Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Very theoretical question, how secure is the mentioned configuration? (IIS7.5 and Windows 2008 R2). I don't mean things like easy passwords, open ports and unsecured c#/.net code.

I mean, are there any serious holes/hacks which ignore any user settings and that attacker is able to gain access to server?

Is it much more secure than IIS6 and Windows Server 2003 used to be? Would you put it online without putting firewall before it? (update: I mean linux/unix/hw firewall in front of windows machine. Windows firewall has to be always on)

share|improve this question
up vote 2 down vote accepted

There are no known IIS 7.5 exploits, AFAIK. Microsoft patches remote code execution holes pretty fast nowadays. That being said, I would never put anything that you care about on the internet without a firewall, that's just bad. Even the built-in Windows Firewall is a big step forward from the 2003 firewall.

Just because there are no well-known exploits doesn't mean that 1) there won't be one tomorrow and 2)that you can ignore security best practices.

share|improve this answer
I meant unix/linux/hw firewall in front of whole Windows machine. I would never switch Windows firewall off. – feronovak Aug 7 '11 at 12:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.