Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We recently had a 3rd party auditor perform a penetration test on our MS 2008 webserver that uncovered remote OS detection vulnerability. It detected the OS as well as version of IIS.

The Auditors recommended: "if Possible, configure the web server so that it does not present identifiable information in the banners"

I've done quite a bit of research and I could not find any easy way that will allow me to quickly block this information from being detected.

Does anyone know of any way to do this? Is this something that needs to be configured/denied on the server level or web application level within the code?

share|improve this question
what kind of severity did they assign this 'information disclosure' vulnerability? – sysadmin1138 Mar 6 '12 at 1:41

You can (among other features) remove the Server: header from HTTP responses with UrlScan. See the configuration reference for options.

To remove the X-Powered-By: header, in IIS manager, select the HTTP Response Header feature, and remove the ASP.NET entry

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.