and features not necessary for operations must be removed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2251	WG130 IIS7	SV-32637r1_rule	ECSC-1	Low

Description
Just as running unneeded services and protocols increase the attack surface of the web server, running unneeded utilities and programs is also an added risk to the web server.

STIG	Date
IIS 7.0 WEB SERVER STIG	2013-04-11

Details

Check Text ( C-32932r3_chk )
Review programs installed on the OS. 1. Open Control Panel. 2. Open Programs and Features. 3. The following programs may be installed without any additional documentation: Administration Pack for IIS 7.0 IIS Search Engine Optimization Toolkit Microsoft .NET Framework version 3.5 SP1 or greater Microsoft Web Platform Installer version 3.x or greater Virtual Machine Additions 4. Review the installed programs, if any programs are installed other than those listed above, this is a finding. NOTE: If additional software is needed and has supporting documentation signed by the IAO, this is not a finding.

Check Text ( C-32932r3_chk )

Review programs installed on the OS.
1. Open Control Panel.
2. Open Programs and Features.
3. The following programs may be installed without any additional documentation:
Administration Pack for IIS 7.0
IIS Search Engine Optimization Toolkit
Microsoft .NET Framework version 3.5 SP1 or greater
Microsoft Web Platform Installer version 3.x or greater
Virtual Machine Additions
4. Review the installed programs, if any programs are installed other than those listed above, this is a finding.

NOTE: If additional software is needed and has supporting documentation signed by the IAO, this is not a finding.

Fix Text (F-29063r1_fix)
Remove all unapproved programs and roles from the production web server.